> > The problem (I guess it is a problem, not sure yet :) is, I'm using > > the pam authentication in both squid (using /usr/sbin/pam_auth) and > > postfix (using PAM and sasl authentication in main.cf), > So postfix uses saslauthd? Why not use saslauthd's native LDAP support; > it is more flexible than PAM. > If you are going to keep with PAM then restricting access to groups is a > PAM feature. Take a look at the pam_listfile module. > pam_listfile item=group file=/etc/security/smtp.groups
Sorry, premature send.
auth required pam_listfile.so \
onerr=fail item=group sense=allow file=/etc/security/smtp.groups
And you can just list the allowed POSIX groups
in /etc/security/smtp.groups, one per line. It doesn't solve the
problem on the DSA, but PAM is [intentionally] quite dumb so it doesn't
provide much information.
To solve the problem on the DSA just create a separate pam_ldap
configuration file (config=/someotherfile in the PAM stack). And have
that file use a separate bind DN. Use ACLs to control the user's each
bind context can see.
signature.asc
Description: This is a digitally signed message part
--- You are currently subscribed to [EMAIL PROTECTED] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
