6213 lines
371 KiB
HTML
6213 lines
371 KiB
HTML
<!DOCTYPE html><html lang="fr">
|
||
<head><meta charset="utf-8">
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><title>OpenLDAP installation et configuration annuaire xoyize.xyz - YannStatic</title>
|
||
|
||
<meta name="description" content="OpenLDAP Debian">
|
||
<link rel="canonical" href="https://static.rnmkcy.eu/2019/10/21/Annuaire-LDAP-xoyize.xyz-(exPC2).html"><link rel="alternate" type="application/rss+xml" title="YannStatic" href="/feed.xml">
|
||
|
||
<!-- - include head/favicon.html - -->
|
||
<link rel="shortcut icon" type="image/png" href="/assets/favicon/favicon.png"><link rel="stylesheet" href="/assets/css/main.css"><link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.0.13/css/all.css" ><!-- start custom head snippets --><link rel="stylesheet" href="/assets/css/expand.css">
|
||
<!-- end custom head snippets --><script>(function() {
|
||
window.isArray = function(val) {
|
||
return Object.prototype.toString.call(val) === '[object Array]';
|
||
};
|
||
window.isString = function(val) {
|
||
return typeof val === 'string';
|
||
};
|
||
|
||
window.hasEvent = function(event) {
|
||
return 'on'.concat(event) in window.document;
|
||
};
|
||
|
||
window.isOverallScroller = function(node) {
|
||
return node === document.documentElement || node === document.body || node === window;
|
||
};
|
||
|
||
window.isFormElement = function(node) {
|
||
var tagName = node.tagName;
|
||
return tagName === 'INPUT' || tagName === 'SELECT' || tagName === 'TEXTAREA';
|
||
};
|
||
|
||
window.pageLoad = (function () {
|
||
var loaded = false, cbs = [];
|
||
window.addEventListener('load', function () {
|
||
var i;
|
||
loaded = true;
|
||
if (cbs.length > 0) {
|
||
for (i = 0; i < cbs.length; i++) {
|
||
cbs[i]();
|
||
}
|
||
}
|
||
});
|
||
return {
|
||
then: function(cb) {
|
||
cb && (loaded ? cb() : (cbs.push(cb)));
|
||
}
|
||
};
|
||
})();
|
||
})();
|
||
(function() {
|
||
window.throttle = function(func, wait) {
|
||
var args, result, thisArg, timeoutId, lastCalled = 0;
|
||
|
||
function trailingCall() {
|
||
lastCalled = new Date;
|
||
timeoutId = null;
|
||
result = func.apply(thisArg, args);
|
||
}
|
||
return function() {
|
||
var now = new Date,
|
||
remaining = wait - (now - lastCalled);
|
||
|
||
args = arguments;
|
||
thisArg = this;
|
||
|
||
if (remaining <= 0) {
|
||
clearTimeout(timeoutId);
|
||
timeoutId = null;
|
||
lastCalled = now;
|
||
result = func.apply(thisArg, args);
|
||
} else if (!timeoutId) {
|
||
timeoutId = setTimeout(trailingCall, remaining);
|
||
}
|
||
return result;
|
||
};
|
||
};
|
||
})();
|
||
(function() {
|
||
var Set = (function() {
|
||
var add = function(item) {
|
||
var i, data = this._data;
|
||
for (i = 0; i < data.length; i++) {
|
||
if (data[i] === item) {
|
||
return;
|
||
}
|
||
}
|
||
this.size ++;
|
||
data.push(item);
|
||
return data;
|
||
};
|
||
|
||
var Set = function(data) {
|
||
this.size = 0;
|
||
this._data = [];
|
||
var i;
|
||
if (data.length > 0) {
|
||
for (i = 0; i < data.length; i++) {
|
||
add.call(this, data[i]);
|
||
}
|
||
}
|
||
};
|
||
Set.prototype.add = add;
|
||
Set.prototype.get = function(index) { return this._data[index]; };
|
||
Set.prototype.has = function(item) {
|
||
var i, data = this._data;
|
||
for (i = 0; i < data.length; i++) {
