I've attached a diff file for the debops.postldap role. It contains CipherMail-specific changes to the role defaults that more people might be interested in. What do you think? Should I make a PR for (some of) these changes?
The changes are:
- Use of mailRecipient object class where it makes sense, specifically in the ldap_virtual_alias_maps, ldap_virtual_mailbox_maps and ldap_smtpd_sender_login_maps configuration.
- Support for virtual alias lookups for group members. This allows us to make a distribution list out of an LDAP group. Postfix resolves the distribution list members using special_result_attribute and leaf_result_attribute.
- search_base of ldap_virtual_mailbox_maps.cf set to the base DN instead of ou=People. We did this because we also have mailboxes that are accessed by services whose LDAP accounts are under the ou=Hosts tree. An example is the system that uses IMAP to access messages in our support(a)ciphermail.com mailbox.
- The maildir paths are /var/vmail/<uid>/Maildir instead of /var/vmail/<domain>/<localpart>/Maildir. I like to associate mailboxes with the accounts in LDAP, which are primarily distinguished by uid and not email addresses.
- We are using mailAlternateAddress attributes (mailRecipient objectClass) instead of mailAlias objects. This allows us to add email aliases directly to the existing people and group objects. The filters have been updated for this.
- I have removed the ldap_unauth_sender_access sender restriction. This restriction forces SMTP clients to authenticate before sending mail when the sender address exists in LDAP. This is nice, but the ldap_unauth_domain_access sender restriction already forces authentication when an SMTP client tries to send mail from one of the domains in LDAP, which should be enough. Removing this restriction reduces the complexity of the whole system a little and saves some LDAP lookups.
- We're not using postldap__domain_rev_pattern.
Personal LDAP objects look like this:
cn: Imre Jonk
Group LDAP objects used as distribution lists look like this:
dn: cn=UNIX Administrators,ou=Groups,dc=ciphermail,dc=com
cn: UNIX Administrators
description: People responsible for UNIX-like infrastructure
Hoping this is useful for someone. It took me quite a while to figure out and explain in writing what customizations I've made to this role. It's been a while since I last touched the mail cluster configuration...
I'VE GOT THE T-SHIRT (habeo t-shirt :-D) !!
Its quality is jaw dropping! My wife is so amazed by the fabric's
quality that she feels envious.
Many thanks to Imre and all those who kindly put so much efforts is it.
The Debian release team just hit the second milestone in the Bullseye release
process. The 'testing' distribution is now in soft freeze , which means
that package maintainers are discouraged from making large changes, and new
source packages are not allowed into Bullseye.
If you haven't done so already, please see if you can spin up a test system
with Debian Bullseye to test our playbooks against. Issues and pull requests
are more than welcome. Problems with the testing distribution (see also RC
bugs ) should be filed against the Debian bug tracking system .