diff options
| -rw-r--r-- | fripost-docs.org | 224 |
1 files changed, 147 insertions, 77 deletions
diff --git a/fripost-docs.org b/fripost-docs.org index f6198ee..73b0982 100644 --- a/fripost-docs.org +++ b/fripost-docs.org @@ -672,23 +672,30 @@ Jamm's (http://jamm.sourceforge.net/howto/html/implementation.html). dc=mail, dc=fripost, dc=org |- ou=mailboxes - | |- mail=user1@fripost.org - | | mail: user1@fripost.org - | | maildir: user1/ - | | mailLocalAddress: user1-alias@fripost.org + | |- uid=user1@fripost.org + | | uid: user1@fripost.org + | | userPassword: xxxxxx + | | maildir: fripost.org/user1/ | | isActive: TRUE + | | |- mailTarget=user1@fripost.org + | | | mailTarget: user1@fripost.org + | | | mailLocalAddress: user1-alias@example.org + | | | isActive: TRUE + | | `- dc=example.org + | | dc: example.org + | | isActive: TRUE + | | `- mailTarget=user1@fripost.org + | | | mailTarget: user1@fripost.org + | | | mailLocalAddress: user1@example.org + | | | isActive: TRUE + | | | + | | `- mailTarget=user1-alias@fripost.org | | - | `- mail=user2@fripost.org + | `- uid=user2@fripost.org | |- ou=domains - | |- dc=fripost.org - | | dc: fripost.org - | | isActive: TRUE - | | - | `- dc=example.org - | dc: example.org - | owner: mail=user1@fripost.org, ou=mailboxes, dc=mail, dc=fripost, dc=org - | mailLocalAddress: user1@example.org + | `- dc=fripost.org + | dc: fripost.org | isActive: TRUE | |- ou=managers @@ -707,28 +714,38 @@ Jamm's (http://jamm.sourceforge.net/howto/html/implementation.html). dn: cn=mail.fripost.org,cn=schema,cn=config objectClass: olcSchemaConfig cn: mail.fripost.org - olcAttributeTypes: ( 1.3.6.1.4.1.12461.1.1.1 NAME 'maildir' + olcAttributeTypes: ( 1.3.6.1.4.1.7914.1.2.1.1 NAME 'maildir' DESC 'The path to the maildir.' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) - olcAttributeTypes: ( 1.3.6.1.4.1.12461.1.1.3 NAME 'quota' + olcAttributeTypes: ( 1.3.6.1.4.1.7914.1.2.1.2 NAME 'quota' DESC 'The quota on a mailbox e.g., "50MB".' - EQUALITY caseExactIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) - olcAttributetypes: ( 1.3.6.1.4.1.12461.1.1.4 NAME 'isActive' + EQUALITY caseExactMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 SINGLE-VALUE ) + olcAttributetypes: ( 1.3.6.1.4.1.7914.1.2.1.3 NAME 'isActive' DESC 'Is the leaf active?' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + olcAttributeTypes: ( 1.3.6.1.4.1.7914.1.2.1.4 NAME 'mailTarget' + DESC 'The target of e-mail virtual aliases.' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectclasses: ( 1.3.6.1.4.1.12461.1.2.1 NAME 'virtualDomain' SUP top STRUCTURAL - DESC 'Virtual Domains' + DESC 'Virtual Domains.' MUST ( dc $ isActive ) - MAY ( owner $ mailLocalAddress $ description ) ) - olcObjectclasses: ( 1.3.6.1.4.1.12461.1.2.2 NAME 'virtualMailbox' + MAY ( description ) ) + olcObjectclasses: ( 1.3.6.1.4.1.12461.1.2.2 NAME 'virtualAliases' SUP top STRUCTURAL - DESC 'Virtual Mailboxes' - MUST ( mail $ userPassword $ maildir $ isActive ) - MAY ( mailLocalAddress $ gn $ sn $ quota ) ) + DESC 'Virtual Aliases.' + MUST ( mailTarget $ isActive ) + MAY ( mailLocalAddress ) ) + olcObjectclasses: ( 1.3.6.1.4.1.12461.1.2.3 NAME 'virtualMailbox' + SUP top STRUCTURAL + DESC 'Virtual Mailboxes.' + MUST ( uid $ userPassword $ maildir $ isActive ) + MAY ( gn $ sn $ quota ) ) + Note: For the meaning of the sequences of digits above, grep the output of `ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config"' @@ -788,10 +805,13 @@ be looking for e.g., the `mail' attribute. olcDbIndex: dc eq,sub - add: olcDbIndex - olcDbIndex: mail eq,sub + olcDbIndex: uid eq,sub - add: olcDbIndex olcDbIndex: mailLocalAddress eq + - + add: olcDbIndex + olcDbIndex: isActive eq ldapmodify -QY EXTERNAL -H ldapi:/// -f /etc/ldap/local/mail.fripost.org-index.ldif @@ -802,8 +822,9 @@ ldapmodify -QY EXTERNAL -H ldapi:/// -f /etc/ldap/local/mail.fripost.org-index.l olcDbIndex: ou eq olcDbIndex: objectClass pres,eq olcDbIndex: dc eq,sub - olcDbIndex: mail eq,sub + olcDbIndex: uid eq,sub olcDbIndex: mailLocalAddress eq + olcDbIndex: isActive eq ***** Restrict the access @@ -830,23 +851,24 @@ first. by anonymous auth - add: olcAccess - olcAccess: {1}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=gn,sn + olcAccess: {1}to dn.one="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=children,gn,sn by self write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write + by * break - add: olcAccess - olcAccess: {2}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" attrs=mailLocalAddress - by dnattr=owner write + olcAccess: {2}to dn.regex="(.