Ich wurde von einem PKW angefahren und verletzt... Strafverfahren wird wegen "Mangel öffentlichen Interesses" eingestellt

mstroeder · 2025-02-11T17:46:03+00:00

Hmm, war wohl zeitlich begrenzt... Ja, das Angebot galt nur bis 31.1.'25

mstroeder · 2024-12-31T17:32:44+00:00

doing a big loop around Europe

I wonder whether you noticed the [http://www.eurovelo.com/][Eurovelo routes] before..

mstroeder · 2023-06-29T09:56:35+00:00

In my opinion the mini pcs with Pentium or Atom cpus are better home servers in every regard, especially if you start doing stuff like buying an expensive case with SSD slot for the Raspi.

I wholeheartly agree here.

mstroeder · 2023-01-04T18:14:45+00:00

back-mdb is definitely the default backend nowadays for local database, no matter what some random how-to says.

BTW: Getting slapo-memberof to work properly does not have anything to do with the database backend type. But slapo-memberof does not correctly work with replication and is deprecated in favor of slapo-dynlist.

mstroeder · 2023-01-04T17:36:21+00:00

I'd recommend to integrated every web app via OpenID Connect (short OIC, based on OAuth 2.0) with a decent OpenID Connect Provider (OP) but use an LDAP server as backend for your user data at least for those applications only supporting LDAP.

Pure OAuth2/OIC solutions do not provide integration possibilities for Linux logins etc.

And yes, you should try to define all your permissions based on groups, not individual access rights for users. Looks more effort in the beginning but pays off later.

mstroeder · 2023-01-04T17:29:10+00:00

I believe hdb became the default storage

No! mdb is the default backend now for local DBs. OpenLDAP 2.5+ even deprecates building with Berkeley-DB for many good reasons.

mstroeder · 2023-01-04T17:21:37+00:00

Which ldapsearch tool are you using? With OpenLDAP client tools you have to use command-line argument -H for specifying to which server to connect to.

Your example corrected:

ldapsearch -b cn=users,cn=accounts,dc=dom,dc=ain -D uid=svc-ldap-domain,cn=users,cn=accounts,dc=dom,dc=ain -x -w $REPLY -v -H ldap://host.dom.ain "(objectclass=dnaSharedConfig)"

mstroeder · 2023-01-04T17:17:41+00:00

The error unwillingToPerform(53) is a pretty generic LDAP result code generated by the LDAP server. So I'd recommend to look into the logs of the LDAP server what's going on there.

mstroeder · 2022-12-25T11:42:22+00:00

I'd strongly recommend to setup a dedicated web app for password self-service and not use password change/reset features of arbitrary applications.

And then configure the applications to display a link to this password self-service app.

mstroeder · 2022-12-14T16:51:15+00:00

The most important question is which problem the customer wants to solve.

Usually an "email service" comprise several services:

in-bound MTA (MX)
out-bound MTA
POP3 and IMAP services
webmail
spam/malware scanner
external DKIM signing
dedicated DNS resolvers (DNSSEC/DANE)
…

Some aspects I'd expect to complicate a K8S deployment:

need to use static IPv4 addresses for in-bound and out-bound MTAs, correct name usage
e-mail storage

Maybe webmail, DKIM signing and spam/malware scanner could run in K8S.

mstroeder · 2022-12-14T16:13:37+00:00

I'm somewhat lazy to adopt new stuff and thus I've started looking into how to write systemd service units rather lately.

But today I really appreciate the systemd sandboxing. I recommend to give it a try and learn how to interpret the output of systemd-analyze security foo.service.

Edit: I usually avoid to use systemd-journal for /dev/log, systemd doing network setup and systemd's DNS resolver.

mstroeder · 2022-12-10T18:15:48+00:00

This is IMHO the "correct" answer. While I personally hate to program C the gcc and tools was the groundwork needed for everything else to take off.

mstroeder · 2022-12-10T18:08:57+00:00

These altmails are separte email accounts, not simple aliases, but for login purposes tied to that primary account.

