> Quite a long time back I spent a lot of time doing something similar
> (local users in an LDAP backend, pam_ldap and nss_ldap to extract their
> information for a web hosting system) and found that:
>
> 1. If you're binding to the directory using LDAP auth (either by using a
> "secret" file or by having the password in /etc/ldap.conf), then that
> password must be readable by all users, or
> 2. If you're using an anonymous bind
>
> then
>
> All your local users with shell/cgi access can pull all information out
> of the directory. That may not apply to Jason (although he did say that
> they're real, local, system users so it just as easily might apply), but
> the net effect is that the Exim user *must* be able to read the secret
> file or the full ldap.conf file; (from memory) that means that simply
> having the Exim user in an appropriate group may not work because Exim
> itself probably won't do a chgrp() call to an arbitrary group before
> trying the lookup. You could have the config file/secret grouped as
> something:exim I guess, which might work, but only if it doesn't break
> anything else.
>
> In the end I think we dropped LDAP lookups and ended up doing something
> else, but I'm no longer in that job so can't look back at it.
I had the same problem until I created a workaround:
unknown_login = ${run{/etc/exim/getuser.pl "$caller_uid"}}
Where /etc/exim/getuser.pl is a script that does the ldap lookup, and is
owned by root:exim with 750 perms.
I also wrote a custom identd server that does ldap lookups to figure out
the username in case cgi scripts sent email by connecting to
localhost:25 rather than running the exim binary.
This allows me to leave /etc/ldap.conf owned by root:root with 600
perms.
Performance of calling an external script wasn't an issue as this is a
webserver, not a mail server and it sends very few emails.
Mike
--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/
