aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--fripost-docs.org87
1 files changed, 59 insertions, 28 deletions
diff --git a/fripost-docs.org b/fripost-docs.org
index ff5fe1b..ec340fd 100644
--- a/fripost-docs.org
+++ b/fripost-docs.org
@@ -891,13 +891,14 @@ http://www.openldap.org/doc/admin24/access-control.html for details.
-
# Admins have writing rights on the branch. Authenticated users can read
# their entry. The SMTP and SASLauthd servervices can read entries on the
- # branch (but not the passwords). Other cannot access the branch.
+ # branch (but not the passwords). Others can only search.
add: olcAccess
olcAccess: {4}to dn.subtree="o=mailHosting,dc=fripost,dc=org"
by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write
by self read
by dn.exact="cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org" read
by dn.exact="cn=SASLauth,ou=services,o=mailHosting,dc=fripost,dc=org" read
+ by * search
ldapmodify -QY EXTERNAL -H ldapi:/// -f /etc/ldap/fripost/acl.ldif
@@ -908,7 +909,7 @@ ldapmodify -QY EXTERNAL -H ldapi:/// -f /etc/ldap/fripost/acl.ldif
olcAccess: {1}to dn.children="o=mailHosting,dc=fripost,dc=org" attrs=userPassword by self write by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write by anonymous auth
olcAccess: {2}to dn.children="o=mailHosting,dc=fripost,dc=org" attrs=gn,sn by self write by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write
olcAccess: {3}to dn.regex="(.+,)?(dc=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$" by set.expand="[$2]/owner & user" write by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write by * break
- olcAccess: {4}to dn.subtree="o=mailHosting,dc=fripost,dc=org" by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write by self read by dn.exact="cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org" read by dn.exact="cn=SASLauth,ou=services,o=mailHosting,dc=fripost,dc=org" read
+ olcAccess: {4}to dn.subtree="o=mailHosting,dc=fripost,dc=org" by dn.one="ou=managers,o=mailHosting,dc=fripost,dc=org" write by self read by dn.exact="cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org" read by dn.exact="cn=SASLauth,ou=services,o=mailHosting,dc=fripost,dc=org" read by * search
olcAccess: {5}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=fripost,dc=org" write by * none
olcAccess: {6}to dn.base="" by * read
olcAccess: {7}to * by self write by dn="cn=admin,dc=fripost,dc=org" write by * read
@@ -1094,10 +1095,14 @@ Cf. installation of the master LDAP server.
(We also need to install fripost's schema and indexes.)
The slave may only listen on the UNIX socket; To specify that, in
-`/etc/defauld/slapd', change `SLAPD_SERVICES' to
+`/etc/default/slapd', change `SLAPD_SERVICES' to
SLAPD_SERVICES="ldapi:///"
+[TODO: *Ideally*, Postfix's should perform the LDAP lookups on a UNIX socket. However,
+while it `postmap -q' worked fine, Postfix itself couldn't query the LDAP server.
+A quick fix was to query the network instead: SLAPD_SERVICES="ldapi:///127.0.0.1:389/".]
+
In the rest of this section, we assume there is a tunnel from the master
LDAP server to the slave (i.e., ldap://127.0.0.1:3890 on the slaves actually
speaks to the master).
@@ -1223,9 +1228,9 @@ sudo aptitude install dovecot-imapd
:: /etc/postfix/main.cf
- virtual_mailbox_domains = ldap:$config_directory/ldap_virtual_mailbox_domains.cf
- virtual_mailbox_maps = ldap:$config_directory/ldap_virtual_mailbox_maps.cf
- virtual_alias_maps = ldap:$config_directory/ldap_virtual_alias_maps.cf
+ virtual_mailbox_domains = ldap:$config_directory/ldap/ldap_virtual_mailbox_domains.cf
+ virtual_mailbox_maps = ldap:$config_directory/ldap/ldap_virtual_mailbox_maps.cf
+ virtual_alias_maps = ldap:$config_directory/ldap/ldap_virtual_alias_maps.cf
[...]
@@ -1236,49 +1241,56 @@ http://wiki.dovecot.org/LDA/Postfix
http://www.tehinterweb.co.uk/roundcube/#pisieverules
-:: /etc/postfix/ldap_virtual_mailbox_domains.cf
+:: /etc/postfix/ldap/ldap_virtual_mailbox_domains.cf
- server_host = ldapi://
+ server_host = ldap://127.0.0.1:389/
version = 3
search_base = dc=%s,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
- bind = no
+ bind = yes
+ bind_dn = cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org
+ bind_pw = xxxxxx
query_filter = (&(ObjectClass=virtualDomain)(dc=%s)(isActive=TRUE))
result_attribute = dc
Test it:
- postmap -q fripost.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!'
- postmap -q example.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!'
