3 # - [PP] Now version controlled in db.d.o git repository, also see debian/changelog - 2009
4 # - [PP] Now version controlled in db.d.o bzr repository - 2007-12-25
7 # - [HE] Add 'purpose', 'physicalHost' to debianServer - 2007-12-25
8 # - [zobel] Add 'VoIP' - 2008-05-10
9 # - [luk] Add 'subGroup' to group - 2008-11-22
12 # - Add 'gender' and 'birthDate' to debianDeveloper
13 # - Add 'mailDisableMessage' to debianAccount
14 # - Add 'mailDisableMessage', 'mailCallout', 'mailGreylisting', 'mailRBL',
15 # 'mailRHSBL', and 'mailWhitelist' to debianDeveloper and debianRoleAccount
18 # - Add 'access' as a MAY for debianServer objectclass.
19 # - Make activity-from a UTF-8 string rather than ASCII.
20 # - add new debianRoleAccount objectclass.
23 # - Add 'access' as a MAY for debianDeveloper objectclass.
24 # - Add 'gid' attribute.
25 # - Make homeDirectory a MAY not MUST for debianAccount.
26 # - drop userPassword and memberUID MAYs from debianGroup.
27 # - add SUP top STRUCTURAL to debianGroup.
30 # - add a UTF8-enabled 'gecos' attribute type, conflicts with RFC2307
31 # - add debianAccount, which is roughly equivalent to posixAccount but
32 # permits UTF8 gecos fields
33 # - add debianGroup, which is the same as above but for posixGroup
36 # - Remove labeledURI, jpegPhoto from the list of supported
37 # attributes; using inetOrgPerson instead of organizationalPerson as
38 # a structural objectclass gives us both of these, and several other
39 # attributes that may be useful.
40 # - Add echelon attributes for MIA work to the debiandeveloper
41 # objectclass. (accountcomment,accountstatus)
42 # - Add specification for debianServer objectclass, used for Debian
46 # - grammarfied 'allowedHosts' to 'allowedHost' as
47 # 1.3.6.1.4.1.9586.100.4.2.12.
48 # - add 'privateSub' as 1.3.6.1.4.1.9586.100.4.4.5.
49 # - add 'jabberJID' as 1.3.6.1.4.1.9586.100.4.2.13.
50 # - change 'icqUIN' to an integer type (see? I told you it wasn't
51 # approved for use yet! ;)
57 # Project: db.debian.org
58 # Contact: Debian directory administrators <admin@db.debian.org>
62 # enterprise.Debian.project.userdir / 1.3.6.1.4.1.9586.100.4
64 # .1 - public LDAP objectClasses
68 # .2 - public LDAP attributeTypes
77 # .9 - middlename (mn)
79 # .11 - supplementaryGid
100 # .32 - mailDisableMessage
106 # .38 - mailContentInspectionAction
107 # .39 - allowedGroups
108 # .40 - exportOptions
109 # .41 - sshdistAuthKeysHost
112 # .3 - experimental LDAP objectClasses
113 # .1 - debianDeveloper
115 # .3 - debianRoleAccount
117 # .4 - experimental LDAP attributeTypes
118 # .1 - allowedHosts - OBSOLETED
121 # .4 - keyFingerPrint
123 # .6 - accountComment
125 # .8 - perform callouts
126 # .9 - perform greylisting
132 # Public attribute types
133 attributetype ( 1.3.6.1.4.1.9586.100.4.2.1
135 DESC 'textual form of an SSH public key compatible with authorized_keys'
136 EQUALITY caseIgnoreMatch
137 SUBSTR caseIgnoreSubstringsMatch
138 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
140 attributetype ( 1.3.6.1.4.1.9586.100.4.2.2
142 DESC 'last known activity from user email address'
143 EQUALITY caseExactMatch
144 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
146 attributetype ( 1.3.6.1.4.1.9586.100.4.2.3
148 DESC 'last known activity from user PGP key'
149 EQUALITY caseExactIA5Match
150 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
152 attributetype ( 1.3.6.1.4.1.9586.100.4.2.4
154 DESC 'user-editable comment'
155 EQUALITY caseExactIA5Match
156 SUBSTR caseIgnoreIA5SubstringsMatch
157 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
159 attributetype ( 1.3.6.1.4.1.9586.100.4.2.5
161 DESC 'UIN for ICQ instant messaging system'
162 EQUALITY integerMatch
163 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
165 attributetype ( 1.3.6.1.4.1.9586.100.4.2.6
167 DESC 'Internet Relay Chat nickname'
168 EQUALITY caseIgnoreIA5Match
169 SUBSTR caseIgnoreIA5SubstringsMatch
170 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
172 attributetype ( 1.3.6.1.4.1.9586.100.4.2.7
174 DESC 'latitude coordinate'
175 EQUALITY caseExactIA5Match
