3 # - [PP] Now version controlled in db.d.o git repository, also see debian/changelog - 2009
4 # - [PP] Now version controlled in db.d.o bzr repository - 2007-12-25
7 # - [HE] Add 'purpose', 'physicalHost' to debianServer - 2007-12-25
8 # - [zobel] Add 'VoIP' - 2008-05-10
9 # - [luk] Add 'subGroup' to group - 2008-11-22
12 # - Add 'gender' and 'birthDate' to debianDeveloper
13 # - Add 'mailDisableMessage' to debianAccount
14 # - Add 'mailDisableMessage', 'mailCallout', 'mailGreylisting', 'mailRBL',
15 # 'mailRHSBL', and 'mailWhitelist' to debianDeveloper and debianRoleAccount
18 # - Add 'access' as a MAY for debianServer objectclass.
19 # - Make activity-from a UTF-8 string rather than ASCII.
20 # - add new debianRoleAccount objectclass.
23 # - Add 'access' as a MAY for debianDeveloper objectclass.
24 # - Add 'gid' attribute.
25 # - Make homeDirectory a MAY not MUST for debianAccount.
26 # - drop userPassword and memberUID MAYs from debianGroup.
27 # - add SUP top STRUCTURAL to debianGroup.
30 # - add a UTF8-enabled 'gecos' attribute type, conflicts with RFC2307
31 # - add debianAccount, which is roughly equivalent to posixAccount but
32 # permits UTF8 gecos fields
33 # - add debianGroup, which is the same as above but for posixGroup
36 # - Remove labeledURI, jpegPhoto from the list of supported
37 # attributes; using inetOrgPerson instead of organizationalPerson as
38 # a structural objectclass gives us both of these, and several other
39 # attributes that may be useful.
40 # - Add echelon attributes for MIA work to the debiandeveloper
41 # objectclass. (accountcomment,accountstatus)
42 # - Add specification for debianServer objectclass, used for Debian
46 # - grammarfied 'allowedHosts' to 'allowedHost' as
47 # 1.3.6.1.4.1.9586.100.4.2.12.
48 # - add 'privateSub' as 1.3.6.1.4.1.9586.100.4.4.5.
49 # - add 'jabberJID' as 1.3.6.1.4.1.9586.100.4.2.13.
50 # - change 'icqUIN' to an integer type (see? I told you it wasn't
51 # approved for use yet! ;)
57 # Project: db.debian.org
58 # Contact: Debian directory administrators <admin@db.debian.org>
62 # enterprise.Debian.project.userdir / 1.3.6.1.4.1.9586.100.4
64 # .1 - public LDAP objectClasses
68 # .2 - public LDAP attributeTypes
77 # .9 - middlename (mn)
79 # .11 - supplementaryGid
100 # .32 - mailDisableMessage
106 # .38 - mailContentInspectionAction
107 # .39 - allowedGroups
108 # .40 - exportOptions
109 # .41 - sshdistAuthKeysHost
111 # .3 - experimental LDAP objectClasses
112 # .1 - debianDeveloper
114 # .3 - debianRoleAccount
116 # .4 - experimental LDAP attributeTypes
117 # .1 - allowedHosts - OBSOLETED
120 # .4 - keyFingerPrint
122 # .6 - accountComment
124 # .8 - perform callouts
125 # .9 - perform greylisting
130 # Public attribute types
131 attributetype ( 1.3.6.1.4.1.9586.100.4.2.1
133 DESC 'textual form of an SSH public key compatible with authorized_keys'
134 EQUALITY caseIgnoreMatch
135 SUBSTR caseIgnoreSubstringsMatch
136 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
138 attributetype ( 1.3.6.1.4.1.9586.100.4.2.2
140 DESC 'last known activity from user email address'
141 EQUALITY caseExactMatch
142 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
144 attributetype ( 1.3.6.1.4.1.9586.100.4.2.3
146 DESC 'last known activity from user PGP key'
147 EQUALITY caseExactIA5Match
148 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
150 attributetype ( 1.3.6.1.4.1.9586.100.4.2.4
152 DESC 'user-editable comment'
153 EQUALITY caseExactIA5Match
154 SUBSTR caseIgnoreIA5SubstringsMatch
155 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
157 attributetype ( 1.3.6.1.4.1.9586.100.4.2.5
159 DESC 'UIN for ICQ instant messaging system'
160 EQUALITY integerMatch
161 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
163 attributetype ( 1.3.6.1.4.1.9586.100.4.2.6
165 DESC 'Internet Relay Chat nickname'
166 EQUALITY caseIgnoreIA5Match
167 SUBSTR caseIgnoreIA5SubstringsMatch
168 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
170 attributetype ( 1.3.6.1.4.1.9586.100.4.2.7
172 DESC 'latitude coordinate'
173 EQUALITY caseExactIA5Match