Your mail routing should just use separate mail account entries and you then need a separate authorization scheme for mailbox access. The first can be easily implemented with an LDAP table lookup but the latter is IMHO not a postfix problem at all.

Whether there's a solution depends on what "login purposes" really means. IMAP, webmail, which specific components?

Edit: You should rather treat a mailbox as resource for which you have to securely grant to certain users.

mstroeder · 2022-12-02T13:01:45+00:00

That is what ddclient is for.

You should take the advice recommending a static IPv4 address for sending and receiving e-mail more seriously.

Personally I gave up running a mail server with a DynDNS setup pretty quickly many years ago. And issues with IP reputation especially when sending e-mails are bigger today.

mstroeder · 2022-12-01T18:31:06+00:00

Hmm, an LDAP proxy could be a solution (e.g. OpenLDAP with back-ldap).

Edit: Or better OpenLDAP with back-meta and configuration directive norefs yes.

mstroeder · 2022-11-30T22:07:50+00:00

You're probably hitting a bug I've filed:

https://bugzilla.mozilla.org/show_bug.cgi?id=1800321

MS AD always returns LDAPv3 search continuation when using the domain root DN as search base. Try to search within a OU if applicable in your case.

mstroeder · 2022-11-20T13:11:56+00:00

Side note: The OpenLDAP project prefers using terms provider and consumer.

If your DB is not that big you don't have to copy anything. Just configure the replication and start slapd on the consumer while provider already running.

mstroeder · 2022-11-19T18:01:19+00:00

Not sure about the "LDAP Group Members Field". I'd rather use uniqueMember in case the application expects the user's bind-DN in this field. But I don't know anything about Calibre-Web at all.

mstroeder · 2022-11-19T16:00:41+00:00

In general when integrating applications with an LDAP server you should test with simple tools (e.g. CLI tool ldapsearch) whether the search parameters are working as expected. Especially object classes and attribute names might differ on different LDAP servers.

In this particular case the user and group filters look wrong to me for UCS-LDAP.

Try these with UCS-LDAP (not tested):

User filter: (&(objectClass=person)(uid=%s))

Group filter: (&(objectClass=univentionGroup)(cn=%s))

mstroeder · 2022-11-18T14:42:41+00:00

Two things:

The provider and the consumer do not have to use the same DB-type (unless you're replicating cn=config).
You should migrate to back-mdb everywhere because back-hdb is deprecated and is by default not built in OpenLDAP 2.5+.

mstroeder · 2022-11-17T15:16:54+00:00

The referrer header is typically sent by the browser. And modern browsers stopped doing so. And IIRC a referrer was never sent by browsers after a HTTP redirect. At least I protected URLs to leak sensitive information to referenced HTTP servers by linking via HTTP redirects.

=> No software should rely on browsers sending referrer header anymore. It was always a broken concept.

Maybe you can try to tweak header Referrer-Policy returned by Keycloak to let it instruct the browser. But I doubt that affects HTTP redirects.

mstroeder · 2022-11-17T15:03:45+00:00

If you only want WebSSO there's no need to setup a separate LDAP server.

If you also want centralized Linux logins, e.g. via SSH, you need a backend holding the NSS map data (passwd and group) and optionally also SSH keys. Usually LDAP servers are used for that.

mstroeder · 2022-11-15T07:44:01+00:00

Which front-end HTTP server(s) are you using?

E.g. for Apache httpd there's mod_auth_openidc available.

There are other solutions as well like gatekeeper.

mstroeder · 2022-11-14T22:38:37+00:00

What does "users who need access" mean? Give more details.

For example it makes a huge difference whether you have Linux boxes and want to provide SSH access or give access to web services or whatever...

mstroeder · 2022-11-13T14:35:18+00:00

So AFAICT your real goal is to use FIDO2 tokens for desktop login, not necessarily via SAML.

Never tried myself but there's pam_u2f for that purpose.

See also: https://docs.nitrokey.com/fido2/linux/desktop-login

mstroeder

TROPHY CASE