3 # - [PP] Now version controlled in db.d.o git repository, also see debian/changelog - 2009
4 # - [PP] Now version controlled in db.d.o bzr repository - 2007-12-25
7 # - [HE] Add 'purpose', 'physicalHost' to debianServer - 2007-12-25
8 # - [zobel] Add 'VoIP' - 2008-05-10
9 # - [luk] Add 'subGroup' to group - 2008-11-22
12 # - Add 'gender' and 'birthDate' to debianDeveloper
13 # - Add 'mailDisableMessage' to debianAccount
14 # - Add 'mailDisableMessage', 'mailCallout', 'mailGreylisting', 'mailRBL',
15 # 'mailRHSBL', and 'mailWhitelist' to debianDeveloper and debianRoleAccount
18 # - Add 'access' as a MAY for debianServer objectclass.
19 # - Make activity-from a UTF-8 string rather than ASCII.
20 # - add new debianRoleAccount objectclass.
23 # - Add 'access' as a MAY for debianDeveloper objectclass.
24 # - Add 'gid' attribute.
25 # - Make homeDirectory a MAY not MUST for debianAccount.
26 # - drop userPassword and memberUID MAYs from debianGroup.
27 # - add SUP top STRUCTURAL to debianGroup.
30 # - add a UTF8-enabled 'gecos' attribute type, conflicts with RFC2307
31 # - add debianAccount, which is roughly equivalent to posixAccount but
32 # permits UTF8 gecos fields
33 # - add debianGroup, which is the same as above but for posixGroup
36 # - Remove labeledURI, jpegPhoto from the list of supported
37 # attributes; using inetOrgPerson instead of organizationalPerson as
38 # a structural objectclass gives us both of these, and several other
39 # attributes that may be useful.
40 # - Add echelon attributes for MIA work to the debiandeveloper
41 # objectclass. (accountcomment,accountstatus)
42 # - Add specification for debianServer objectclass, used for Debian
46 # - grammarfied 'allowedHosts' to 'allowedHost' as
47 # 1.3.6.1.4.1.9586.100.4.2.12.
48 # - add 'privateSub' as 1.3.6.1.4.1.9586.100.4.4.5.
49 # - add 'jabberJID' as 1.3.6.1.4.1.9586.100.4.2.13.
50 # - change 'icqUIN' to an integer type (see? I told you it wasn't
51 # approved for use yet! ;)
57 # Project: db.debian.org
58 # Contact: Debian directory administrators <admin@db.debian.org>
62 # enterprise.Debian.project.userdir / 1.3.6.1.4.1.9586.100.4
64 # .1 - public LDAP objectClasses
68 # .2 - public LDAP attributeTypes
77 # .9 - middlename (mn)
79 # .11 - supplementaryGid
100 # .32 - mailDisableMessage
106 # .38 - mailContentInspectionAction
107 # .39 - allowedGroups
108 # .40 - exportOptions
110 # .3 - experimental LDAP objectClasses
111 # .1 - debianDeveloper
113 # .3 - debianRoleAccount
115 # .4 - experimental LDAP attributeTypes
116 # .1 - allowedHosts - OBSOLETED
119 # .4 - keyFingerPrint
121 # .6 - accountComment
123 # .8 - perform callouts
124 # .9 - perform greylisting
129 # Public attribute types
130 attributetype ( 1.3.6.1.4.1.9586.100.4.2.1
132 DESC 'textual form of an SSH public key compatible with authorized_keys'
133 EQUALITY caseIgnoreMatch
134 SUBSTR caseIgnoreSubstringsMatch
135 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
137 attributetype ( 1.3.6.1.4.1.9586.100.4.2.2
139 DESC 'last known activity from user email address'
140 EQUALITY caseExactMatch
141 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
143 attributetype ( 1.3.6.1.4.1.9586.100.4.2.3
145 DESC 'last known activity from user PGP key'
146 EQUALITY caseExactIA5Match
147 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
149 attributetype ( 1.3.6.1.4.1.9586.100.4.2.4
151 DESC 'user-editable comment'
152 EQUALITY caseExactIA5Match
153 SUBSTR caseIgnoreIA5SubstringsMatch
154 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
156 attributetype ( 1.3.6.1.4.1.9586.100.4.2.5
158 DESC 'UIN for ICQ instant messaging system'
159 EQUALITY integerMatch
160 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
162 attributetype ( 1.3.6.1.4.1.9586.100.4.2.6
164 DESC 'Internet Relay Chat nickname'
165 EQUALITY caseIgnoreIA5Match
166 SUBSTR caseIgnoreIA5SubstringsMatch
167 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
169 attributetype ( 1.3.6.1.4.1.9586.100.4.2.7
171 DESC 'latitude coordinate'
172 EQUALITY caseExactIA5Match