174 SUBSTR caseExactIA5SubstringsMatch
175 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
177 attributetype ( 1.3.6.1.4.1.9586.100.4.2.8
179 DESC 'longitude coordinate'
180 EQUALITY caseExactIA5Match
181 SUBSTR caseExactIA5SubstringsMatch
182 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
184 attributetype ( 1.3.6.1.4.1.9586.100.4.2.9
185 NAME ( 'mn' 'middlename' )
188 attributetype ( 1.3.6.1.4.1.9586.100.4.2.10
190 DESC 'vacation message'
191 EQUALITY caseIgnoreMatch
192 SUBSTR caseIgnoreSubstringsMatch
193 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
195 attributetype ( 1.3.6.1.4.1.9586.100.4.2.11
196 NAME 'supplementaryGid'
197 DESC 'additional Unix group id of user'
198 EQUALITY caseIgnoreMatch
199 SUBSTR caseIgnoreSubstringsMatch
200 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
202 attributetype ( 1.3.6.1.4.1.9586.100.4.2.12
204 DESC 'host name this account is allowed access to'
205 EQUALITY caseIgnoreIA5Match
206 SUBSTR caseIgnoreIA5SubstringsMatch
207 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
209 attributetype ( 1.3.6.1.4.1.9586.100.4.2.13
211 DESC 'JID for Jabber instant messaging protocol'
212 EQUALITY caseIgnoreIA5Match
213 SUBSTR caseIgnoreIA5SubstringsMatch
214 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
216 attributetype ( 1.3.6.1.4.1.9586.100.4.2.14
218 DESC 'nature of access allowed to server'
219 EQUALITY caseIgnoreMatch
220 SUBSTR caseIgnoreSubstringsMatch
221 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
223 attributetype ( 1.3.6.1.4.1.9586.100.4.2.15
225 DESC 'email address of server administrator'
226 EQUALITY caseIgnoreIA5Match
227 SUBSTR caseIgnoreIA5SubstringsMatch
228 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
230 attributetype ( 1.3.6.1.4.1.9586.100.4.2.16
232 DESC 'hardware architecture of server'
233 EQUALITY caseIgnoreIA5Match
234 SUBSTR caseIgnoreIA5SubstringsMatch
235 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
237 attributetype ( 1.3.6.1.4.1.9586.100.4.2.17
239 DESC 'type of network connection for server'
240 EQUALITY caseIgnoreMatch
241 SUBSTR caseIgnoreSubstringsMatch
242 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
244 attributetype ( 1.3.6.1.4.1.9586.100.4.2.18
246 DESC 'amount of disk space available to server'
247 EQUALITY caseIgnoreMatch
248 SUBSTR caseIgnoreSubstringsMatch
249 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
251 attributetype ( 1.3.6.1.4.1.9586.100.4.2.19
253 DESC 'host OS distribution'
254 EQUALITY caseIgnoreIA5Match
255 SUBSTR caseIgnoreIA5SubstringsMatch
256 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
258 #attributetype ( 1.3.6.1.4.1.9586.100.4.2.20
260 # DESC '(short) host name of server'
261 # EQUALITY caseIgnoreIA5Match
262 # SUBSTR caseIgnoreIA5SubstringsMatch
263 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGLE-VALUE )
265 attributetype ( 1.3.6.1.4.1.9586.100.4.2.21
267 DESC 'FQDN of the server'
268 EQUALITY caseIgnoreIA5Match
269 SUBSTR caseIgnoreIA5SubstringsMatch
270 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
272 attributetype ( 1.3.6.1.4.1.9586.100.4.2.22
274 DESC 'description of physical hardware'
275 EQUALITY caseIgnoreMatch
276 SUBSTR caseIgnoreSubstringsMatch
277 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE )
279 attributetype ( 1.3.6.1.4.1.9586.100.4.2.23
281 DESC 'amount of RAM available to server'
282 EQUALITY caseIgnoreMatch
283 SUBSTR caseIgnoreSubstringsMatch
284 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
286 attributetype ( 1.3.6.1.4.1.9586.100.4.2.24
288 DESC 'name of the sponsor of this server'
289 EQUALITY caseIgnoreMatch
290 SUBSTR caseIgnoreSubstringsMatch
291 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
293 attributetype ( 1.3.6.1.4.1.9586.100.4.2.25
295 DESC 'email address of sponsoring server administrator'
296 EQUALITY caseIgnoreIA5Match
297 SUBSTR caseIgnoreIA5SubstringsMatch
298 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
300 attributetype ( 1.3.6.1.4.1.9586.100.4.2.26
302 DESC 'textual form of an SSH public host key compatible with known_hosts'