176 SUBSTR caseExactIA5SubstringsMatch
177 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
179 attributetype ( 1.3.6.1.4.1.9586.100.4.2.8
181 DESC 'longitude coordinate'
182 EQUALITY caseExactIA5Match
183 SUBSTR caseExactIA5SubstringsMatch
184 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
186 attributetype ( 1.3.6.1.4.1.9586.100.4.2.9
187 NAME ( 'mn' 'middlename' )
190 attributetype ( 1.3.6.1.4.1.9586.100.4.2.10
192 DESC 'vacation message'
193 EQUALITY caseIgnoreMatch
194 SUBSTR caseIgnoreSubstringsMatch
195 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
197 attributetype ( 1.3.6.1.4.1.9586.100.4.2.11
198 NAME 'supplementaryGid'
199 DESC 'additional Unix group id of user'
200 EQUALITY caseIgnoreMatch
201 SUBSTR caseIgnoreSubstringsMatch
202 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
204 attributetype ( 1.3.6.1.4.1.9586.100.4.2.12
206 DESC 'host name this account is allowed access to'
207 EQUALITY caseIgnoreIA5Match
208 SUBSTR caseIgnoreIA5SubstringsMatch
209 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
211 attributetype ( 1.3.6.1.4.1.9586.100.4.2.13
213 DESC 'JID for Jabber instant messaging protocol'
214 EQUALITY caseIgnoreIA5Match
215 SUBSTR caseIgnoreIA5SubstringsMatch
216 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
218 attributetype ( 1.3.6.1.4.1.9586.100.4.2.14
220 DESC 'nature of access allowed to server'
221 EQUALITY caseIgnoreMatch
222 SUBSTR caseIgnoreSubstringsMatch
223 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
225 attributetype ( 1.3.6.1.4.1.9586.100.4.2.15
227 DESC 'email address of server administrator'
228 EQUALITY caseIgnoreIA5Match
229 SUBSTR caseIgnoreIA5SubstringsMatch
230 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
232 attributetype ( 1.3.6.1.4.1.9586.100.4.2.16
234 DESC 'hardware architecture of server'
235 EQUALITY caseIgnoreIA5Match
236 SUBSTR caseIgnoreIA5SubstringsMatch
237 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
239 attributetype ( 1.3.6.1.4.1.9586.100.4.2.17
241 DESC 'type of network connection for server'
242 EQUALITY caseIgnoreMatch
243 SUBSTR caseIgnoreSubstringsMatch
244 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
246 attributetype ( 1.3.6.1.4.1.9586.100.4.2.18
248 DESC 'amount of disk space available to server'
249 EQUALITY caseIgnoreMatch
250 SUBSTR caseIgnoreSubstringsMatch
251 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
253 attributetype ( 1.3.6.1.4.1.9586.100.4.2.19
255 DESC 'host OS distribution'
256 EQUALITY caseIgnoreIA5Match
257 SUBSTR caseIgnoreIA5SubstringsMatch
258 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
260 #attributetype ( 1.3.6.1.4.1.9586.100.4.2.20
262 # DESC '(short) host name of server'
263 # EQUALITY caseIgnoreIA5Match
264 # SUBSTR caseIgnoreIA5SubstringsMatch
265 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGLE-VALUE )
267 attributetype ( 1.3.6.1.4.1.9586.100.4.2.21
269 DESC 'FQDN of the server'
270 EQUALITY caseIgnoreIA5Match
271 SUBSTR caseIgnoreIA5SubstringsMatch
272 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
274 attributetype ( 1.3.6.1.4.1.9586.100.4.2.22
276 DESC 'description of physical hardware'
277 EQUALITY caseIgnoreMatch
278 SUBSTR caseIgnoreSubstringsMatch
279 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE )
281 attributetype ( 1.3.6.1.4.1.9586.100.4.2.23
283 DESC 'amount of RAM available to server'
284 EQUALITY caseIgnoreMatch
285 SUBSTR caseIgnoreSubstringsMatch
286 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
288 attributetype ( 1.3.6.1.4.1.9586.100.4.2.24
290 DESC 'name of the sponsor of this server'
291 EQUALITY caseIgnoreMatch
292 SUBSTR caseIgnoreSubstringsMatch
293 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
295 attributetype ( 1.3.6.1.4.1.9586.100.4.2.25
297 DESC 'email address of sponsoring server administrator'
298 EQUALITY caseIgnoreIA5Match
299 SUBSTR caseIgnoreIA5SubstringsMatch
300 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
302 attributetype ( 1.3.6.1.4.1.9586.100.4.2.26
304 DESC 'textual form of an SSH public host key compatible with known_hosts'