173 SUBSTR caseExactIA5SubstringsMatch
174 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
176 attributetype ( 1.3.6.1.4.1.9586.100.4.2.8
178 DESC 'longitude coordinate'
179 EQUALITY caseExactIA5Match
180 SUBSTR caseExactIA5SubstringsMatch
181 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
183 attributetype ( 1.3.6.1.4.1.9586.100.4.2.9
184 NAME ( 'mn' 'middlename' )
187 attributetype ( 1.3.6.1.4.1.9586.100.4.2.10
189 DESC 'vacation message'
190 EQUALITY caseIgnoreMatch
191 SUBSTR caseIgnoreSubstringsMatch
192 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
194 attributetype ( 1.3.6.1.4.1.9586.100.4.2.11
195 NAME 'supplementaryGid'
196 DESC 'additional Unix group id of user'
197 EQUALITY caseIgnoreMatch
198 SUBSTR caseIgnoreSubstringsMatch
199 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
201 attributetype ( 1.3.6.1.4.1.9586.100.4.2.12
203 DESC 'host name this account is allowed access to'
204 EQUALITY caseIgnoreIA5Match
205 SUBSTR caseIgnoreIA5SubstringsMatch
206 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
208 attributetype ( 1.3.6.1.4.1.9586.100.4.2.13
210 DESC 'JID for Jabber instant messaging protocol'
211 EQUALITY caseIgnoreIA5Match
212 SUBSTR caseIgnoreIA5SubstringsMatch
213 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
215 attributetype ( 1.3.6.1.4.1.9586.100.4.2.14
217 DESC 'nature of access allowed to server'
218 EQUALITY caseIgnoreMatch
219 SUBSTR caseIgnoreSubstringsMatch
220 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
222 attributetype ( 1.3.6.1.4.1.9586.100.4.2.15
224 DESC 'email address of server administrator'
225 EQUALITY caseIgnoreIA5Match
226 SUBSTR caseIgnoreIA5SubstringsMatch
227 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
229 attributetype ( 1.3.6.1.4.1.9586.100.4.2.16
231 DESC 'hardware architecture of server'
232 EQUALITY caseIgnoreIA5Match
233 SUBSTR caseIgnoreIA5SubstringsMatch
234 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
236 attributetype ( 1.3.6.1.4.1.9586.100.4.2.17
238 DESC 'type of network connection for server'
239 EQUALITY caseIgnoreMatch
240 SUBSTR caseIgnoreSubstringsMatch
241 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
243 attributetype ( 1.3.6.1.4.1.9586.100.4.2.18
245 DESC 'amount of disk space available to server'
246 EQUALITY caseIgnoreMatch
247 SUBSTR caseIgnoreSubstringsMatch
248 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
250 attributetype ( 1.3.6.1.4.1.9586.100.4.2.19
252 DESC 'host OS distribution'
253 EQUALITY caseIgnoreIA5Match
254 SUBSTR caseIgnoreIA5SubstringsMatch
255 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
257 #attributetype ( 1.3.6.1.4.1.9586.100.4.2.20
259 # DESC '(short) host name of server'
260 # EQUALITY caseIgnoreIA5Match
261 # SUBSTR caseIgnoreIA5SubstringsMatch
262 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGLE-VALUE )
264 attributetype ( 1.3.6.1.4.1.9586.100.4.2.21
266 DESC 'FQDN of the server'
267 EQUALITY caseIgnoreIA5Match
268 SUBSTR caseIgnoreIA5SubstringsMatch
269 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
271 attributetype ( 1.3.6.1.4.1.9586.100.4.2.22
273 DESC 'description of physical hardware'
274 EQUALITY caseIgnoreMatch
275 SUBSTR caseIgnoreSubstringsMatch
276 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE )
278 attributetype ( 1.3.6.1.4.1.9586.100.4.2.23
280 DESC 'amount of RAM available to server'
281 EQUALITY caseIgnoreMatch
282 SUBSTR caseIgnoreSubstringsMatch
283 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
285 attributetype ( 1.3.6.1.4.1.9586.100.4.2.24
287 DESC 'name of the sponsor of this server'
288 EQUALITY caseIgnoreMatch
289 SUBSTR caseIgnoreSubstringsMatch
290 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
292 attributetype ( 1.3.6.1.4.1.9586.100.4.2.25
294 DESC 'email address of sponsoring server administrator'
295 EQUALITY caseIgnoreIA5Match
296 SUBSTR caseIgnoreIA5SubstringsMatch
297 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
299 attributetype ( 1.3.6.1.4.1.9586.100.4.2.26
301 DESC 'textual form of an SSH public host key compatible with known_hosts'
