[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Removing olcAccess entry
--On Tuesday, January 12, 2016 2:55 PM -0500 Katherine Faella <kmf@uri.edu>
wrote:
Hi Kathy,
I was afraid you were going to ask that. We are running the Redhat 6
supported 2.4.40-7.el6_7. We have a policy here of sticking with the
redhat supported releases of packages since our staff is so small.
Extremely ill advised for a number of reasons. I'd suggest using the LTB
project software instead, since it actually links to secure TLS software.
2.4.40 had some serious bugs as well. You can set up the LTB software via
their YUM repository.
<http://ltb-project.org/wiki/download#openldap>
<http://ltb-project.org/wiki/documentation/openldap-rpm#yum_repository>
I really need to resolve this for an important project here. Of course
the project is behind schedule and I am left with little time to get my
stuff working. I was hoping my syntax was just incorrect. The only
other way I can image fixing this is to revert to slapd.conf ....
I guess the good news is that my steps and syntax look okay to you. If
you have any other thoughts I would happily accept them.
Just tested, and can confirm it works correctly for me:
[zimbra@zre-ldap003 ~]$ ldapsearch -x -LLL -H ldapi:/// -D cn=config -w
8utM5cM7v0 -b "olcDatabase={2}mdb,cn=config" -s base olcAccess
dn: olcDatabase={2}mdb,cn=config
olcAccess: {0}to attrs=userPassword by anonymous auth by
dn.children="cn=adm
ins,cn=zimbra" write
olcAccess: {1}to dn.subtree="cn=zimbra" by
dn.children="cn=admins,cn=zimbra"
write
olcAccess: {2}to
attrs=zimbraZimletUserProperties,zimbraGalLdapBindPassword,zi
mbraGalLdapBindDn,zimbraAuthTokenKey,zimbraPreAuthKey,zimbraPasswordHistory,z
imbraIsAdminAccount,zimbraAuthLdapSearchBindPassword by
dn.children="cn=admi
ns,cn=zimbra" write by * none
olcAccess: {3}to attrs=objectclass by dn.children="cn=admins,cn=zimbra"
write
by dn.base="uid=zmpostfix,cn=appaccts,cn=zimbra" read by
dn.base="uid=zmam
avis,cn=appaccts,cn=zimbra" read by users read by * none
olcAccess: {4}to attrs=@amavisAccount by dn.children="cn=admins,cn=zimbra"
wr
ite by dn.base="uid=zmamavis,cn=appaccts,cn=zimbra" read by * +0 break
olcAccess: {5}to attrs=mail by dn.children="cn=admins,cn=zimbra" write by
dn
.base="uid=zmamavis,cn=appaccts,cn=zimbra" read by * +0 break
olcAccess: {6}to
attrs=zimbraAllowFromAddress,DKIMIdentity,DKIMSelector,DKIMDo
main,DKIMKey by dn.children="cn=admins,cn=zimbra" write by
dn.base="uid=zmp
ostfix,cn=appaccts,cn=zimbra" read by * none
olcAccess: {7}to filter="(!(zimbraHideInGal=TRUE))"
attrs=cn,co,company,dc,di
splayName,givenName,gn,initials,l,mail,o,ou,physicalDeliveryOfficeName,postal
Code,sn,st,street,streetAddress,telephoneNumber,title,uid,homePhone,pager,mob
ile,userCertificate by dn.children="cn=admins,cn=zimbra" write by
dn.base="
uid=zmpostfix,cn=appaccts,cn=zimbra" read by users read by * none
olcAccess: {8}to
attrs=zimbraId,zimbraMailAddress,zimbraMailAlias,zimbraMailCa
nonicalAddress,zimbraMailCatchAllAddress,zimbraMailCatchAllCanonicalAddress,z
imbraMailCatchAllForwardingAddress,zimbraMailDeliveryAddress,zimbraMailForwar
dingAddress,zimbraPrefMailForwardingAddress,zimbraMailHost,zimbraMailStatus,z
imbraMailTransport,zimbraDomainName,zimbraDomainType,zimbraPrefMailLocalDeliv
eryDisabled,member,memberURL,zimbraMemberOf by
