From 7c01a383fae4d84727d6a036d93117c761b98e10 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 7 Jul 2014 05:16:53 +0200 Subject: Configure SyncRepl (OpenLDAP replication) and related ACLs. The clients are identified using their certificate, and connect securely to the SyncProv. There are a few workarounds (XXX) in the ACLs due to Postfix not supporting SASL binds in Wheezy. Overview: - Authentication (XXX: strong authentication) is required prior to any DIT operation (see 'olcRequires'). - We force a Security Strength Factor of 128 or above for all operations (see 'olcSecurity'), meaning one must use either a local connection (eg, ldapi://, possible since we set the 'olcLocalSSF' to 128), or TLS with at least 128 bits of security. - XXX: Services may not simple bind other than locally on a ldapi:// socket. If no remote access is needed, they should use SASL/EXTERNAL on a ldapi:// socket whenever possible (if the service itself supports SASL binds). If remote access is needed, they should use SASL/EXTERNAL on a ldaps:// socket, and their identity should be derived from the CN of the client certificate only (hence services may not simple bind). - Admins have restrictions similar to that of the services. - User access is only restricted by our global 'olcSecurity' attribute. --- common.yml | 2 +- lib/modules/openldap | 1 + roles/LDAP-provider/tasks/main.yml | 16 + roles/common-LDAP/tasks/main.yml | 57 +- roles/common-LDAP/templates/etc/default/slapd.j2 | 4 +- .../templates/etc/ldap/database.ldif.j2 | 825 ++++++++++----------- roles/common/templates/etc/iptables/services.j2 | 5 + 7 files changed, 479 insertions(+), 431 deletions(-) diff --git a/common.yml b/common.yml index d069ecc..48fc4df 100644 --- a/common.yml +++ b/common.yml @@ -21,7 +21,7 @@ - name: Common LDAP tasks hosts: MDA:MSA:lists:LDAP-provider:MX - gather_facts: False + gather_facts: True tags: slapd,ldap roles: - common-LDAP diff --git a/lib/modules/openldap b/lib/modules/openldap index 3f6ea39..0f0bc9a 100644 --- a/lib/modules/openldap +++ b/lib/modules/openldap @@ -37,6 +37,7 @@ indexedAttributes = frozenset([ 'olcSyncrepl', 'olcOverlay', 'olcLimits', + 'olcAuthzRegexp', ]) diff --git a/roles/LDAP-provider/tasks/main.yml b/roles/LDAP-provider/tasks/main.yml index fc9ed62..48cc8d2 100644 --- a/roles/LDAP-provider/tasks/main.yml +++ b/roles/LDAP-provider/tasks/main.yml @@ -4,4 +4,20 @@ target=etc/ldap/syncprov.ldif local=file +- name: Enable the EXTERNAL SASL mechanism + lineinfile: dest=/usr/lib/sasl2/slapd.conf + regexp='^mech_list'':' + line=mech_list':'' EXTERNAL' + owner=root group=root + mode=0644 + +- name: Copy the SyncRepls's client certificates + assemble: src=certs/ldap + remote_src=no + dest=/etc/ldap/ssl/clients.pem + owner=root group=root + mode=0644 + tags: + - genkey + # TODO: authz constraint diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml index 5aa8a2e..43c6bfb 100644 --- a/roles/common-LDAP/tasks/main.yml +++ b/roles/common-LDAP/tasks/main.yml @@ -43,6 +43,61 @@ # Not sure if required - Restart slapd +- name: Create directory /etc/ldap/ssl + file: path=/etc/ldap/ssl + state=directory + owner=root group=root + mode=0755 + tags: + - genkey + +- name: Generate a private key and a X.509 certificate for slapd + # XXX: GnuTLS (libgnutls26 2.12.20-8+deb7u2, found in Wheezy) doesn't + # support ECDSA; and slapd doesn't seem to support DHE (!?) so + # we're stuck with "plain RSA" Key-Exchange. Also, there is a bug with + # SHA-512. + command: genkeypair.sh x509 + --pubkey=/etc/ldap/ssl/{{ item.name }}.pem + --privkey=/etc/ldap/ssl/{{ item.name }}.key + --ou=LDAP {{ item.ou }} --cn={{ item.name }} + --usage=digitalSignature,keyEncipherment + -t rsa -b 4096 -h sha256 + --chown="root:openldap" --chmod=0640 + register: r3 + changed_when: r3.rc == 0 + failed_when: r3.rc > 1 + with_items: + - { group: 'LDAP-provider', name: ldap.fripost.org, ou: } + - { group: 'MX', name: mx, ou: --ou=SyncRepl } + - { group: 'lists', name: lists, ou: --ou=SyncRepl } + when: "item.group in group_names" + tags: + - genkey + +- name: Fetch slapd's X.509 certificate + # Ensure we don't fetch private data + sudo: False + fetch: src=/etc/ldap/ssl/{{ item.name }}.pem + dest=certs/ldap/ + fail_on_missing=yes + flat=yes + with_items: + - { group: 'LDAP-provider', name: ldap.fripost.org } + - { group: 'MX', name: mx } + - { group: 'lists', name: lists } + when: "item.group in group_names" + tags: + - genkey + +- name: Copy the SyncProv's server certificate + copy: src=certs/ldap/ldap.fripost.org.pem + dest=/etc/ldap/ssl/ldap.fripost.org.pem + owner=root group=root + mode=0644 + tags: + - genkey + when: "'LDAP-provider' not in group_names" + - name: Copy fripost & amavis' schema copy: src=etc/ldap/schema/{{ item }} dest=/etc/ldap/schema/{{ item }} @@ -74,6 +129,6 @@ - name: Start slapd service: name=slapd state=started - when: not (r1.changed or r2.changed) + when: not (r1.changed or r2.changed or r3.changed) - meta: flush_handlers diff --git a/roles/common-LDAP/templates/etc/default/slapd.j2 b/roles/common-LDAP/templates/etc/default/slapd.j2 index 92b3b22..f652f9a 100644 --- a/roles/common-LDAP/templates/etc/default/slapd.j2 +++ b/roles/common-LDAP/templates/etc/default/slapd.j2 @@ -20,11 +20,11 @@ SLAPD_PIDFILE= # service requests on TCP-port 636 (ldaps) and requests via unix # sockets. SLAPD_SERVICES="ldapi:///" -{% for i in postfix_instance.keys() | intersect(group_names) | list %} +{% for i in ['IMAP','MX','lists'] | intersect(group_names) | sort %} SLAPD_SERVICES="$SLAPD_SERVICES ldapi://%2Fvar%2Fspool%2Fpostfix-{{ postfix_instance[i].name }}%2Fprivate%2Fldapi/" {% endfor %} {% if 'LDAP-provider' in group_names %} -SLAPD_SERVICES="$SLAPD_SERVICES ldap://172.16.0.1:389/" +SLAPD_SERVICES="$SLAPD_SERVICES ldaps:///" {% endif %} # If SLAPD_NO_START is set, the init script will not start or restart diff --git a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 index af31836..291b5cb 100644 --- a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 +++ b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 @@ -1,5 +1,5 @@ # Fripost's LDAP database definition -# Copyright (c) 2013 Guilhem Moulin +# Copyright (c) 2013-2014 Guilhem Moulin # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -14,25 +14,67 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . +# There are a couple of XXX in this file, due to Postfix not supporting +# SASL binds in Wheezy. + +dn: cn=config +objectClass: olcGlobal +cn: config +olcArgsFile: /var/run/slapd/slapd.args +olcPidFile: /var/run/slapd/slapd.pid +olcLogLevel: none +olcToolThreads: 1 +{% if ansible_processor_vcpus > 4 %} +olcThreads: {{ 2 * ansible_processor_vcpus }} +{% else %} +olcThreads: 8 +{% endif %} +{% if 'LDAP-provider' in group_names %} +olcTLSCertificateFile: /etc/ldap/ssl/ldap.fripost.org.pem +olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.fripost.org.key +olcTLSCACertificateFile: /etc/ldap/ssl/clients.pem +olcTLSVerifyClient: allow +olcAuthzRegexp: "^cn=([^,]+),ou=SyncRepl,ou=LDAP,ou=SSLcerts,o=Fripost$" + "cn=$1,ou=replicates,o=mailHosting,dc=fripost,dc=org" +olcSaslSecProps: minssf=128,noanonymous,noplain,nodict +# XXX We would like to say 'PFS' here, but Wheezy'z GnuTLS (libgnutls26 +# 2.12.20-8+deb7u2) is too old :-( (Also, DHE/ECDHE are not supported.) +olcTLSCipherSuite: SECURE128:!CIPHER-ALL:+AES-128-CBC:+AES-256-CBC:!MD5 +{% endif %} +olcLocalSSF: 128 +# /!\ This is not portable! But we only use glibc's crypt(3), which +# supports (salted, streched) SHA512 +olcPasswordHash: {CRYPT} +olcPasswordCryptSaltFormat: $6$%s + + dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDbDirectory: /var/lib/ldap/fripost olcSuffix: o=mailHosting,dc=fripost,dc=org +{% if 'LDAP-provider' not in group_names and ('MX' in group_names or 'lists' in group_names) %} +olcReadOnly: TRUE +{% endif %} +{% if 'LDAP-provider' in group_names %} olcLastMod: TRUE olcDbCheckpoint: 512 15 -# Require LDAPv3 protocol and authentication prior to directory -# operations. -olcRequires: LDAPv3 -# TODO: how 'olcAddContentAcl' affects the test suite? -olcAddContentAcl: TRUE +{% else %} +olcLastMod: FALSE +{% endif %} # The root user has all rights on the whole database (when SASL-binding # on a UNIX socket). olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth +# Ensure that all DIT access is made according to the LDAPv3 protocol, +# and must use 1/ authentication, and 2/ SASL or TLS. (Local clients +# should use ldapi:// and SASL/EXERNAL, while remote clients should use +# TLS.) +# XXX: olcRequires: none LDAPv3 authc strong +olcRequires: none LDAPv3 authc +olcSecurity: simple_bind=128 ssf=128 update_ssf=128 # # ######################################################################## -######################################################################## # Performance considerations # # To reindex an existing database, you have to @@ -40,14 +82,23 @@ olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth # * Reindex su openldap -c "slapindex -b 'o=mailHosting,dc=fripost,dc=org'" # * Restart slapd sudo service slapd start # +olcDbIndex: objectClass eq +# Let us make Postfix's life easier. +{% if 'MX' in group_names or 'MDA' in group_names %} +olcDbIndex: fripostIsStatusActive,fvd,fvl eq +{% endif %} +{% if 'MX' in group_names %} +olcDbIndex: fripostOptionalMaildrop pres +{% endif %} +{% if ('LDAP-provider' not in group_names and + ('MX' in group_names or 'lists' in group_names)) or + 'LDAP-provider' in group_names and + (groups.MX | difference([inventory_hostname]) > 1 or + groups.lists | difference([inventory_hostname]) > 1) %} +# SyncProv/SyncRepl specific indexing. +olcDbIndex: entryCSN,entryUUID eq +{% endif%} # -# On single- and dual-core systems, change the maximum number of threads -# to 8. (The default, 16, is fine for 4- and 8-core systems.) -# -# dn: cn=config -# changetype: modify -# add: olcThreads -# olcThreads: 8 # # References # - https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning_5.0 @@ -56,68 +107,88 @@ olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth # - http://www.openldap.org/faq/data/cache/136.html # - http://www.zytrax.com/books/ldap/apa/indeces.html # -olcDbIndex: objectClass eq -# Let us make Postfix's life easier. TODO: only if MX, lists.f.o, MDA, etc. -olcDbIndex: fripostIsStatusActive,fvd,fvl eq -olcDbIndex: fripostOptionalMaildrop pres -# SyncProv/SyncRepl specific indexing. -olcDbIndex: entryCSN,entryUUID eq # -# -######################################################################## ######################################################################## # Sync Replication -# TODO: replace the simple bind by Kerberos/GSSAPI # # References: # - http://www.openldap.org/doc/admin24/replication.html#Syncrepl # - http://www.zytrax.com/books/ldap/ch7/#ol-syncrepl-rap # {% if 'LDAP-provider' in group_names %} -olcLimits: dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" +{% if groups.MX | difference([inventory_hostname]) > 1 %} +olcLimits: dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited -olcLimits: dn.exact="cn=lists-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" +{% endif %} +{% if groups.lists | difference([inventory_hostname]) > 1 %} +olcLimits: dn.exact="cn=lists,ou=replicates,o=mailHosting,dc=fripost,dc=org" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited -{% elif 'MX' in group_names %} +{% endif %} +{% endif %} +{% if 'MX' in group_names and 'LDAP-provider' not in group_names %} olcSyncrepl: rid=000 - provider=ldap://ldap.fripost.org + provider=ldaps://ldap.fripost.org type=refreshAndPersist - retry="5 5 300 +" + retry="10 30 300 +" searchbase="ou=virtual,o=mailHosting,dc=fripost,dc=org" attrs=objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop,fripostPostmaster,fripostOwner scope=sub + sizelimit=unlimited schemachecking=off - bindmethod=simple - binddn="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" - credentials=mx -{% elif 'lists' in group_names %} -# XXX: mlmmj is not compatible with the MX, see -# http://mlmmj.org/bugs/bug.php?id=51 + bindmethod=sasl + saslmech=external + tls_cert=/etc/ldap/ssl/mx.pem + tls_key=/etc/ldap/ssl/mx.key + tls_cacert=/etc/ldap/ssl/ldap.fripost.org.pem + tls_reqcert=hard +{% endif %} +{% if 'lists' in group_names and 'LDAP-provider' not in group_names %} olcSyncrepl: rid=001 - provider=ldap://ldap.fripost.org + provider=ldaps://ldap.fripost.org type=refreshAndPersist - retry="5 5 300 +" + retry="10 30 300 +" searchbase="ou=virtual,o=mailHosting,dc=fripost,dc=org" attrs=objectClass,fvd,fvl,fripostListManager,fripostOwner scope=sub + sizelimit=unlimited schemachecking=off - bindmethod=simple - binddn="cn=lists-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" - credentials=lists + bindmethod=sasl + saslmech=external + tls_cert=/etc/ldap/ssl/lists.pem + tls_key=/etc/ldap/ssl/lists.key + tls_cacert=/etc/ldap/ssl/ldap.fripost.org.pem + tls_reqcert=hard {% endif %} # # ######################################################################## -######################################################################## # Access control # /!\ WARN: All modification to the ACL should be reflected to the test # /!\ suite as well! +olcAddContentAcl: TRUE +# +# Overview: +# - Authentication (XXX: strong authentication) is required prior to any DIT +# operation (see 'olcRequires'). +# - We force a Security Strength Factor of 128 or above for all operations (see +# 'olcSecurity'), meaning one must use either a local connection (eg, +# ldapi://, possible since we set the 'olcLocalSSF' to 128), or TLS with at +# least 128 bits of security. +# - XXX: Services may not simple bind other than locally on a ldapi:// socket. +# If no remote access is needed, they should use SASL/EXTERNAL on a ldapi:// +# socket whenever possible (if the service itself supports SASL binds). +# If remote access is needed, they should use SASL/EXTERNAL on a ldaps:// +# socket, and their identity should be derived from the CN of the client +# certificate only (hence services may not simple bind). +# - Admins have restrictions similar to that of the services. +# - User access is only restricted by our global 'olcSecurity' attribute. +# # # References: # - http://www.openldap.org/doc/admin24/access-control.html @@ -126,423 +197,323 @@ olcSyncrepl: rid=001 # - http://www.openldap.org/faq/data/cache/1133.html # - man 5 slapd.access # -# -######################################################################## -# Most common services: Postfix, Amavis, Dovecot -# (Most used ACLs are cheaper when written first.) -# -# Postfix have read access to the attribute it needs when eg, doing -# alias resolution. -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=entry,objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop - filter=(&(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList))(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE))) - by dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by realanonymous =rsd - by users =0 break -# -# Search domain owners / postmasters (used by reserved-alias.pl). -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=entry,objectClass,fvd,fvl,fripostPostmaster,fripostOwner - filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE))) - by dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by dn.exact="username=nobody,cn=peercred,cn=external,cn=auth" =rsd - by users =0 break -# -# List replicates -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=entry,objectClass,fvd,fvl,fripostListManager,fripostOwner - filter=(&(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualList))(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE))) - by dn.exact="cn=lists-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by realanonymous =rsd - by users =0 break -# -# The following is required for the content filter -{% if 'MDA' in group_names %} -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - attrs=entry - filter=(&(objectClass=FripostVirtualDomain)(!