305 EQUALITY caseIgnoreMatch
306 SUBSTR caseIgnoreSubstringsMatch
307 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
309 attributetype ( 1.3.6.1.4.1.9586.100.4.2.27
311 DESC 'administrative status of server'
312 EQUALITY caseIgnoreMatch
313 SUBSTR caseIgnoreSubstringsMatch
314 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
316 attributetype ( 1.3.6.1.4.1.9586.100.4.2.28
318 DESC 'The GECOS field; the common name'
319 EQUALITY caseIgnoreMatch
320 SUBSTR caseIgnoreSubstringsMatch
321 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
323 attributetype ( 1.3.6.1.4.1.9586.100.4.2.29
326 EQUALITY caseExactIA5Match
327 SUBSTR caseExactIA5SubstringsMatch
328 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
330 attributetype ( 1.3.6.1.4.1.9586.100.4.2.30
332 DESC 'ISO 5218 representation of human gender'
333 EQUALITY integerMatch
335 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27{1} )
337 attributetype ( 1.3.6.1.4.1.9586.100.4.2.31
339 DESC 'Date of birth in YYYYMMDD format'
340 EQUALITY numericStringMatch
342 SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{8} )
344 attributetype ( 1.3.6.1.4.1.9586.100.4.2.32
345 NAME 'mailDisableMessage'
346 DESC 'Message returned when all mail is disabled'
347 EQUALITY caseIgnoreIA5Match
348 SUBSTR caseIgnoreIA5SubstringsMatch
349 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
351 attributetype ( 1.3.6.1.4.1.9586.100.4.2.33
353 DESC 'purposes of this server'
354 EQUALITY caseIgnoreMatch
355 SUBSTR caseIgnoreSubstringsMatch
356 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
358 attributetype ( 1.3.6.1.4.1.9586.100.4.2.34
360 DESC 'FQDN of the physical host of this virtual server'
361 EQUALITY caseIgnoreIA5Match
362 SUBSTR caseIgnoreIA5SubstringsMatch
364 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
366 attributetype ( 1.3.6.1.4.1.9586.100.4.2.35
368 DESC 'VoIP URL to communicate with that person'
369 EQUALITY caseIgnoreIA5Match
370 SUBSTR caseIgnoreIA5SubstringsMatch
371 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
373 attributetype ( 1.3.6.1.4.1.9586.100.4.2.36
376 EQUALITY octetStringMatch
377 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
379 attributetype ( 1.3.6.1.4.1.9586.100.4.2.37
381 DESC 'name of other group for which membership implied by memberschip to this group'
382 EQUALITY caseIgnoreIA5Match
383 SUBSTR caseIgnoreIA5SubstringsMatch
384 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
386 # more attributes below
387 attributetype ( 1.3.6.1.4.1.9586.100.4.2.39
389 DESC 'Groups that have access to a host'
390 EQUALITY caseExactIA5Match
391 SUBSTR caseExactIA5SubstringsMatch
392 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
394 attributetype ( 1.3.6.1.4.1.9586.100.4.2.40
396 DESC 'export options for servers'
397 EQUALITY caseIgnoreIA5Match
398 SUBSTR caseIgnoreIA5SubstringsMatch
399 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
401 # Experimental attribute types
403 # There are existing schemas for doing DNS in LDAP; would one of
404 # these be better? c.f. draft-miller-dns-ldap-schema-00 (expired)
405 attributetype ( 1.3.6.1.4.1.9586.100.4.4.2
407 DESC 'DNS zone record for user'
408 EQUALITY octetStringMatch
409 SUBSTR caseIgnoreSubstringsMatch
410 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
412 # rfc822mailbox (RFC1274) is recommended as a replacement for this in
414 attributetype ( 1.3.6.1.4.1.9586.100.4.4.3
416 DESC 'forwarding address for email sent to this account'
417 EQUALITY caseIgnoreIA5Match
418 SUBSTR caseIgnoreIA5SubstringsMatch
419 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
421 # Network Associates also has a schema for PGP keys / key IDs which may
422 # or may not be applicable:
423 # http://www.openldap.org/lists/openldap-devel/200010/msg00071.html
424 attributetype ( 1.3.6.1.4.1.9586.100.4.4.4
425 NAME 'keyFingerPrint'
426 EQUALITY caseIgnoreMatch
427 SUBSTR caseIgnoreSubstringsMatch
428 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
430 # Rather Debian-specific, not useful to the public.