dn.children="cn=admins,cn=zim
bra" write by dn.base="uid=zmpostfix,cn=appaccts,cn=zimbra" read by
dn.base
="uid=zmamavis,cn=appaccts,cn=zimbra" read by * none
olcAccess: {9}to dn.subtree="cn=groups,cn=zimbra"
attrs=zimbraMailAlias,member
,zimbraMailStatus,entry by dn.children="cn=admins,cn=zimbra" write by
dn.ba
se="uid=zmpostfix,cn=appaccts,cn=zimbra" read
olcAccess: {10}to attrs=entry by dn.children="cn=admins,cn=zimbra" write
by
* read
[zimbra@zre-ldap003 ~]$ cat /tmp/access-del.ldif
dn: olcDatabase={2}mdb,cn=config
changetype: modify
delete: olcAccess
olcAccess: {0}
[zimbra@zre-ldap003 ~]$ ldapmodify -x -H ldapi:/// -D cn=config -w
8utM5cM7v0 -f /tmp/access-del.ldif
modifying entry "olcDatabase={2}mdb,cn=config"
[zimbra@zre-ldap003 ~]$
[zimbra@zre-ldap003 ~]$ ldapsearch -x -LLL -H ldapi:/// -D cn=config -w
8utM5cM7v0 -b "olcDatabase={2}mdb,cn=config" -s base olcAccess
dn: olcDatabase={2}mdb,cn=config
olcAccess: {0}to dn.subtree="cn=zimbra" by
dn.children="cn=admins,cn=zimbra"
write
olcAccess: {1}to
attrs=zimbraZimletUserProperties,zimbraGalLdapBindPassword,zi
mbraGalLdapBindDn,zimbraAuthTokenKey,zimbraPreAuthKey,zimbraPasswordHistory,z
imbraIsAdminAccount,zimbraAuthLdapSearchBindPassword by
dn.children="cn=admi
ns,cn=zimbra" write by * none
olcAccess: {2}to attrs=objectclass by dn.children="cn=admins,cn=zimbra"
write
by dn.base="uid=zmpostfix,cn=appaccts,cn=zimbra" read by
dn.base="uid=zmam
avis,cn=appaccts,cn=zimbra" read by users read by * none
olcAccess: {3}to attrs=@amavisAccount by dn.children="cn=admins,cn=zimbra"
wr
ite by dn.base="uid=zmamavis,cn=appaccts,cn=zimbra" read by * +0 break
olcAccess: {4}to attrs=mail by dn.children="cn=admins,cn=zimbra" write by
dn
.base="uid=zmamavis,cn=appaccts,cn=zimbra" read by * +0 break
olcAccess: {5}to
attrs=zimbraAllowFromAddress,DKIMIdentity,DKIMSelector,DKIMDo
main,DKIMKey by dn.children="cn=admins,cn=zimbra" write by
dn.base="uid=zmp
ostfix,cn=appaccts,cn=zimbra" read by * none
olcAccess: {6}to filter="(!(zimbraHideInGal=TRUE))"
attrs=cn,co,company,dc,di
splayName,givenName,gn,initials,l,mail,o,ou,physicalDeliveryOfficeName,postal
Code,sn,st,street,streetAddress,telephoneNumber,title,uid,homePhone,pager,mob
ile,userCertificate by dn.children="cn=admins,cn=zimbra" write by
dn.base="
uid=zmpostfix,cn=appaccts,cn=zimbra" read by users read by * none
olcAccess: {7}to
attrs=zimbraId,zimbraMailAddress,zimbraMailAlias,zimbraMailCa
nonicalAddress,zimbraMailCatchAllAddress,zimbraMailCatchAllCanonicalAddress,z
imbraMailCatchAllForwardingAddress,zimbraMailDeliveryAddress,zimbraMailForwar
dingAddress,zimbraPrefMailForwardingAddress,zimbraMailHost,zimbraMailStatus,z
imbraMailTransport,zimbraDomainName,zimbraDomainType,zimbraPrefMailLocalDeliv
eryDisabled,member,memberURL,zimbraMemberOf by
dn.children="cn=admins,cn=zim
bra" write by dn.base="uid=zmpostfix,cn=appaccts,cn=zimbra" read by
dn.base
="uid=zmamavis,cn=appaccts,cn=zimbra" read by * none
olcAccess: {8}to dn.subtree="cn=groups,cn=zimbra"
attrs=zimbraMailAlias,member
,zimbraMailStatus,entry by dn.children="cn=admins,cn=zimbra" write by
dn.ba
se="uid=zmpostfix,cn=appaccts,cn=zimbra" read
olcAccess: {9}to attrs=entry by dn.children="cn=admins,cn=zimbra" write
by *
read
--Quanah
--
Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration