ZhangHuangbin wrote:Can you paste the whole LDAP ACL rules? (you can replace your domain name before post)
And, a short introduction about how you implement SSH + LDAP integration is better.
This is the ACL rule:
#
# Set permission for LDAP attrs.
#
access to attrs="userPassword,mailForwardingAddress"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users none
access to attrs="cn,sn,telephoneNumber"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users read
# Domain attrs.
access to attrs="objectclass,domainName,mtaTransport,enabledService,domainSenderBccAddress,domainRecipientBccAddress,domainAdmin,domainGlobalAdmin,domainBackupMX,domainMaxQuotaSize,domainMaxUserNumber"
by * read
by anonymous auth
by self read
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users read
# User attrs.
access to attrs="employeeNumber,homeDirectory,mailMessageStore,mail,accountStatus,userSenderBccAddress,userRecipientBccAddress,mailForwardingAddress,mailQuota,backupMailAddress,shadowAddress"
by * read
by anonymous auth
by self read
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users read
#
# Set ACL for vmail/vmailadmin.
#
access to dn="cn=vmail,dc=pippo,dc=pluto,dc=org"
by anonymous auth
by self write
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users none
access to dn="cn=vmailadmin,dc=pippo,dc=pluto,dc=org"
by anonymous auth
by self write
by users none
#
# Allow users to access their own domain subtree.
# Allow domain admin to modify accounts under same domain.
#
access to dn.regex="domainName=([^,]+),o=domains,dc=pippo,dc=pluto,dc=org$"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=it" write
by dn.regex="mail=[^,]+@$1,o=domainAdmins,dc=pippo,dc=pluto,dc=org$" write
by dn.regex="mail=[^,]+@$1,ou=Users,domainName=$1,o=domains,dc=pippo,dc=pluto,dc=org$" read
by users none
#
# Enable vmail/vmailadmin.
#
access to dn.subtree="o=domains,dc=pippo,dc=pluto,dc=org"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by dn.regex="mail=[^,]+,ou=Users,domainName=$1,o=domains,dc=pippo,dc=pluto,dc=org$" read
by users read
access to dn.subtree="o=domainAdmins,dc=pippo,dc=pluto,dc=org"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=pippo,dc=pluto,dc=org" read
by dn.exact="cn=vmailadmin,dc=pippo,dc=pluto,dc=org" write
by users none
#
# Set permission for "cn=*,dc=pippo,dc=pluto,dc=org".
#
access to dn.regex="cn=[^,]+,dc=pippo,dc=pluto,dc=org"
by anonymous auth
by self write
by users none
#
# Set default permission.
#
access to *
by * read
by anonymous auth
by self write
by users read