|
||
if (this.get(i) === item) {
|
||
return true;
|
||
}
|
||
}
|
||
return false;
|
||
};
|
||
Set.prototype.is = function(map) {
|
||
if (map._data.length !== this._data.length) { return false; }
|
||
var i, j, flag, tData = this._data, mData = map._data;
|
||
for (i = 0; i < tData.length; i++) {
|
||
for (flag = false, j = 0; j < mData.length; j++) {
|
||
if (tData[i] === mData[j]) {
|
||
flag = true;
|
||
break;
|
||
}
|
||
}
|
||
if (!flag) { return false; }
|
||
}
|
||
return true;
|
||
};
|
||
Set.prototype.values = function() {
|
||
return this._data;
|
||
};
|
||
return Set;
|
||
})();
|
||
|
||
window.Lazyload = (function(doc) {
|
||
var queue = {js: [], css: []}, sources = {js: {}, css: {}}, context = this;
|
||
var createNode = function(name, attrs) {
|
||
var node = doc.createElement(name), attr;
|
||
for (attr in attrs) {
|
||
if (attrs.hasOwnProperty(attr)) {
|
||
node.setAttribute(attr, attrs[attr]);
|
||
}
|
||
}
|
||
return node;
|
||
};
|
||
var end = function(type, url) {
|
||
var s, q, qi, cbs, i, j, cur, val, flag;
|
||
if (type === 'js' || type ==='css') {
|
||
s = sources[type], q = queue[type];
|
||
s[url] = true;
|
||
for (i = 0; i < q.length; i++) {
|
||
cur = q[i];
|
||
if (cur.urls.has(url)) {
|
||
qi = cur, val = qi.urls.values();
|
||
qi && (cbs = qi.callbacks);
|
||
for (flag = true, j = 0; j < val.length; j++) {
|
||
cur = val[j];
|
||
if (!s[cur]) {
|
||
flag = false;
|
||
}
|
||
}
|
||
if (flag && cbs && cbs.length > 0) {
|
||
for (j = 0; j < cbs.length; j++) {
|
||
cbs[j].call(context);
|
||
}
|
||
qi.load = true;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
};
|
||
var load = function(type, urls, callback) {
|
||
var s, q, qi, node, i, cur,
|
||
_urls = typeof urls === 'string' ? new Set([urls]) : new Set(urls), val, url;
|
||
if (type === 'js' || type ==='css') {
|
||
s = sources[type], q = queue[type];
|
||
for (i = 0; i < q.length; i++) {
|
||
cur = q[i];
|
||
if (_urls.is(cur.urls)) {
|
||
qi = cur;
|
||
break;
|
||
}
|
||
}
|
||
val = _urls.values();
|
||
if (qi) {
|
||
callback && (qi.load || qi.callbacks.push(callback));
|
||
callback && (qi.load && callback());
|
||
} else {
|
||
q.push({
|
||
urls: _urls,
|
||
callbacks: callback ? [callback] : [],
|
||
load: false
|
||
});
|
||
for (i = 0; i < val.length; i++) {
|
||
node = null, url = val[i];
|
||
if (s[url] === undefined) {
|
||
(type === 'js' ) && (node = createNode('script', { src: url }));
|
||
(type === 'css') && (node = createNode('link', { rel: 'stylesheet', href: url }));
|
||
if (node) {
|
||
node.onload = (function(type, url) {
|
||
return function() {
|
||
end(type, url);
|
||
};
|
||
})(type, url);
|
||
(doc.head || doc.body).appendChild(node);
|
||
s[url] = false;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
};
|
||
return {
|
||
js: function(url, callback) {
|
||
load('js', url, callback);
|
||
},
|
||
css: function(url, callback) {
|
||
load('css', url, callback);
|
||
}
|
||
};
|
||
})(this.document);
|
||
})();
|
||
</script><script>
|
||
(function() {
|
||
var TEXT_VARIABLES = {
|
||
version: '2.2.6',
|
||
sources: {
|
||
font_awesome: 'https://use.fontawesome.com/releases/v5.0.13/css/all.css',
|
||
jquery: '/assets/js/jquery.min.js',
|
||
leancloud_js_sdk: '//cdn.jsdelivr.net/npm/leancloud-storage@3.13.2/dist/av-min.js',