302 EQUALITY caseIgnoreMatch
303 SUBSTR caseIgnoreSubstringsMatch
304 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
306 attributetype ( 1.3.6.1.4.1.9586.100.4.2.27
308 DESC 'administrative status of server'
309 EQUALITY caseIgnoreMatch
310 SUBSTR caseIgnoreSubstringsMatch
311 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
313 attributetype ( 1.3.6.1.4.1.9586.100.4.2.28
315 DESC 'The GECOS field; the common name'
316 EQUALITY caseIgnoreMatch
317 SUBSTR caseIgnoreSubstringsMatch
318 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
320 attributetype ( 1.3.6.1.4.1.9586.100.4.2.29
323 EQUALITY caseExactIA5Match
324 SUBSTR caseExactIA5SubstringsMatch
325 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
327 attributetype ( 1.3.6.1.4.1.9586.100.4.2.30
329 DESC 'ISO 5218 representation of human gender'
330 EQUALITY integerMatch
332 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27{1} )
334 attributetype ( 1.3.6.1.4.1.9586.100.4.2.31
336 DESC 'Date of birth in YYYYMMDD format'
337 EQUALITY numericStringMatch
339 SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{8} )
341 attributetype ( 1.3.6.1.4.1.9586.100.4.2.32
342 NAME 'mailDisableMessage'
343 DESC 'Message returned when all mail is disabled'
344 EQUALITY caseIgnoreIA5Match
345 SUBSTR caseIgnoreIA5SubstringsMatch
346 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
348 attributetype ( 1.3.6.1.4.1.9586.100.4.2.33
350 DESC 'purposes of this server'
351 EQUALITY caseIgnoreMatch
352 SUBSTR caseIgnoreSubstringsMatch
353 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
355 attributetype ( 1.3.6.1.4.1.9586.100.4.2.34
357 DESC 'FQDN of the physical host of this virtual server'
358 EQUALITY caseIgnoreIA5Match
359 SUBSTR caseIgnoreIA5SubstringsMatch
361 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
363 attributetype ( 1.3.6.1.4.1.9586.100.4.2.35
365 DESC 'VoIP URL to communicate with that person'
366 EQUALITY caseIgnoreIA5Match
367 SUBSTR caseIgnoreIA5SubstringsMatch
368 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
370 attributetype ( 1.3.6.1.4.1.9586.100.4.2.36
373 EQUALITY octetStringMatch
374 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
376 attributetype ( 1.3.6.1.4.1.9586.100.4.2.37
378 DESC 'name of other group for which membership implied by memberschip to this group'
379 EQUALITY caseIgnoreIA5Match
380 SUBSTR caseIgnoreIA5SubstringsMatch
381 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
383 # more attributes below
384 attributetype ( 1.3.6.1.4.1.9586.100.4.2.39
386 DESC 'Groups that have access to a host'
387 EQUALITY caseExactIA5Match
388 SUBSTR caseExactIA5SubstringsMatch
389 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
391 attributetype ( 1.3.6.1.4.1.9586.100.4.2.40
393 DESC 'export options for servers'
394 EQUALITY caseIgnoreIA5Match
395 SUBSTR caseIgnoreIA5SubstringsMatch
396 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
398 # Experimental attribute types
400 # There are existing schemas for doing DNS in LDAP; would one of
401 # these be better? c.f. draft-miller-dns-ldap-schema-00 (expired)
402 attributetype ( 1.3.6.1.4.1.9586.100.4.4.2
404 DESC 'DNS zone record for user'
405 EQUALITY octetStringMatch
406 SUBSTR caseIgnoreSubstringsMatch
407 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
409 # rfc822mailbox (RFC1274) is recommended as a replacement for this in
411 attributetype ( 1.3.6.1.4.1.9586.100.4.4.3
413 DESC 'forwarding address for email sent to this account'
414 EQUALITY caseIgnoreIA5Match
415 SUBSTR caseIgnoreIA5SubstringsMatch
416 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
418 # Network Associates also has a schema for PGP keys / key IDs which may
419 # or may not be applicable:
420 # http://www.openldap.org/lists/openldap-devel/200010/msg00071.html
421 attributetype ( 1.3.6.1.4.1.9586.100.4.4.4
422 NAME 'keyFingerPrint'
423 EQUALITY caseIgnoreMatch
424 SUBSTR caseIgnoreSubstringsMatch
425 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
427 # Rather Debian-specific, not useful to the public.