+,)?dc=[^,]+,(uid=[^,]+,ou=mailboxes,dc=mail,dc=fripost,dc=org)$" + by dn.exact,expand="$2" write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write by * break - add: olcAccess - olcAccess: {3}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" + olcAccess: {3}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" attrs=entry,dc by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break - add: olcAccess - olcAccess: {4}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" + olcAccess: {4}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=entry,dc,uid,maildir,mailLocalAddress,mailTarget by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break - @@ -862,17 +884,17 @@ ldapmodify -QY EXTERNAL -H ldapi:/// -f /etc/ldap/local/mail.fripost.org-acl.ldi :: ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config "(olcDatabase={1}hdb)" [...] olcAccess: {0}to dn.children="dc=mail,dc=fripost,dc=org" attrs=userPassword by self write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write by anonymous auth - olcAccess: {1}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=gn,sn by self write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write - olcAccess: {2}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" attrs=mailLocalAddress by dnattr=owner write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write - olcAccess: {3}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break - olcAccess: {4}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break + olcAccess: {1}to dn.one="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=children,gn,sn by self write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write + olcAccess: {2}to dn.regex="(.+,)?dc=[^,]+,(uid=[^,]+,ou=mailboxes,dc=mail,dc=fripost,dc=org)$" by dn.exact,expand="$2" write by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write by * break + olcAccess: {3}to dn.children="ou=domains,dc=mail,dc=fripost,dc=org" attrs=dc,entry by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break + olcAccess: {4}to dn.children="ou=mailboxes,dc=mail,dc=fripost,dc=org" attrs=entry,dc,uid,maildir,mailLocalAddress,mailTarget by dn="cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" read by * break olcAccess: {5}to dn.subtree="dc=mail,dc=fripost,dc=org" by dn.one="ou=managers,dc=mail,dc=fripost,dc=org" write by * search olcAccess: {6}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=fripost,dc=org" write by * none olcAccess: {7}to dn.base="" by * read olcAccess: {8}to * by self write by dn="cn=admin,dc=fripost,dc=org" write by * read [...] -Note: Users are here able to manage their aliases themselves. Before inserting, we should +Note: Users are here allowed to manage their aliases themselves. Before inserting, we should ensure that aliases are fully qualified with the domain they own! Otherwise it'd be easy to steal aliases and probably even spy on other users... @@ -925,33 +947,54 @@ To delete a leaf or a sub-tree: objectClass: organizationalRole userPassword: {SSHA}xxxxxxx - dn: mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org - mail: user@fripost.org + dn: uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + uid: user@fripost.org objectClass: top - objectClass: inetLocalMailRecipient objectClass: virtualMailbox gn: First Name sn: Last Name userPassword: {SSHA}xxxxxxx maildir: fripost.org/user/ isActive: TRUE - mailLocalAddress: user-alias@fripost.org - dn: dc=fripost.org,ou=domains,dc=mail,dc=fripost,dc=org + dn: mailTarget=user@fripost.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + mailTarget: user@fripost.org + objectClass: top + objectClass: inetLocalMailRecipient + objectClass: virtualAliases + mailLocalAddress: user-alias@fripost.org + isActive: TRUE + + dn: dc=example.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + dc: example.org objectClass: top objectClass: virtualDomain - dc: fripost.org isActive: TRUE - - dn: dc=example.org,ou=domains,dc=mail,dc=fripost,dc=org + + dn: mailTarget=user@fripost.org,dc=example.