|
||
chart: 'https://cdn.bootcss.com/Chart.js/2.7.2/Chart.bundle.min.js',
|
||
gitalk: {
|
||
js: 'https://cdn.bootcss.com/gitalk/1.2.2/gitalk.min.js',
|
||
css: 'https://cdn.bootcss.com/gitalk/1.2.2/gitalk.min.css'
|
||
},
|
||
valine: 'https://unpkg.com/valine/dist/Valine.min.js'
|
||
},
|
||
site: {
|
||
toc: {
|
||
selectors: 'h1,h2,h3'
|
||
}
|
||
},
|
||
paths: {
|
||
search_js: '/assets/search.js'
|
||
}
|
||
};
|
||
window.TEXT_VARIABLES = TEXT_VARIABLES;
|
||
})();
|
||
</script>
|
||
</head>
|
||
<body>
|
||
<div class="root" data-is-touch="false">
|
||
<div class="layout--page js-page-root"><!----><div class="page__main js-page-main page__viewport hide-footer has-aside has-aside cell cell--auto">
|
||
|
||
<div class="page__main-inner"><div class="page__header d-print-none"><header class="header"><div class="main">
|
||
<div class="header__title">
|
||
<div class="header__brand"><svg id="svg" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="478.9473684210526" viewBox="0, 0, 400,478.9473684210526"><g id="svgg"><path id="path0" d="M308.400 56.805 C 306.970 56.966,303.280 57.385,300.200 57.738 C 290.906 58.803,278.299 59.676,269.200 59.887 L 260.600 60.085 259.400 61.171 C 258.010 62.428,256.198 63.600,255.645 63.600 C 255.070 63.600,252.887 65.897,252.598 66.806 C 252.460 67.243,252.206 67.600,252.034 67.600 C 251.397 67.600,247.206 71.509,247.202 72.107 C 247.201 72.275,246.390 73.190,245.400 74.138 C 243.961 75.517,243.598 76.137,243.592 77.231 C 243.579 79.293,241.785 83.966,240.470 85.364 C 239.176 86.740,238.522 88.365,237.991 91.521 C 237.631 93.665,236.114 97.200,235.554 97.200 C 234.938 97.200,232.737 102.354,232.450 104.472 C 232.158 106.625,230.879 109.226,229.535 110.400 C 228.933 110.926,228.171 113.162,226.434 119.500 C 226.178 120.435,225.795 121.200,225.584 121.200 C 225.373 121.200,225.200 121.476,225.200 121.813 C 225.200 122.149,224.885 122.541,224.500 122.683 C 223.606 123.013,223.214 123.593,223.204 124.600 C 223.183 126.555,220.763 132.911,219.410 134.562 C 218.443 135.742,217.876 136.956,217.599 138.440 C 217.041 141.424,215.177 146.434,214.532 146.681 C 214.240 146.794,214.000 147.055,214.000 147.261 C 214.000 147.467,213.550 148.086,213.000 148.636 C 212.450 149.186,212.000 149.893,212.000 150.208 C 212.000 151.386,208.441 154.450,207.597 153.998 C 206.319 153.315,204.913 150.379,204.633 147.811 C 204.365 145.357,202.848 142.147,201.759 141.729 C 200.967 141.425,199.200 137.451,199.200 135.974 C 199.200 134.629,198.435 133.224,196.660 131.311 C 195.363 129.913,194.572 128.123,193.870 125.000 C 193.623 123.900,193.236 122.793,193.010 122.540 C 190.863 120.133,190.147 118.880,188.978 115.481 C 188.100 112.928,187.151 111.003,186.254 109.955 C 185.358 108.908,184.518 107.204,183.847 105.073 C 183.280 103.273,182.497 101.329,182.108 100.753 C 181.719 100.177,180.904 98.997,180.298 98.131 C 179.693 97.265,178.939 95.576,178.624 94.378 C 178.041 92.159,177.125 90.326,175.023 87.168 C 174.375 86.196,173.619 84.539,173.342 83.486 C 172.800 81.429,171.529 79.567,170.131 78.785 C 169.654 78.517,168.697 77.511,168.006 76.549 C 167.316 75.587,166.594 74.800,166.402 74.800 C 166.210 74.800,164.869 73.633,163.421 72.206 C 160.103 68.936,161.107 69.109,146.550 69.301 C 133.437 69.474,128.581 70.162,126.618 72.124 C 126.248 72.495,125.462 