From 5118f8d3394579a245b355c863c69410fe92e26e Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 21 May 2020 01:35:28 +0200 Subject: dovecot-auth-proxy: replace directory traversal with LDAP lookups. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This provides better isolation opportunity as the service doesn't need to run as ‘vmail’ user. We use a dedicated system user instead, and LDAP ACLs to limit its access to the strict minimum. The new solution is also more robust to quoting/escaping, and doesn't depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID instead of %d/%n at some point to make user renaming simpler). OTOH we no longer lists users that have been removed from LDAP but still have a mailstore lingering around. This is fair. --- lib/modules/openldap | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/modules/openldap') diff --git a/lib/modules/openldap b/lib/modules/openldap index 9afe1f1..219c9a6 100644 --- a/lib/modules/openldap +++ b/lib/modules/openldap @@ -61,7 +61,7 @@ indexedDN = { # 102 is postfix's UID and 106 its primary GID. # (Regular expressions are not allowed.) sasl_ext_re = re.compile( r"""(?P\sby\s+dn(?:\.exact)?)= - (?P['\"]?)username=(?P[a-z][-a-z0-9_]*), + (?P['\"]?)username=(?P_?[a-z][-a-z0-9_]*), (?Pcn=peercred,cn=external,cn=auth) (?P=quote)\s""" , re.VERBOSE ) -- cgit v1.2.3