431 attributetype ( 1.3.6.1.4.1.9586.100.4.4.5
433 DESC 'email subscription address for debian-private mailing list'
434 EQUALITY caseIgnoreIA5Match
435 SUBSTR caseIgnoreIA5SubstringsMatch
436 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
438 # Echelon attributes; re-evaluate later
439 attributetype ( 1.3.6.1.4.1.9586.100.4.4.6
440 NAME 'accountComment'
441 DESC 'additional comments regarding the account status'
442 EQUALITY caseIgnoreIA5Match
443 SUBSTR caseIgnoreIA5SubstringsMatch
444 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
446 attributetype ( 1.3.6.1.4.1.9586.100.4.4.7
448 DESC 'Debian developer account status'
449 EQUALITY caseIgnoreIA5Match
450 SUBSTR caseIgnoreIA5SubstringsMatch
451 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
453 # mail attributes; not public information
454 attributetype ( 1.3.6.1.4.1.9586.100.4.4.8
456 DESC 'Whether or not to require a successful callout attempt on email delivery'
457 EQUALITY booleanMatch
458 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
460 attributetype ( 1.3.6.1.4.1.9586.100.4.4.9
461 NAME 'mailGreylisting'
462 DESC 'Whether or not to perform greylisting on email delivery'
463 EQUALITY booleanMatch
464 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
466 attributetype ( 1.3.6.1.4.1.9586.100.4.4.11
468 DESC 'RBL sites to check at SMTP accept time'
469 EQUALITY caseIgnoreIA5Match
470 SUBSTR caseIgnoreIA5SubstringsMatch
471 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
473 attributetype ( 1.3.6.1.4.1.9586.100.4.4.12
475 DESC 'RHSBL sites to check at SMTP accept time'
476 EQUALITY caseIgnoreIA5Match
477 SUBSTR caseIgnoreIA5SubstringsMatch
478 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
480 attributetype ( 1.3.6.1.4.1.9586.100.4.4.13
482 DESC 'sites to whitelist from additional SMTP accept time checks'
483 EQUALITY caseIgnoreIA5Match
484 SUBSTR caseIgnoreIA5SubstringsMatch
485 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
487 attributetype ( 1.3.6.1.4.1.9586.100.4.4.14
489 DESC 'Token for BATV'
490 EQUALITY caseExactMatch
491 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
493 attributetype ( 1.3.6.1.4.1.9586.100.4.2.38
494 NAME 'mailContentInspectionAction'
495 DESC 'what to do on content inspection hits'
496 EQUALITY caseIgnoreIA5Match
497 SUBSTR caseIgnoreIA5SubstringsMatch
498 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
500 attributetype ( 1.3.6.1.4.1.9586.100.4.2.41
501 NAME ( 'sshdistAuthKeysHost' )
504 attributetype ( 1.3.6.1.4.1.9586.100.4.4.42
506 DESC 'DNS Time To Live value'
507 EQUALITY caseIgnoreIA5Match
508 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
510 # Public object classes
512 objectclass ( 1.3.6.1.4.1.9586.100.4.1.1
514 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
516 MUST ( cn $ uid $ uidNumber $ gidNumber )
517 MAY ( userPassword $ loginShell $ gecos $ homeDirectory $ description $ mailDisableMessage $ sudoPassword ) )
519 objectclass ( 1.3.6.1.4.1.9586.100.4.1.2
522 DESC 'attributes used for Debian groups'
523 MUST ( gid $ gidNumber )
524 MAY ( description $ subGroup $ accountStatus ) )
526 # Experimental objectclasses:
528 objectclass ( 1.3.6.1.4.1.9586.100.4.3.1
529 NAME 'debianDeveloper'
530 DESC 'additional account attributes used by Debian'
532 MUST ( uid $ cn $ sn )
533 MAY ( accountComment $ accountStatus $ activity-from $
534 activity-pgp $ allowedHost $ comment $ countryName $
535 dnsZoneEntry $ emailForward $ icqUin $ ircNick $
536 jabberJID $ keyFingerPrint $ latitude $ longitude $ mn $
537 onVacation $ privateSub $ sshRSAAuthKey $ supplementaryGid $
538 access $ gender $ birthDate $ mailCallout $ mailGreylisting $
539 mailRBL $ mailRHSBL $ mailWhitelist $ VoIP $ mailContentInspectionAction
542 objectclass ( 1.3.6.1.4.1.9586.100.4.3.2
544 DESC 'Internet-connected server associated with Debian'
546 MUST ( host $ hostname )
547 MAY ( c $ access $ admin $ architecture $ bandwidth $ description $ disk $
548 distribution $ l $ machine $ memory $ sponsor $
549 sponsor-admin $ status $ physicalHost $ ipHostNumber $ dnsTTL $
550 sshRSAHostKey $ purpose $ allowedGroups $ exportOptions $ MXRecord $
554 objectclass ( 1.3.6.1.4.1.9586.100.4.3.3
555 NAME 'debianRoleAccount'
556 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
557 SUP account STRUCTURAL
558 MAY ( emailForward $ supplementaryGid $ allowedHost $ labeledURI $
559 mailCallout $ mailGreylisting $ mailRBL $ mailRHSBL $
560 mailWhitelist $ dnsZoneEntry $ mailContentInspectionAction