72.904,124.872 73.033 C 124.282 73.163,123.088 73.536,122.219 73.863 C 121.349 74.191,119.028 74.638,117.061 74.858 C 113.514 75.254,109.970 76.350,108.782 77.419 C 107.652 78.436,100.146 80.400,97.388 80.400 C 95.775 80.400,93.167 81.360,91.200 82.679 C 90.430 83.195,89.113 83.804,88.274 84.031 C 85.875 84.681,78.799 90.910,74.400 96.243 L 73.400 97.456 73.455 106.028 C 73.526 117.055,74.527 121.238,77.820 124.263 C 78.919 125.273,80.400 127.902,80.400 128.842 C 80.400 129.202,81.075 130.256,81.900 131.186 C 83.563 133.059,85.497 136.346,86.039 138.216 C 86.233 138.886,87.203 140.207,88.196 141.153 C 89.188 142.098,90.000 143.104,90.000 143.388 C 90.000 144.337,92.129 148.594,92.869 149.123 C 93.271 149.410,93.600 149.831,93.600 150.059 C 93.600 150.286,93.932 150.771,94.337 151.136 C 94.743 151.501,95.598 153.004,96.237 154.475 C 96.877 155.947,97.760 157.351,98.200 157.596 C 98.640 157.841,99.900 159.943,101.000 162.267 C 102.207 164.817,103.327 166.644,103.825 166.876 C 104.278 167.087,105.065 168.101,105.573 169.130 C 107.658 173.348,108.097 174.093,110.006 176.647 C 111.103 178.114,112.000 179.725,112.000 180.227 C 112.000 181.048,113.425 183.163,114.678 184.200 C 115.295 184.711,117.396 188.733,117.720 190.022 C 117.855 190.562,118.603 191.633,119.381 192.402 C 120.160 193.171,121.496 195.258,122.351 197.039 C 123.206 198.820,124.167 200.378,124.487 200.501 C 124.807 200.624,125.953 202.496,127.034 204.662 C 128.114 206.828,129.676 209.299,130.505 210.153 C 131.333 211.007,132.124 212.177,132.262 212.753 C 132.618 214.239,134.291 217.048,136.288 219.516 C 137.230 220.679,138.000 221.923,138.000 222.280 C 138.000 223.140,139.924 226.400,140.431 226.400 C 140.650 226.400,141.167 227.190,141.581 228.156 C 141.995 229.122,142.524 230.029,142.756 230.173 C 142.988 230.316,143.381 231.187,143.629 232.107 C 143.901 233.119,144.651 234.320,145.527 235.145 C 146.323 235.896,147.551 237.776,148.256 239.323 C 148.961 240.869,149.822 242.467,150.169 242.872 C 150.516 243.277,150.800 243.747,150.800 243.916 C 150.800 244.084,151.178 244.546,151.640 244.941 C 152.102 245.337,153.117 247.042,153.896 248.730 C 154.674 250.419,155.885 252.393,156.587 253.117 C 157.288 253.842,158.453 255.832,159.175 257.541 C 159.991 259.470,161.083 261.238,162.057 262.207 C 162.921 263.065,163.741 264.225,163.880 264.784 C 164.202 266.074,165.821 269.140,166.738 270.193 C 167.716 271.317,169.600 274.181,169.600 274.543 C 169.600 275.323,171.398 278.721,172.342 279.726 L 173.400 280.852 173.501 347.096 C 173.584 401.667,173.696 413.450,174.136 413.969 C 174.430 414.316,175.270 415.545,176.002 416.700 C 176.735 417.855,177.566 418.800,177.849 418.800 C 178.505 418.800,179.956 420.251,181.626 422.576 C 182.346 423.579,183.220 424.401,183.568 424.402 C 183.916 424.404,184.716 424.674,185.346 425.002 C 186.694 425.706,205.876 425.863,210.404 425.207 C 211.837 425.000,214.626 424.647,216.602 424.422 C 218.578 424.198,221.096 423.671,222.197 423.251 C 225.651 421.936,234.760 420.742,244.200 420.367 C 254.932 419.940,255.342 419.867,256.938 418.105 C 258.873 415.970,262.469 412.173,263.741 410.922 C 268.897 405.853,268.378 414.164,268.506 334.626 C 268.624 260.876,268.527 264.457,270.487 262.095 C 270.963 261.522,272.681 256.931,273.205 254.833 C 273.645 253.071,274.761 250.935,275.900 249.677 