428 attributetype ( 1.3.6.1.4.1.9586.100.4.4.5
430 DESC 'email subscription address for debian-private mailing list'
431 EQUALITY caseIgnoreIA5Match
432 SUBSTR caseIgnoreIA5SubstringsMatch
433 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)
435 # Echelon attributes; re-evaluate later
436 attributetype ( 1.3.6.1.4.1.9586.100.4.4.6
437 NAME 'accountComment'
438 DESC 'additional comments regarding the account status'
439 EQUALITY caseIgnoreIA5Match
440 SUBSTR caseIgnoreIA5SubstringsMatch
441 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
443 attributetype ( 1.3.6.1.4.1.9586.100.4.4.7
445 DESC 'Debian developer account status'
446 EQUALITY caseIgnoreIA5Match
447 SUBSTR caseIgnoreIA5SubstringsMatch
448 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
450 # mail attributes; not public information
451 attributetype ( 1.3.6.1.4.1.9586.100.4.4.8
453 DESC 'Whether or not to require a successful callout attempt on email delivery'
454 EQUALITY booleanMatch
455 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
457 attributetype ( 1.3.6.1.4.1.9586.100.4.4.9
458 NAME 'mailGreylisting'
459 DESC 'Whether or not to perform greylisting on email delivery'
460 EQUALITY booleanMatch
461 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
463 attributetype ( 1.3.6.1.4.1.9586.100.4.4.11
465 DESC 'RBL sites to check at SMTP accept time'
466 EQUALITY caseIgnoreIA5Match
467 SUBSTR caseIgnoreIA5SubstringsMatch
468 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
470 attributetype ( 1.3.6.1.4.1.9586.100.4.4.12
472 DESC 'RHSBL sites to check at SMTP accept time'
473 EQUALITY caseIgnoreIA5Match
474 SUBSTR caseIgnoreIA5SubstringsMatch
475 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
477 attributetype ( 1.3.6.1.4.1.9586.100.4.4.13
479 DESC 'sites to whitelist from additional SMTP accept time checks'
480 EQUALITY caseIgnoreIA5Match
481 SUBSTR caseIgnoreIA5SubstringsMatch
482 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
484 attributetype ( 1.3.6.1.4.1.9586.100.4.2.38
485 NAME 'mailContentInspectionAction'
486 DESC 'what to do on content inspection hits'
487 EQUALITY caseIgnoreIA5Match
488 SUBSTR caseIgnoreIA5SubstringsMatch
489 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
492 # Public object classes
494 objectclass ( 1.3.6.1.4.1.9586.100.4.1.1
496 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
498 MUST ( cn $ uid $ uidNumber $ gidNumber )
499 MAY ( userPassword $ loginShell $ gecos $ homeDirectory $ description $ mailDisableMessage $ sudoPassword ) )
501 objectclass ( 1.3.6.1.4.1.9586.100.4.1.2
504 DESC 'attributes used for Debian groups'
505 MUST ( gid $ gidNumber )
506 MAY ( description $ subGroup $ accountStatus ) )
508 # Experimental objectclasses:
510 objectclass ( 1.3.6.1.4.1.9586.100.4.3.1
511 NAME 'debianDeveloper'
512 DESC 'additional account attributes used by Debian'
514 MUST ( uid $ cn $ sn )
515 MAY ( accountComment $ accountStatus $ activity-from $
516 activity-pgp $ allowedHost $ comment $ countryName $
517 dnsZoneEntry $ emailForward $ icqUin $ ircNick $
518 jabberJID $ keyFingerPrint $ latitude $ longitude $ mn $
519 onVacation $ privateSub $ sshRSAAuthKey $ supplementaryGid $
520 access $ gender $ birthDate $ mailCallout $ mailGreylisting $
521 mailRBL $ mailRHSBL $ mailWhitelist $ VoIP $ mailContentInspectionAction
524 objectclass ( 1.3.6.1.4.1.9586.100.4.3.2
526 DESC 'Internet-connected server associated with Debian'
528 MUST ( host $ hostname )
529 MAY ( c $ access $ admin $ architecture $ bandwidth $ description $ disk $
530 distribution $ l $ machine $ memory $ sponsor $
531 sponsor-admin $ status $ physicalHost $ ipHostNumber $
532 sshRSAHostKey $ purpose $ allowedGroups $ exportOptions $ MXRecord
535 objectclass ( 1.3.6.1.4.1.9586.100.4.3.3
536 NAME 'debianRoleAccount'
537 DESC 'Abstraction of an account with POSIX attributes and UTF8 support'
538 SUP account STRUCTURAL
539 MAY ( emailForward $ supplementaryGid $ allowedHost $ labeledURI $
540 mailCallout $ mailGreylisting $ mailRBL $ mailRHSBL $
541 mailWhitelist $ dnsZoneEntry $ mailContentInspectionAction