(fripostIsStatusActive=FALSE))) - by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" =s - by users =0 break -olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - attrs=entry,objectClass,fvl,@AmavisAccount - filter=(&(objectClass=FripostVirtualUser)(objectClass=AmavisAccount)(fripostIsStatusActive=TRUE)) - by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" =rsd - by users =0 break -# -# The following is required for the userdb -olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - attrs=entry,objectClass - filter=(objectClass=FripostVirtualUser) - by dn.exact="username=dovecot,cn=peercred,cn=external,cn=auth" =rsd - by users =0 break -{% endif %} -# -# Anonymous can authenticate into the services. (But not read or write the password.) -olcAccess: to dn.one="ou=services,o=mailHosting,dc=fripost,dc=org" - attrs=userPassword - by realanonymous =xd -# -# The following is required for SASL proxy Authorize the web application. -olcAccess: to dn.exact="cn=AdminWebPanel,ou=services,o=mailHosting,dc=fripost,dc=org" - attrs=entry,objectClass,authzTo - by realanonymous =x -# -# The following is required for Sync Replication. -{% if 'LDAP-provider' in group_names %} -olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=entry,objectClass - filter=(objectClass=FripostVirtual) - by dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by dn.exact="cn=lists-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by users =0 break -olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=structuralObjectClass,createTimestamp,creatorsName,entryDN,entryUUID,modifiersName,modifyTimestamp,hasSubordinates,subschemaSubentry - by dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by dn.exact="cn=lists-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd - by users =0 break -{% endif %} -# -# 1. The WebPanel itself cannot bind, read or write passwords. This -# guarantees that, if an attacker gains its priviledge, it will *not* be -# able to change user passwords (which would allow him/her to read every -# emails). This is a trick to tackle the absence of 'realgroup'. -# 2. Anonymous users can bind. -# 3. Users can change their password (but not read it). -# 4. The postmaster of a domain can change (replace) his/her users' password (but not read it). +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# User Passwords: +# +# * Anonymous users are allowed to simple bind through TLS-protected +# connections. +# * Anonymous users are allowed to simple bind when connecting to a +# local ldapi:// socket (when using auth_binds, Dovecot delegates +# authentication to the LDAP server). +# * Authenticated users are allowed to change (ie replace) their +# password through TLS-protected connections, but read access is not +# granted. +# * Domain postmasters are allowed to change (ie replace) their users' +# password through TLS-protected connections, but read access is not +# granted. +# * The same goes for general admins. +# * The same goes for local admins. olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" filter=(objectClass=FripostVirtualUser) attrs=userPassword - by realdn.exact="uid=AdminWebPanel@fripost.org,cn=auth" =0 - by realanonymous =xd - by realself =w - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =w - by dn.onelevel="ou=managers,o=mailHosting,dc=fripost,dc=org" =w + by realanonymous tls_ssf=128 =xd + by realanonymous sockurl.regex="^ldapi://" =xd + by realself tls_ssf=128 =w + by group/FripostVirtualDomain/fripostPostmaster.expand="$1" tls_ssf=128 =w + by dn.onelevel="ou=admins,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =w + by dn.exact="username=guilhem,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =w +# +# XXX +# * Anonymous users are allowed to simple bind as Postfix, but only when +# using a local ldapi:// listener from one of the Postfix instance +# (which should be accessible by the 'postfix' UNIX user only). +olcAccess: to dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" + attrs=userPassword + by realanonymous sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =xd +# +# TODO: are there other services which need to be able to simple bind? # -# A catch-all, to be sure that noone else have access to the passwords. +# * Catch-all: no one else may access the passwords (including simple +# bind). olcAccess: to dn.subtree="o=mailHosting,dc=fripost,dc=org" attrs=userPassword by * =0 # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Base # -######################################################################## -# Virtual subtree, pending token and general access -# -# 1. Users need further access. We use a set to deny all access to non-users without -# having a need for an expensive LDAP search (URL) in the AuthzTo. -# /!\ The objectClass "FripostVirtualUser" is case-sensitive in this case! -# 2,3. Services that need particular access on the tree. -# 4. Managers have read/write access to the "virtual" subtree. -olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" - by set.exact="user/objectClass & [FripostVirtualUser]" =0 break - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=org" =0 break - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" =0 break - by dn.onelevel="ou=managers,o=mailHosting,dc=fripost,dc=org" =wrscd -# -# Only the domain Postmasters and Owners can delete the 'pending' status on domains. -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(&(objectClass=FripostVirtualDomain)(objectClass=FripostPendingEntry)) - attrs=objectClass val=FripostPendingEntry - by dnattr=fripostPostmaster =z break - by dnattr=fripostOwner =z break - by * =0 break -# -# The list creation service can delete the 'pending' status on lists and list commands. -olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) - attrs=objectClass val=FripostPendingEntry - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=org" =z break - by * +0 break -# -# ObjectClass is a public attribute: everyone can read and search