C 276.395 249.131,276.800 248.378,276.800 248.006 C 276.800 246.948,279.199 240.273,279.832 239.569 C 280.145 239.221,280.400 238.714,280.400 238.442 C 280.400 238.169,280.826 237.374,281.347 236.673 C 281.868 235.973,282.391 234.759,282.510 233.975 C 282.628 233.191,283.088 231.751,283.530 230.775 C 283.973 229.799,284.463 228.550,284.618 228.000 C 284.773 227.450,285.400 226.253,286.010 225.339 C 286.620 224.426,287.347 222.986,287.625 222.139 C 289.193 217.363,291.339 212.217,292.021 211.600 C 292.431 211.229,293.600 208.484,293.600 207.893 C 293.600 207.570,293.978 206.338,294.441 205.153 C 295.255 203.068,295.626 202.309,297.773 198.331 C 298.328 197.303,298.950 195.773,299.155 194.931 C 299.786 192.337,301.043 189.208,301.943 187.992 C 302.414 187.354,302.800 186.740,302.800 186.628 C 302.800 186.516,303.250 185.440,303.800 184.237 C 304.350 183.035,304.800 181.764,304.800 181.414 C 304.800 180.310,306.817 175.830,307.626 175.136 C 308.052 174.771,308.400 174.224,308.400 173.920 C 308.400 173.617,308.760 172.663,309.200 171.800 C 309.640 170.937,310.000 169.819,310.000 169.316 C 310.000 168.227,312.179 163.482,312.987 162.811 C 313.490 162.394,314.327 160.096,316.017 154.494 C 316.300 153.556,316.772 152.589,317.066 152.345 C 317.360 152.102,317.600 151.654,317.600 151.351 C 317.600 151.048,317.783 150.800,318.006 150.800 C 318.520 150.800,319.275 149.024,320.385 145.200 C 321.312 142.009,321.939 140.531,323.182 138.600 C 324.471 136.600,325.199 135.111,325.219 134.439 C 325.257 133.119,327.075 128.319,327.930 127.280 C 329.603 125.247,330.395 123.800,330.397 122.771 C 330.400 121.619,331.518 118.006,332.053 117.420 C 332.244 117.211,332.400 116.797,332.400 116.501 C 332.400 116.204,332.849 115.546,333.398 115.037 C 334.472 114.042,335.431 111.724,336.008 108.730 C 336.435 106.511,337.850 103.325,338.913 102.188 C 339.725 101.319,341.600 96.369,341.600 95.093 C 341.600 94.285,342.786 91.895,343.300 91.667 C 343.465 91.593,343.600 91.183,343.600 90.754 C 343.600 90.326,343.884 89.866,344.231 89.733 C 346.502 88.861,346.588 65.600,344.320 65.600 C 343.429 65.600,340.000 62.351,340.000 61.507 C 340.000 61.160,339.041 60.335,337.869 59.674 C 336.698 59.013,335.433 58.005,335.060 57.436 L 334.382 56.400 322.691 56.457 C 316.261 56.488,309.830 56.645,308.400 56.805 M376.400 57.549 C 376.400 57.782,376.747 58.157,377.171 58.384 C 378.343 59.012,380.402 62.302,380.384 63.520 L 380.368 64.600 379.753 63.465 C 378.904 61.899,378.656 62.357,379.395 64.126 C 379.728 64.922,380.026 66.165,380.057 66.887 C 380.112 68.165,380.121 68.157,380.400 66.600 C 380.580 65.594,380.686 67.004,380.686 70.400 C 380.686 73.598,380.576 75.147,380.415 74.200 L 380.144 72.600 379.939 74.200 C 379.749 75.684,379.730 75.643,379.667 73.633 C 379.574 70.643,379.356 71.152,378.822 75.600 C 378.571 77.690,378.058 80.660,377.683 82.200 L 377.000 85.000 376.746 83.400 C 376.606 82.520,376.502 86.255,376.514 91.700 C 376.526 97.145,376.695 101.600,376.888 101.600 C 380.700 101.600,381.297 98.218,381.125 77.588 L 381.000 62.576 379.983 60.600 C 379.046 58.781,376.400 56.528,376.400 57.549 M324.808 74.604 C 327.263 75.874,327.008 81.222,324.349 84.211 C 323.581 85.075,321.200 90.546,321.200 91.449 C 321.200 92.087,319.203 96.289,318.260 97.635 C 317.897 98.154,317.600 98.952,317.600 99.409 C 