303 EQUALITY caseIgnoreMatch
304 SUBSTR caseIgnoreSubstringsMatch
305 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
307 attributetype ( 1.3.6.1.4.1.9586.100.4.2.27
309 DESC 'administrative status of server'
310 EQUALITY caseIgnoreMatch
311 SUBSTR caseIgnoreSubstringsMatch
312 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
314 attributetype ( 1.3.6.1.4.1.9586.100.4.2.28
316 DESC 'The GECOS field; the common name'
317 EQUALITY caseIgnoreMatch
318 SUBSTR caseIgnoreSubstringsMatch
319 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
321 attributetype ( 1.3.6.1.4.1.9586.100.4.2.29
324 EQUALITY caseExactIA5Match
325 SUBSTR caseExactIA5SubstringsMatch
326 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
328 attributetype ( 1.3.6.1.4.1.9586.100.4.2.30
330 DESC 'ISO 5218 representation of human gender'
331 EQUALITY integerMatch
333 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27{1} )
335 attributetype ( 1.3.6.1.4.1.9586.100.4.2.31
337 DESC 'Date of birth in YYYYMMDD format'
338 EQUALITY numericStringMatch
340 SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{8} )
342 attributetype ( 1.3.6.1.4.1.9586.100.4.2.32
343 NAME 'mailDisableMessage'
344 DESC 'Message returned when all mail is disabled'
345 EQUALITY caseIgnoreIA5Match
346 SUBSTR caseIgnoreIA5SubstringsMatch
347 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
349 attributetype ( 1.3.6.1.4.1.9586.100.4.2.33
351 DESC 'purposes of this server'
352 EQUALITY caseIgnoreMatch
353 SUBSTR caseIgnoreSubstringsMatch
354 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
356 attributetype ( 1.3.6.1.4.1.9586.100.4.2.34
358 DESC 'FQDN of the physical host of this virtual server'
359 EQUALITY caseIgnoreIA5Match
360 SUBSTR caseIgnoreIA5SubstringsMatch
362 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
364 attributetype ( 1.3.6.1.4.1.9586.100.4.2.35
366 DESC 'VoIP URL to communicate with that person'
367 EQUALITY caseIgnoreIA5Match
368 SUBSTR caseIgnoreIA5SubstringsMatch
369 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
371 attributetype ( 1.3.6.1.4.1.9586.100.4.2.36
374 EQUALITY octetStringMatch
375 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
377 attributetype ( 1.3.6.1.4.1.9586.100.4.2.37
379 DESC 'name of other group for which membership implied by memberschip to this group'
380 EQUALITY caseIgnoreIA5Match
381 SUBSTR caseIgnoreIA5SubstringsMatch
382 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
384 # more attributes below
385 attributetype ( 1.3.6.1.4.1.9586.100.4.2.39
387 DESC 'Groups that have access to a host'
388 EQUALITY caseExactIA5Match
389 SUBSTR caseExactIA5SubstringsMatch
390 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
392 attributetype ( 1.3.6.1.4.1.9586.100.4.2.40
394 DESC 'export options for servers'
395 EQUALITY caseIgnoreIA5Match
396 SUBSTR caseIgnoreIA5SubstringsMatch
397 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
399 # Experimental attribute types
401 # There are existing schemas for doing DNS in LDAP; would one of
402 # these be better? c.f. draft-miller-dns-ldap-schema-00 (expired)
403 attributetype ( 1.3.6.1.4.1.9586.100.4.4.2
405 DESC 'DNS zone record for user'
406 EQUALITY octetStringMatch
407 SUBSTR caseIgnoreSubstringsMatch
408 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
410 # rfc822mailbox (RFC1274) is recommended as a replacement for this in
412 attributetype ( 1.3.6.1.4.1.9586.100.4.4.3
414 DESC 'forwarding address for email sent to this account'
415 EQUALITY caseIgnoreIA5Match
416 SUBSTR caseIgnoreIA5SubstringsMatch
417 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
419 # Network Associates also has a schema for PGP keys / key IDs which may
420 # or may not be applicable:
421 # http://www.openldap.org/lists/openldap-devel/200010/msg00071.html
422 attributetype ( 1.3.6.1.4.1.9586.100.4.4.4
423 NAME 'keyFingerPrint'
424 EQUALITY caseIgnoreMatch
425 SUBSTR caseIgnoreSubstringsMatch
426 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
428 # Rather Debian-specific, not useful to the public.
