<p>Look in red hat docs. There you can find a lot of advices on schema writing. But writing a schema is one thing but app to use it is another issue.</p>
<p>Greg.</p>
<p>Send from htc desire z</p>
<div class="gmail_quote">17-08-2012 08:27, "Ray" <<a href="mailto:ray@renegade.zapto.org">ray@renegade.zapto.org</a>> napisa³(a):<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Am 16.08.2012 20:16, schrieb Stephen Ingram:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Thu, Aug 16, 2012 at 10:27 AM, Ray <<a href="mailto:ray@renegade.zapto.org" target="_blank">ray@renegade.zapto.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Am 16.08.2012 19:03, schrieb Stephen Ingram:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Thu, Aug 16, 2012 at 9:33 AM, Ray <<a href="mailto:ray@renegade.zapto.org" target="_blank">ray@renegade.zapto.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Hi,<br>
<br>
I posted this before without getting a response. I think the question is<br>
super simple to answer for LDAP experts. I'll try to rephrase the<br>
quiestion<br>
(in case it was unclear before…)<br>
<br>
I've geen googling quite a while on this topic trying all sorts of<br>
keyword<br>
combinations and found exactly nothing.<br>
<br>
LDAP appears to be commonplace, almost every server software I can think<br>
of<br>
comes with an LDAP authentication module. The services that use the<br>
directory may need have different user bases (i.e. not every Linux user<br>
needs to be an IMAP user also and not every IMAP user should<br>
automatically<br>
be able to SSH into servers).<br>
<br>
What is the right way to achieve the above?:<br>
<br>
1) Have separate LDAP instances running, one for IMAP, the other one for<br>
Linux authentication. As there are some users that need both IMAP and<br>
Linux<br>
access, some users would need to be set up twice.<br>
<br>
2) Have all users in one LDAP instance, and have different sets of<br>
attributes for IMAP and Linux authentication. Those users with IMAP<br>
access<br>
have their IMAP attributes filled in and those with Linux logins have<br>
their<br>
posix account settings filled with values. Some would have both. I do not<br>
see how to assign different passwords for the two services for this<br>
option.<br>
Is there a way?<br>
<br>
Are there any other options?<br>
</blockquote>
<br>
<br>
Generally the whole purpose of using a directory server (LDAP) is to<br>
benefit from centralized and consistent configuration and<br>
authentication. As such, most setups use the same user base for<br>
everything (in your case IMAP access and shell logins). You just need<br>
to point each service (login and IMAP) to your directory and filter<br>
based on the existence of certain attributes. For example, only users<br>
with the objectclass=mailRecipient would be allowed to login to your<br>
IMAP mail store. This can easily be accomplished through the<br>
authentication system of your IMAP software (one that supports LDAP<br>
authentication).<br>
<br>
Steve<br>
</blockquote>
<br>
<br>
Many thanks for these insights, Steve!<br>
<br>
There are two more questions I have:<br>
<br>
* Is mailRecipient defined somewhere (schema?) or are these objectClasses<br>
free for me to choose?<br>
</blockquote>
<br>
mailRecipient is already defined as part of the old Netscape mail<br>
server schemas. I'm not sure if it's included in the default 389ds or<br>
not. Ultimately, you can roll your own schemas, however, it not always<br>
an easy task, and, thus many times easier to use an already available<br>
schema.<br>
</blockquote>
<br>
Ok, I see. Rich: also thanks for your reply on this.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Is there a way to have separate passwords for IMAP? Specifically I would<br>
like to run Cyrus-imap.<br>
</blockquote>
<br>
No, there can only be one userpassword attribute. Out of curiosity,<br>
why would you want your users to have to use different passwords for<br>
each service? That sort of disposes of the whole idea of using LDAP<br>
auth to begin with. And, yes, Cyrus-IMAP works perfectly with LDAP<br>
authentication.<br>
</blockquote>
<br>
Steve & Rich:<br>
<br>
I prefer different passwords because of security concerns: If a user (with both IMAP and SSH access) hacks his/her mail password into a comprimised box (keylogger, for instance, internet café…), then the expected damage would be limited to the mail account only. If the same password works for SSH also, then it's possible to screw up all files of that user; worse even, if there is some rights-elevation bug around at the time - then the entire box might be at risk.<br>
<br>
Getting a second set of userpassword attributes then either would require me to run a second instance, or I would have to resort to the likes of sasldb for the mail side of things…<br>
<br>
Would there be a way to patch some schema file with an extra password attribute ("mailuserpassword")? I have absolutely no clue about schema writing though… is there something you can recommend me to read (book, website, …) on this topic?<br>
<br>
Cheers,<br>
Ray<br>
--<br>
389 users mailing list<br>
<a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.<u></u>org</a><br>
<a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.<u></u>org/mailman/listinfo/389-users</a></blockquote></div>