317.600 99.866,317.434 100.411,317.232 100.620 C 317.029 100.829,316.497 102.080,316.049 103.400 C 315.601 104.720,314.507 107.237,313.617 108.992 C 312.728 110.748,312.000 112.415,312.000 112.697 C 312.000 112.978,311.654 113.972,311.231 114.904 C 310.808 115.837,309.889 117.933,309.189 119.562 C 308.489 121.191,307.575 123.132,307.158 123.874 C 306.741 124.617,306.399 125.534,306.399 125.912 C 306.398 126.290,306.038 127.189,305.599 127.910 C 305.159 128.630,304.800 129.514,304.800 129.875 C 304.800 130.236,303.916 132.346,302.835 134.565 C 301.755 136.784,300.478 139.680,299.998 141.000 C 299.518 142.320,298.391 144.930,297.493 146.800 C 295.933 150.048,295.066 152.122,293.981 155.200 C 293.709 155.970,292.873 157.843,292.122 159.361 C 291.371 160.880,290.124 163.850,289.352 165.961 C 287.937 169.831,287.646 170.471,285.551 174.309 C 284.918 175.469,284.400 176.755,284.400 177.167 C 284.400 178.039,282.061 183.699,281.571 184.011 C 281.116 184.301,278.953 189.495,278.605 191.133 C 278.449 191.866,277.633 193.683,276.790 195.170 C 275.015 198.302,273.200 202.606,273.200 203.682 C 273.200 204.479,271.552 207.953,270.394 209.600 C 269.551 210.798,267.600 216.315,267.600 217.502 C 267.600 217.964,267.366 218.581,267.081 218.871 C 266.123 219.847,264.000 223.139,264.000 223.648 C 264.000 224.862,261.733 230.962,260.992 231.741 C 259.946 232.841,258.632 235.681,258.066 238.062 C 257.591 240.061,256.412 242.719,254.244 246.674 C 253.499 248.035,252.804 249.835,252.700 250.674 C 252.596 251.513,252.126 253.624,251.655 255.364 L 250.800 258.528 250.790 326.564 C 250.781 394.972,250.734 397.275,249.322 398.305 C 248.925 398.595,248.240 399.144,247.800 399.525 C 246.609 400.557,243.279 401.197,236.800 401.640 C 233.610 401.858,228.750 402.468,226.000 402.995 C 219.686 404.206,216.314 404.661,202.633 406.153 C 194.013 407.093,190.060 405.271,190.884 400.737 C 191.623 396.672,191.048 272.414,190.280 270.200 C 189.208 267.110,188.079 264.878,187.096 263.904 C 186.086 262.902,185.571 262.105,184.446 259.800 C 184.017 258.920,183.031 257.300,182.257 256.200 C 181.482 255.100,180.264 253.030,179.549 251.600 C 178.834 250.170,177.665 248.276,176.951 247.391 C 176.236 246.505,174.924 244.357,174.034 242.617 C 173.144 240.877,171.862 238.764,171.185 237.922 C 170.508 237.079,169.284 235.087,168.464 233.495 C 167.644 231.903,166.406 229.824,165.713 228.876 C 165.019 227.927,163.801 225.816,163.005 224.184 C 162.209 222.552,161.343 221.078,161.079 220.908 C 160.307 220.411,159.057 218.422,157.408 215.062 C 156.560 213.336,155.627 211.832,155.334 211.719 C 155.040 211.607,154.800 211.335,154.800 211.115 C 154.800 210.895,154.350 210.181,153.800 209.527 C 153.250 208.873,152.800 208.005,152.800 207.598 C 152.800 207.190,152.551 206.608,152.246 206.303 C 151.942 205.999,151.308 204.996,150.838 204.075 C 150.368 203.154,149.807 202.400,149.592 202.400 C 149.376 202.400,149.200 202.143,149.200 201.829 C 149.200 201.514,148.928 200.986,148.597 200.654 C 148.265 200.322,147.660 199.274,147.252 198.325 C 146.844 197.376,145.822 195.700,144.981 194.600 C 144.139 193.500,142.660 191.070,141.693 189.200 C 140.727 187.330,139.518 185.350,139.007 184.800 C 138.496 184.250,137.424 182.540,136.625 181.000 C 134.927 177.729,134.425 176.908,133.574 176.009 C 133.229 175.645,132.292 174.009,131.492 