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + mailTarget: user@fripost.org objectClass: top objectClass: inetLocalMailRecipient - objectClass: virtualDomain - dc: example.org + objectClass: virtualAliases isActive: TRUE - owner: mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org mailLocalAddress: user@example.org mailLocalAddress: user-alias@example.org + + dn: uid=user2@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + uid: user2@fripost.org + objectClass: top + objectClass: virtualMailbox + gn: First Name + sn: Last Name + userPassword: {SSHA}xxxxxx + maildir: fripost.org/user2/ + isActive: FALSE + + dn: dc=fripost.org,ou=domains,dc=mail,dc=fripost,dc=org + dc: fripost.org + objectClass: top + objectClass: virtualDomain + isActive: TRUE ldapadd -cxWD cn=admin,dc=fripost,dc=org -f /tmp/populate.ldif @@ -962,11 +1005,11 @@ e.g., `slappasswd -h "{SSHA}"'. **** Check the SASL binds (authentication) -ldapwhoami -xD "mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -W +ldapwhoami -xD "uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -W should return the whole dn: -"mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" +"uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" **** Check the ACL @@ -983,11 +1026,19 @@ and ***** Anonymous user -`ldapsearch -xLLL -b "ou=mailboxes,dc=mail,dc=fripost,dc=org"' should not return anything. +`ldapsearch -xLLL -b "ou=mailboxes,dc=mail,dc=fripost,dc=org"' should exit with status 0, but not return +anything. + +***** Services + +ldapsearch -xLLL -D "cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org" -b 'ou=mailboxes,dc=mail,dc=fripost,dc=org' -W + +should only print what Postifx needs to retrieve that is, the domain names, the maildirs +and the e-mail addresses. ***** Self -ldapsearch -xLLL -D "mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -b 'ou=mailboxes,dc=mail,dc=fripost,dc=org' -W +ldapsearch -xLLL -D "uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -b 'ou=mailboxes,dc=mail,dc=fripost,dc=org' -W should return all the information for this very user, but not e.g., the password of the other users. @@ -996,17 +1047,17 @@ The user should be able to change his/her password, and aliases in his/her own d :: /tmp/usermod.ldif - dn: mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + dn: uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org changetype: modify replace: userPassword userPassword: hop - dn: dc=example.org,ou=domains,dc=mail,dc=fripost,dc=org + dn: mailTarget=user@fripost.org,dc=example.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org changetype: modify add: mailLocalAddress mailLocalAddress: user-alias2@example.org -ldapmodify -D "mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -W -f /tmp/usermod.ldif +ldapmodify -D "uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -W -f /tmp/usermod.ldif [Note: Still that should be wrapped up in a script, and there is no need to write on disk since the data is read from the standard input.] @@ -1017,16 +1068,36 @@ from having "mailLocalAddress: admin@fripost.org" for example! We now ensure that the leaf has been updated: - :: slapcat -s "mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" + :: slapcat -s "uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" [...] userPassword:: aG9w entryCSN: 20120404215647.957317Z#000000#000#000000 - modifiersName: mail=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + modifiersName: uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org modifyTimestamp: 20120404215647Z -Doing the same thing with eg, trying to change the `maildir', `ldapmodify' -refuses with `Insufficient access (50)'. +Also, he/she's allowed to add new virtual domains: + + :: /tmp/newdomain.ldif + + dn: dc=example2.