- postmap -q fake.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!'
+ postmap -q fripost.org ldap:/etc/postfix/ldap/ldap_virtual_domains_maps.cf || echo 'failed!'
+ postmap -q example.org ldap:/etc/postfix/ldap/ldap_virtual_domains_maps.cf || echo 'failed!'
+ postmap -q fake.org ldap:/etc/postfix/ldap/ldap_virtual_domains_maps.cf || echo 'failed!'
+
+:: /etc/postfix/ldap/ldap_virtual_mailbox_maps.cf
-:: /etc/postfix/ldap_virtual_mailbox_maps.cf
- server_host = ldapi://
+ server_host = ldap://127.0.0.1:389/
version = 3
search_base = uid=%u,dc=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
- bind = no
+ bind = yes
+ bind_dn = cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org
+ bind_pw = xxxxxx
query_filter = (&(ObjectClass=virtualMailbox)(uid=%u)(isActive=TRUE))
result_attribute = uid
Test it:
- postmap -q user@fripost.org ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf || echo 'failed!'
- postmap -q fake@fake.org ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf || echo 'failed!'
+ postmap -q user@fripost.org ldap:/etc/postfix/ldap/ldap_virtual_mailbox_maps.cf || echo 'failed!'
+ postmap -q fake@fake.org ldap:/etc/postfix/ldap/ldap_virtual_mailbox_maps.cf || echo 'failed!'
-:: /etc/postfix/ldap_virtual_alias_maps.cf
+:: /etc/postfix/ldap/ldap_virtual_alias_maps.cf
- server_host = ldapi://
+ server_host = ldap://127.0.0.1:389/
version = 3
search_base = dc=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = one
- bind = no
+ bind = yes
+ bind_dn = cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=org
+ bind_pw = xxxxxx
query_filter = (&(ObjectClass=virtualAliases)(mailLocalAddress=%u)(isActive=TRUE))
result_attribute = mailTarget
Test it:
- postmap -q user-alias@fripost.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf
- postmap -q user@example.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf
+ postmap -q user-alias@fripost.org ldap:/etc/postfix/ldap/ldap_virtual_alias_maps.cf
+ postmap -q user@example.org ldap:/etc/postfix/ldap/ldap_virtual_alias_maps.cf
(The main LDAP server is partly replicated on a UNIX socket on the MX's.)
@@ -1379,13 +1391,14 @@ http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds
Debian provides a squeleton configuration in /usr/share/dovecot/dovecot-ldap.conf .
Copy this file in /etc/dovecot, and chmod 600 it. Uncomment the following lines:
- hosts = localhost # Or wherever is our LDAP server
+ hosts = localhost
ldap_version = 3
auth_bind = yes
auth_bind_userdn = uid=%n,dc=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
base = uid=%n,dc=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
deref = never
scope = base
+ pass_attrs = uid=user
pass_filter = (&(objectClass=virtualMailbox)(uid=%n)(isActive=TRUE))
(And the TLS-related lines in case we are not using a tunnel.)
@@ -1397,13 +1410,14 @@ blocks, and uncomment
args = /etc/dovecot/dovecot-ldap.conf
}
# and
- userdb ldap {
- args = /etc/dovecot/dovecot-ldap-userdb.conf
+ userdb static {
+ args = uid=115 gid=8 home=/home/mail/virtual/%d/%n/ allow_all_users=yes
}
-Following http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds, `dovecot-ldap-userdb.conf'
-can simply be a symlink to `dovecot-ldap.conf'. The names have to differ for Dovecot to send
-asynchronous request to the LDAP server.
+We are not making use of the User Database (to ensure that Dovecot's `deliver' checks
+that the recipient exists) here, since `deliver' should only be called by Postfix which
+takes care of that (cf. `ldap_virtual_mailbox_maps.cf'). Hence the `allow_all_users=yes'
+above.
*** Configuring a new smarthost to relay e-mail to the main IMAP server
**** Overview
@@ -1513,6 +1527,23 @@ Finally, we can add the submission service to our master.cf, with customized pol
We now have to restart Postfix: `/etc/init.d/postfix restart'. (Maybe `postfix reload'
is enough actually.)
+**** Test it
+
+(desactivate smtpd_sasl_exceptions_networks for localhost first)
+
+openssl s_client -connect localhost:25 -starttls smtp -CApath /etc/ssl/
+
+echo -ne '\000user@fripost.org\000user' | openssl base64
+
+EHLO localhost
+AUTH PLAIN AHVzZXJAZnJpcG9zdC5vcmcAdXNlcg==
+
+mail from:<user@fripost.org>
+rcpt to:<me@guilhem.org>
+
+
+
+
**** Anonymize the senders
If RoudCube automatically anonymize the sender (by simply shortening the
trace), it's not the case (by default) for SquirrelMail, or when clients