172.374 C 130.691 170.738,129.491 168.807,128.825 168.083 C 128.159 167.358,126.949 165.378,126.138 163.683 C 125.326 161.987,123.883 159.638,122.931 158.463 C 121.979 157.288,121.200 156.096,121.200 155.814 C 121.200 155.061,119.237 151.677,118.465 151.098 C 117.877 150.657,116.870 148.821,115.136 145.028 C 114.841 144.383,114.060 143.277,113.400 142.570 C 112.740 141.863,111.660 140.230,111.000 138.942 C 110.340 137.654,109.023 135.472,108.074 134.092 C 107.125 132.713,105.886 130.574,105.320 129.338 C 104.755 128.103,104.001 126.774,103.646 126.386 C 101.555 124.102,100.800 123.138,100.800 122.750 C 100.800 121.775,98.336 117.300,97.017 115.881 C 96.241 115.045,95.487 113.875,95.341 113.281 C 95.196 112.686,94.969 112.110,94.836 112.000 C 94.704 111.890,94.066 111.080,93.419 110.200 C 92.772 109.320,92.056 108.474,91.829 108.319 C 91.568 108.142,91.751 107.624,92.322 106.919 C 92.821 106.304,93.332 105.491,93.458 105.113 C 93.584 104.736,94.010 104.324,94.406 104.198 C 94.802 104.072,95.216 103.736,95.325 103.450 C 95.831 102.132,101.677 100.204,109.319 98.835 C 110.594 98.607,113.114 97.717,114.919 96.858 C 116.723 95.998,119.370 95.082,120.800 94.822 C 126.541 93.779,129.129 93.065,131.866 91.770 C 133.443 91.025,135.513 90.244,136.466 90.036 C 147.927 87.531,149.748 87.332,151.504 88.400 C 152.688 89.120,154.800 91.559,154.800 92.206 C 154.800 92.388,155.044 92.821,155.342 93.169 C 155.640 93.516,156.479 95.150,157.205 96.800 C 159.339 101.648,160.545 104.186,160.815 104.400 C 161.225 104.725,163.999 110.690,164.009 111.269 C 164.014 111.561,164.370 112.250,164.800 112.800 C 165.230 113.350,165.586 114.037,165.591 114.327 C 165.596 114.616,166.050 115.443,166.600 116.164 C 167.150 116.886,167.600 117.706,167.600 117.989 C 167.600 118.496,169.140 121.915,171.119 125.800 C 173.546 130.567,175.200 134.063,175.200 134.430 C 175.200 134.647,175.906 136.071,176.769 137.594 C 177.633 139.117,178.815 141.497,179.398 142.882 C 179.981 144.267,180.739 145.940,181.083 146.600 C 184.292 152.754,185.631 155.598,185.841 156.700 C 185.978 157.415,186.221 158.000,186.382 158.000 C 186.542 158.000,187.017 158.667,187.437 159.483 C 187.857 160.298,188.605 161.583,189.100 162.338 C 189.595 163.094,190.000 163.965,190.000 164.275 C 190.000 164.585,190.360 165.584,190.800 166.494 C 191.240 167.405,191.600 168.327,191.600 168.544 C 191.600 168.760,191.854 169.221,192.164 169.569 C 193.061 170.572,195.200 174.660,195.200 175.369 C 195.200 176.118,196.944 179.652,198.176 181.400 C 199.143 182.772,200.646 186.122,200.958 187.600 C 201.074 188.150,201.986 189.842,202.985 191.359 C 203.983 192.877,204.800 194.251,204.800 194.414 C 204.800 194.576,205.069 195.224,205.398 195.854 C 205.727 196.484,206.113 197.620,206.257 198.377 C 206.873 201.624,207.803 202.448,210.708 202.317 C 212.806 202.223,213.403 202.047,213.758 201.417 C 214.001 200.986,214.413 200.400,214.674 200.115 C 215.194 199.544,215.299 199.225,216.026 196.000 C 216.715 192.940,217.808 190.527,218.779 189.921 C 219.230 189.638,219.600 189.209,219.600 188.965 C 219.600 188.722,219.886 187.949,220.236 187.247 C 220.586 186.545,221.001 185.033,221.158 183.886 C 221.431 181.894,223.031 178.570,224.175 177.621 C 224.671 177.209,226.514 171.933,226.977 169.600 C 227.086 169.050,227.834 167.610,228.639 166.400 C 230.126 