it. -olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=objectClass - by * +rscd -# -# The pending token is not public, but domain owner and postmasters can check their and -# delete it (if the token matches, but the check is done on the library side). -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(&(objectClass=FripostVirtualDomain)(objectClass=FripostPendingEntry)) - attrs=fripostPendingToken - by dnattr=fripostPostmaster =zcd break - by dnattr=fripostOwner =zcd break - by * +0 break -# -# The list creation service can delete the 'pending' status on lists and list commands. -olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) - attrs=fripostPendingToken - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=org" +z - by * +0 -# -# The cleaning service can list the (expired) pending entries and delete them. -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(objectClass=FripostPendingEntry) - attrs=entry - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" =zrd break - by * =0 break -# -# One can search search everywhere in the virtual tree. -olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" - attrs=entry - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" +s - by * =s break -# -# We're giving away create/delete access on the children attributes, but we will be carefull -# with the 'entry' permissions. +# * The SyncRepl replicates may use the base as a searchBase, when using +# a TLS-protected connection. +# * So can Dovecot on the MDA (for the iterate filter), when +# SASL-binding using the EXTERNAL mechanism and connecting to a local +# ldapi:// socket. olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org" + attrs=entry,objectClass filter=(objectClass=FripostVirtual) - attrs=children - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" =w - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" =z -olcAccess: to dn.one="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(objectClass=FripostVirtualDomain) - attrs=children - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" =z - by * break -olcAccess: to dn.one="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))(!(objectClass=FripostVirtualAliasDomain))) - attrs=children - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" =w -# -# The cleaning service needs to know when entries have been created. -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(objectClass=FripostPendingEntry) - attrs=createTimestamp - by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=org" =s -# -# Users can use these in filters (e.g., to list the entries they have created). -olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)) - attrs=fripostOwner,fripostPostmaster,fripostCanAddAlias,fripostCanAddList - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" =s break -# -# -######################################################################## -# Virtual subtree, domains -# -# 1. The postmaster of a domain can give (or take back) people the right to create -# aliases. -# 2,3. People that can create aliases can list the members of the group. + {% if 'LDAP-provider' in group_names -%} + {% if groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if groups.lists | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=lists,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% endif -%} + {% if 'MDA' in group_names -%} + by dn.exact="username=dovecot,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =sd + {% endif -%} + by users =0 break +# +# * Only SyncRepl replicates may access operational attributes in the +# subtree, when using a TLS-protected connection. +olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" + attrs=structuralObjectClass,createTimestamp,creatorsName,entryDN,entryUUID,modifiersName,modifyTimestamp,hasSubordinates,subschemaSubentry + {% if 'LDAP-provider' in group_names -%} + {% if groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if groups.lists | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=lists,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% endif -%} + by * =0 +# +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Domain entries +# +# * The SyncRepl replicates have read access to the entry itself, when +# using a TLS-protected connection. +# * So has Postfix, when connecting a local ldapi:// socket from the +# 'private' directory in one of the non-default instance's chroot. +# * So has Dovecot on the MDA (for the iterate filter), when +# SASL-binding using the EXTERNAL mechanism and connecting to a local +# ldapi:// socket. +# * Amavis may use the entry as searchBase (required to look for the +# per-user preferences) but doesn't have read access to the entry. +# * The 'nobody' UNIX user has read access on the MX:es, when using +# SASL-binding using the EXTERNAL mechanism and connecting to a local +# ldapi:// socket. This is required for the 'reserved-alias.pl' +# script. olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) - attrs=fripostCanAddAlias - by dnattr=fripostPostmaster =wrscd - by dnattr=fripostOwner =rscd - by set.exact="this/fripostCanAddAlias & (user | user/-1)" =rscd -# -# 1. The postmaster of a domain can give (or take back) people the right to create lists. -# 2,3. People that can create lists can list the members of the group. + attrs=entry,objectClass,fvd + filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))) + {% if 'LDAP-provider' in group_names -%} + {% if groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if groups.lists | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=lists,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% endif -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% if 'MDA' in group_names -%} + by dn.exact="username=dovecot,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =sd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="username=nobody,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + {% endif -%} + by users =0 break +# +# * The SyncRepl MX replicates can check whether a virtual domain is +# active, and read the destination address for catch-alls, when using +# a TLS-protected connection. +# * So can Postfix on the MX:es, when connecting a local ldapi:// socket +# from the 'private' directory in one of the non-default instance's +# chroot. +{% if 'MX' in group_names or ('LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1) %} olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) - attrs=fripostCanAddList - by dnattr=fripostPostmaster =wrscd - by dnattr=fripostOwner =rscd - by set.exact="this/fripostCanAddList & (user | user/-1)" =rscd -# -# 1-3. Noone (but the managers) can appoint domain Owners or Postmasters. -# But people that can create aliases and lists can list the members of their group. + attrs=fripostIsStatusActive,fripostOptionalMaildrop + filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))) + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} +# +# * The 'nobody' UNIX user can list the domain owners and postmasters on +# the MX:es, when SASL-binding using the EXTERNAL mechanism and +# connecting to a local ldapi:// socket. This is required for the +# 'reserved-alias.pl' script. +{% if 'MX' in group_names %} olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) attrs=fripostOwner,fripostPostmaster - by dnattr=fripostOwner =rscd - by dnattr=fripostPostmaster =rscd - by set.exact="(this/fripostCanAddAlias | this/fripostCanAddList) & (user | user/-1)" =rscd - by dn.onelevel,expand="$0" +d - by * +0 -# -# 1. Domain owners can edit their entry's attributes. -# 2. So can domain postmasters. -# 3. Domain users can read the public domain attributes. -# 4. So can users with "canAddAlias" or "canAddList" access. -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) - attrs=fvd,fripostIsStatusActive,description - by dnattr=fripostOwner =wrscd - by dnattr=fripostPostmaster =wrscd - by dn.onelevel,expand="$0" =rscd - by set.exact="(this/fripostCanAddAlias | this/fripostCanAddList) & (user | user/-1)" =rscd -# -# 1. Domain owners can edit their entry's attributes. -# 2. So can domain postmasters. -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) - attrs=@fripostVirtualDomain - by dnattr=fripostOwner =wrscd - by dnattr=fripostPostmaster =wrscd - by * +0 -# -# Users with "addDomain" access can create new entries, but only if -# there is a pending token. -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(&(objectClass=FripostVirtualDomain)(objectClass=FripostPendingEntry)(fripostPendingToken=*)) - attrs=entry - by set.exact="this/-1/fripostCanAddDomain & (user | user/-1)" +a break - by * +0 break -# -# 1. Domain owners can delete their domain (and read the entry). -# 2. So can domain postmasters. -# 3. Domain users can read the domain entry (but not delete it). -# 4. So can users with "canAddAlias" or "canAddList" rights. -olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - filter=(objectClass=FripostVirtualDomain) - attrs=entry - by dnattr=fripostOwner +zrd - by dnattr=fripostPostmaster +zrd - by dn.onelevel,expand="$0" +rd - by set.exact="(this/fripostCanAddAlias | this/fripostCanAddList) & (user | user/-1)" +rd - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" +0 -# -# Reserved local parts are reserved. /!\ The case must be insensitive -# - postmaster: RFC 822, appendix C.6 -# - abuse: RFC 2142, section 4 -olcAccess: to dn.regex="^fvl=(postmaster|abuse),fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" - by * =0 + filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))) + by dn.exact="username=nobody,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + by users =0 break +{% endif %} # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Alias domain entries # -######################################################################## -# Virtual subtree, users +# * The SyncRepl MX replicates have read access to the entry itself and +# the destination domain it aliases to, when using a TLS-protected +# connection. +# * So has Postfix on the MX:es, when connecting a local ldapi:// socket +# from the 'private' directory in one of the non-default instance's +# chroot. +{% if 'MX' in group_names or ('LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1) %} +olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry,fripostMaildrop + filter=(&(objectClass=FripostVirtualAliasDomain)(!(objectClass=FripostPendingEntry))) + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} # -# Users and their postmaster can read the quota (but not change it). -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# User entries +# +# * The SyncRepl replicates have read access to the entry itself, when +# using a TLS-protected connection. +# * So has Postfix, when connecting a local ldapi:// socket from the +# 'private' directory in one of the non-default instance's chroot. +# * So has Dovecot on the MDA (for the iterate filter), when +# SASL-binding using the EXTERNAL mechanism and connecting to a local +# ldapi:// socket. +# * So has Amavis on the MDA, when SASL-binding using the EXTERNAL +# mechanism and connecting to a local ldapi:// socket. +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry,objectClass,fvl filter=(objectClass=FripostVirtualUser) - attrs=fripostUserQuota - by self =rscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =rscd -# -# 1. Users can modify their own entry. -# 2. So can their postmasters. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% if 'MDA' in group_names -%} + by dn.exact="username=dovecot,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + {% endif -%} + by users =0 break +# +# * The SyncRepl MX replicates can check whether a virtual user is +# active, when using a TLS-protected connection. +# * So can Postfix on the MX:es, when connecting a local ldapi:// socket +# from the 'private' directory in one of the non-default instance's +# chroot. +{% if 'MX' in group_names or ('LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1) %} +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=fripostIsStatusActive filter=(objectClass=FripostVirtualUser) - attrs=@FripostVirtualUser - by self =wrscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} +{% if 'MDA' in group_names %} # -# 1. Users can read their entry (but not delete it). -# 2. Postmasters can create users (but not delete them). -# (Provided that they have +a access to the parent's "children" attribute.) -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualUser) - attrs=entry - by self +rd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +ard +# * Amavis can look for per-user configuration options, when +# SASL-binding using the EXTERNAL mechanism and connecting to a local +# ldapi:// socket. +# TODO: we need a fripostUseContentFilter here +# filter=(&(objectClass=FripostVirtualUser)(objectClass=AmavisAccount)(fripostIsStatusActive=TRUE)(fripostUseContentFilter=TRUE)) +# TODO: only allow it to read the configuration options users are allowed +# to set and modify. +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=@AmavisAccount + filter=(&(objectClass=FripostVirtualUser)(objectClass=AmavisAccount)(fripostIsStatusActive=TRUE)) + by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + by users =0 break # +# * Dovecot can look for user quotas, when SASL-binding using the +# EXTERNAL mechanism and connecting to a local ldapi:// socket. +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=fripostUserQuota + filter=(objectClass=FripostVirtualUser) + by dn.exact="username=dovecot,cn=peercred,cn=external,cn=auth" sockurl.regex="^ldapi://" =rsd + by users =0 break +{% endif %} # -######################################################################## -# Virtual subtree, aliases +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Alias entries # -# 1. The alias owner can list the ownership of the entry. -# 2. The domain owner can add/delete/change the ownership of the entry. -# 3. So can the domain postmasters. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualAlias) - attrs=fripostOwner - by dnattr=fripostOwner =rscd continue - by group/FripostVirtualDomain/fripostOwner.expand="$1" =wrscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd - by * +0 -# -# 1. The alias owners can edit the rest of their entry's attributes. -# 2. So can the domain owners. -# 3. So can the domain postmasters. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualAlias) - attrs=@FripostVirtualAlias - by dnattr=fripostOwner =wrscd - by group/FripostVirtualDomain/fripostOwner.expand="$1" =wrscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd -# -# 1. The alias owners can read and delete the entry. -# 2. So can the domain owner. -# 3. So can the domain postmaster. -# 4. Users with "canAddAlias" access (either explicitely, or as a wildcard) for the domain can create aliases for that domain. -# (But *not* delete them, unless also owner.) -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" +# * The SyncRepl MX replicates can read the entry itelf, whether it +# is active, and the address(es) it aliases to, when using a +# TLS-protected connection. +# * So can Postfix on the MX:es, when connecting a local ldapi:// socket +# from the 'private' directory in one of the non-default instance's +# chroot. +{% if 'MX' in group_names or ('LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1) %} +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry,objectClass,fvl,fripostMaildrop,fripostIsStatusActive filter=(objectClass=FripostVirtualAlias) - attrs=entry - by dnattr=fripostOwner +zrd continue - by group/FripostVirtualDomain/fripostOwner.expand="$1" +wrd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +wrd - by set.exact="this/-1/fripostCanAddAlias & (user | user/-1)" +a - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" +0 + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# List entries +# +# * The SyncRepl replicates can read the entry itelf and the list manager, when +# using a TLS-protected connection. +# * So can Postfix on the MX:es and lists managers, when connecting a local +# ldapi:// socket from the 'private' directory in one of the non-default +# instance's chroot. +# XXX: where does sympa enter the picture? we really don't want to reintroduce listcomands... +{% if 'MX' in group_names or 'lists' in group_names or ('LDAP-provider' in group_names and + (groups.lists | difference([inventory_hostname]) > 1 or groups.MX | difference([inventory_hostname]) > 1)) %} +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry,objectClass,fvl,fripostListManager + filter=(&(objectClass=FripostVirtualList)(!