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + objectClass: top + objectClass: virtualDomain + dc: example2.org + isActive: TRUE + + dn: mailTarget=user-alias@fripost.org,dc=example2.org,uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org + mailTarget: user-alias@fripost.org + objectClass: top + objectClass: inetLocalMailRecipient + objectClass: virtualAliases + isActive: TRUE + mailLocalAddress: user@example2.org + +ldapadd -D "uid=user@fripost.org,ou=mailboxes,dc=mail,dc=fripost,dc=org" -W -f /tmp/newdomain.ldif + +On other modifications, for instance of `maildir', `ldapmodify' +should refuse with `Insufficient access (50)'. *** Configuring the main IMAP server **** Install packages @@ -1097,8 +1168,8 @@ sudo aptitude install dovecot-imapd :: /etc/postfix/main.cf virtual_mailbox_domains = ldap:$config_directory/ldap_virtual_mailbox_domains.cf - virtual_mailbox_maps = ldap:$config_directory/ldap_virtual_mailbox_maps.cf virtual_alias_maps = ldap:$config_directory/ldap_virtual_alias_maps.cf + virtual_mailbox_maps = ldap:$config_directory/ldap_virtual_mailbox_maps.cf [...] @@ -1113,7 +1184,7 @@ http://www.tehinterweb.co.uk/roundcube/#pisieverules server_host = ldap://localhost/ version = 3 - search_base = ou=domains,dc=mail,dc=fripost,dc=org + search_base = dc=mail,dc=fripost,dc=org bind = yes bind_dn = cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org bind_pw = xxxxxx @@ -1122,10 +1193,11 @@ http://www.tehinterweb.co.uk/roundcube/#pisieverules Test it: postmap -q fripost.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!' + postmap -q example.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!' postmap -q fake.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!' -:: /etc/postfix/ldap_virtual_mailbox_maps.cf +:: /etc/postfix/ldap_virtual_alias_maps.cf server_host = ldap://localhost/ version = 3 @@ -1133,29 +1205,27 @@ Test it: bind = yes bind_dn = cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org bind_pw = xxxxxx - query_filter = (&(ObjectClass=virtualMailbox)(mail=%s)(isActive=TRUE)) - result_attribute = maildir + query_filter = (&(ObjectClass=virtualAliases)(mailLocalAddress=%s)(isActive=TRUE)) + result_attribute = mailTarget Test it: - postmap -q user@fripost.org ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf + postmap -q user-alias@fripost.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf + postmap -q user@example.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf -:: /etc/postfix/ldap_virtual_alias_maps.cf +:: /etc/postfix/ldap_virtual_mailbox_maps.cf server_host = ldap://localhost/ version = 3 - search_base = dc=mail,dc=fripost,dc=org + search_base = ou=mailboxes,dc=mail,dc=fripost,dc=org bind = yes bind_dn = cn=SMTP,ou=services,dc=mail,dc=fripost,dc=org bind_pw = xxxxxx - query_filter = (&(|(ObjectClass=virtualMailbox)(ObjectClass=virtualDomain))(mailLocalAddress=%s)(isActive=TRUE)) - result_attribute = mail - special_result_attribute = owner + query_filter = (&(ObjectClass=virtualMailbox)(uid=%s)(isActive=TRUE)) + result_attribute = maildir Test it: - postmap -q user-alias@fripost.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf - postmap -q user@example.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf - + postmap -q user@fripost.org ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf **** Test delivery @@ -1256,14 +1326,14 @@ Copy this file in /etc/dovecot, and chmod 600 it. Uncomment the following lines: hosts = localhost # Or wherever is our LDAP server ldap_version = 3 auth_bind = yes - auth_bind_userdn = mail=%u,ou=mailboxes,dc=mail,dc=fripost,dc=org + auth_bind_userdn = uid=%u,ou=mailboxes,dc=mail,dc=fripost,dc=org base = ou=mailboxes,dc=mail,dc=fripost,dc=org deref = never scope = subtree user_attrs = maildir=home=/home/mail/virtual/%$ - user_filter = (&(objectClass=virtualMailbox)(mail=%u)(dc=%d)(isActive=TRUE)) - pass_attrs = mail=user - pass_filter = (&(objectClass=virtualMailbox)(mail=%u)(dc=%d)(isActive=TRUE)) + user_filter = (&(objectClass=virtualMailbox)(uid=%u)(isActive=TRUE)) + pass_attrs = uid=user + pass_filter = (&(objectClass=virtualMailbox)(uid=%u)(isActive=TRUE)) (And the TLS-related lines in case we are not using a tunnel.) The "base" is the root of our tree structure, in our case dn="ou=mailboxes,dc=mail,dc=fripost,dc=org". @@ -1337,7 +1407,7 @@ test our installation.) ldap_auth_method: bind ldap_search_base: ou=mailboxes,dc=mail,dc=fripost,dc=org ldap_scope: sub - ldap_filter: (&(objectClass=virtualMailbox)(mail=%u)(dc=%d)(isActive=TRUE)) + ldap_filter: (&(objectClass=virtualMailbox)(uid=%u)(isActive=TRUE)) After restarting saslauthd (`/etc/init.d/saslauthd restart'), we can test the authentication: `testsaslauthd -u user@fripost.org -p password'. (The password |