429 attributetype ( 1.3.6.1.4.1.9586.100.4.4.5
431 DESC 'email subscription address for debian-private mailing list'
432 EQUALITY caseIgnoreIA5Match
433 SUBSTR caseIgnoreIA5SubstringsMatch
434 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
436 # Echelon attributes; re-evaluate later
437 attributetype ( 1.3.6.1.4.1.9586.100.4.4.6
438 NAME 'accountComment'
439 DESC 'additional comments regarding the account status'
440 EQUALITY caseIgnoreIA5Match
441 SUBSTR caseIgnoreIA5SubstringsMatch
442 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
444 attributetype ( 1.3.6.1.4.1.9586.100.4.4.7
446 DESC 'Debian developer account status'
447 EQUALITY caseIgnoreIA5Match
448 SUBSTR caseIgnoreIA5SubstringsMatch
449 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
451 # mail attributes; not public information
452 attributetype ( 1.3.6.1.4.1.9586.100.4.4.8
454 DESC 'Whether or not to require a successful callout attempt on email delivery'
455 EQUALITY booleanMatch
456 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
458 attributetype ( 1.3.6.1.4.1.9586.100.4.4.9
459 NAME 'mailGreylisting'
460 DESC 'Whether or not to perform greylisting on email delivery'
461 EQUALITY booleanMatch
462 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
464 attributetype ( 1.3.6.1.4.1.9586.100.4.4.11
466 DESC 'RBL sites to check at SMTP accept time'
467 EQUALITY caseIgnoreIA5Match
468 SUBSTR caseIgnoreIA5SubstringsMatch
469 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
471 attributetype ( 1.3.6.1.4.1.9586.100.4.4.12
473 DESC 'RHSBL sites to check at SMTP accept time'
474 EQUALITY caseIgnoreIA5Match
475 SUBSTR caseIgnoreIA5SubstringsMatch
476 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
478 attributetype ( 1.3.6.1.4.1.9586.100.4.4.13
480 DESC 'sites to whitelist from additional SMTP accept time checks'
481 EQUALITY caseIgnoreIA5Match
482 SUBSTR caseIgnoreIA5SubstringsMatch
483 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
485 attributetype ( 1.3.6.1.4.1.9586.100.4.2.38
486 NAME 'mailContentInspectionAction'
487 DESC 'what to do on content inspection hits'
488 EQUALITY caseIgnoreIA5Match
489 SUBSTR caseIgnoreIA5SubstringsMatch
490 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
492 attributetype ( 1.3.6.1.4.1.9586.100.4.2.41
493 NAME ( 'sshdistAuthKeysHost' )
497 # Public object classes
499 objectclass ( 1.3.6.1.4.1.9586.100.4.1.1
501 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
503 MUST ( cn $ uid $ uidNumber $ gidNumber )
504 MAY ( userPassword $ loginShell $ gecos $ homeDirectory $ description $ mailDisableMessage $ sudoPassword ) )
506 objectclass ( 1.3.6.1.4.1.9586.100.4.1.2
509 DESC 'attributes used for Debian groups'
510 MUST ( gid $ gidNumber )
511 MAY ( description $ subGroup $ accountStatus ) )
513 # Experimental objectclasses:
515 objectclass ( 1.3.6.1.4.1.9586.100.4.3.1
516 NAME 'debianDeveloper'
517 DESC 'additional account attributes used by Debian'
519 MUST ( uid $ cn $ sn )
520 MAY ( accountComment $ accountStatus $ activity-from $
521 activity-pgp $ allowedHost $ comment $ countryName $
522 dnsZoneEntry $ emailForward $ icqUin $ ircNick $
523 jabberJID $ keyFingerPrint $ latitude $ longitude $ mn $
524 onVacation $ privateSub $ sshRSAAuthKey $ supplementaryGid $
525 access $ gender $ birthDate $ mailCallout $ mailGreylisting $
526 mailRBL $ mailRHSBL $ mailWhitelist $ VoIP $ mailContentInspectionAction
529 objectclass ( 1.3.6.1.4.1.9586.100.4.3.2
531 DESC 'Internet-connected server associated with Debian'
533 MUST ( host $ hostname )
534 MAY ( c $ access $ admin $ architecture $ bandwidth $ description $ disk $
535 distribution $ l $ machine $ memory $ sponsor $
536 sponsor-admin $ status $ physicalHost $ ipHostNumber $
537 sshRSAHostKey $ purpose $ allowedGroups $ exportOptions $ MXRecord $
541 objectclass ( 1.3.6.1.4.1.9586.100.4.3.3
542 NAME 'debianRoleAccount'
543 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
544 SUP account STRUCTURAL
545 MAY ( emailForward $ supplementaryGid $ allowedHost $ labeledURI $
546 mailCallout $ mailGreylisting $ mailRBL $ mailRHSBL $
547 mailWhitelist $ dnsZoneEntry $ mailContentInspectionAction