(objectClass=FripostPendingEntry))) + {% if 'LDAP-provider' in group_names -%} + {% if groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if groups.lists | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=lists,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% endif -%} + {% if 'MX' in group_names or 'lists' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} # -######################################################################## -# Virtual subtree, lists +# * The SyncRepl MX replicates can check whether a virtual list is +# active when using a TLS-protected connection. +# * So can Postfix on the MX:es, when connecting a local ldapi:// socket +# from the 'private' directory in one of the non-default instance's +# chroot. +{% if 'MX' in group_names or ('LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1) %} +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=fripostIsStatusActive + filter=(&(objectClass=FripostVirtualList)(!(objectClass=FripostPendingEntry))) + {% if 'LDAP-provider' in group_names and groups.MX | difference([inventory_hostname]) > 1 -%} + by dn.exact="cn=mx,ou=replicates,o=mailHosting,dc=fripost,dc=org" tls_ssf=128 =rsd + {% endif -%} + {% if 'MX' in group_names -%} + by dn.exact="cn=postfix,ou=services,o=mailHosting,dc=fripost,dc=org" sockurl.regex="^ldapi://%2Fvar%2Fspool%2Fpostfix-[-[:alnum:]]+%2Fprivate%2F" =rsd + {% endif -%} + by users =0 break +{% endif %} +{% if 'LDAP-provider' in group_names %} # -# 1. The list owner can list the ownership of the entry. -# 2. The domain owner can add/delete/change the ownership of the entry. -# 3. So can the domain postmasters. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualList) - attrs=fripostOwner - by dnattr=fripostOwner =rscd continue - by group/FripostVirtualDomain/fripostOwner.expand="$1" =wrscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd - by * +0 -# -# 1. The list owner read (but not edit) the transport-related attributes. -# 2. So can the domain ower. -# 3. So can the domain postmaster. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualList) - attrs=fripostListManager - by dnattr=fripostOwner =rscd - by group/FripostVirtualDomain/fripostOwner.expand="$1" =rscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =rscd -# -# 1. The list owners can edit their entry's attributes. -# 2. So can the domain owners. -# 3. So can the domain postmasters. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualList) - attrs=@FripostVirtualList - by dnattr=fripostOwner =wrscd - by group/FripostVirtualDomain/fripostOwner.expand="$1" =wrscd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd -# -# 1. The domain owner can create and delete lists, but only those with a 'pending' status -# 2. So can the domain postmaster. -# 3. The list owner can delete pending lists. -# 4. The entry creator can delete pending lists (needed to be able to rollback). -# 5. People with "canAddList" access can create lists, but only with a 'pending' status. -# 6. The list creation service can search and browse the entry. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) - attrs=entry - by group/FripostVirtualDomain/fripostOwner.expand="$1" +w break - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +w break - by dnattr=fripostOwner +z continue - by dnattr=creatorsName +z continue - by set.exact="this/-1/fripostCanAddList & (user | user/-1)" +a break - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=org" +rd - by * +0 break -# -# 1. The list owners can read the entry. -# 2. So can the domain's Owner. -# 3. So can the domain's Postmaster. -olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" - filter=(objectClass=FripostVirtualList) - attrs=entry - by dnattr=fripostOwner +rd - by group/FripostVirtualDomain/fripostOwner.expand="$1" +rd - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +rd - by * +0 +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# TODO: allow users to edit their entry, etc # +{% endif %} # -######################################################################## -# Catchall +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Catch-all # -# Users with "canAddDomain" access can see that they have the right -# to create domains. -olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(objectClass=FripostVirtual) - attrs=entry - by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" +rd -olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org" - filter=(objectClass=FripostVirtual) - attrs=fripostCanAddDomain - by set.exact="this/fripostCanAddDomain & (user | user/-1)" =rscd -# Catch the break above -olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=org" +# * Catch all the breaks above. +# * Deny any access to everyone else. +olcAccess: to dn.subtree="o=mailHosting,dc=fripost,dc=org" by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" +0 + by * =0 + # vim: set filetype=ldif : diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2 index f382ea3..4e78d1e 100644 --- a/roles/common/templates/etc/iptables/services.j2 +++ b/roles/common/templates/etc/iptables/services.j2 @@ -13,6 +13,11 @@ out udp 123 123 # NTP {% endif %} in tcp {{ ansible_ssh_port|default('22') }} # SSH +{% if 'LDAP-provider' in group_names %} +in tcp 636 # LDAPS +{% elif 'MX' in group_names or 'lists' in group_name %} +out tcp 636 # LDAPS +{% endif %} {% if 'MX' in group_names %} in tcp 25 # SMTP {% endif %} -- cgit v1.2.3