164.167,231.643 160.379,232.397 157.015 C 232.643 155.916,233.461 154.340,234.406 153.145 C 235.283 152.036,236.000 150.813,236.000 150.428 C 236.000 149.072,238.382 142.593,239.099 142.000 C 239.967 141.282,241.395 138.005,241.779 135.850 C 242.048 134.341,243.035 132.111,245.779 126.818 C 246.515 125.398,247.204 123.588,247.310 122.796 C 247.513 121.285,249.390 116.977,250.014 116.591 C 250.214 116.468,250.750 115.525,251.205 114.496 C 251.951 112.810,252.300 111.597,252.966 108.374 C 253.083 107.809,253.543 106.927,253.989 106.413 C 254.435 105.898,254.800 105.254,254.800 104.982 C 254.800 104.709,255.042 104.393,255.337 104.279 C 255.633 104.166,256.453 102.212,257.159 99.937 C 258.408 95.914,260.308 91.600,260.830 91.600 C 260.972 91.600,261.495 90.311,261.992 88.736 C 263.478 84.031,265.484 80.400,266.600 80.400 C 266.847 80.400,267.849 80.013,268.825 79.540 C 270.427 78.763,271.536 78.652,280.200 78.394 C 289.735 78.110,294.288 77.648,305.800 75.798 C 311.107 74.945,317.548 74.261,322.120 74.065 C 322.956 74.029,324.165 74.272,324.808 74.604 M377.200 77.600 C 376.930 78.724,376.787 79.720,376.881 79.814 C 376.975 79.909,377.285 79.078,377.569 77.969 C 377.853 76.860,377.997 75.864,377.888 75.755 C 377.779 75.646,377.470 76.476,377.200 77.600 M379.083 81.295 C 378.987 81.793,378.905 81.480,378.901 80.600 C 378.896 79.720,378.975 79.313,379.075 79.695 C 379.175 80.078,379.179 80.798,379.083 81.295 M379.017 97.475 C 378.756 98.515,377.778 99.561,377.042 99.587 C 376.844 99.594,377.159 99.159,377.742 98.619 C 378.324 98.080,378.800 97.360,378.800 97.019 C 378.800 96.679,378.910 96.400,379.043 96.400 C 379.177 96.400,379.165 96.884,379.017 97.475 M376.000 106.733 C 376.000 106.990,375.798 107.155,375.550 107.100 C 375.303 107.045,375.018 107.225,374.917 107.500 C 374.816 107.775,374.906 108.000,375.118 108.000 C 375.663 108.000,376.565 106.832,376.257 106.524 C 376.116 106.382,376.000 106.477,376.000 106.733 M368.842 118.760 C 368.159 119.399,367.600 119.739,367.600 119.516 C 367.600 119.294,367.285 119.450,366.900 119.864 C 366.515 120.278,366.335 120.442,366.500 120.228 C 366.933 119.668,366.870 119.313,366.300 119.094 C 365.959 118.963,365.784 119.387,365.748 120.429 L 365.696 121.955 366.748 121.301 L 367.800 120.646 366.700 121.845 C 365.643 122.997,364.962 128.400,365.874 128.400 C 368.662 128.400,370.373 125.543,370.965 119.900 C 371.250 117.186,370.792 116.939,368.842 118.760 M366.800 118.765 C 366.800 119.171,367.823 119.111,368.255 118.678 C 368.408 118.525,368.143 118.400,367.667 118.400 C 367.190 118.400,366.800 118.564,366.800 118.765 M364.571 130.229 C 365.353 131.010,365.402 131.465,364.636 130.830 C 364.203 130.471,364.002 130.474,363.774 130.842 C 363.585 131.147,363.645 131.219,363.938 131.038 C 364.649 130.599,364.486 131.141,363.631 132.059 C 363.147 132.579,362.664 132.767,362.331 132.566 C 361.912 132.314,361.916 132.390,362.349 132.923 C 363.040 133.776,362.667 133.810,361.829 132.971 C 361.257 132.400,361.200 132.420,361.200 133.192 C 361.200 133.966,361.388 134.031,363.300 133.921 L 365.400 133.800 365.521 131.700 C 365.631 129.788,365.566 129.600,364.792 129.600 C 364.020 129.600,364.000 129.657,364.571 130.229 M358.676 143.967 C 358.414 144.315,357.975 144.618,357.700 144.640 C 357.425 144.662,356.750 144.707,356.200 144.740 C 355.262 144.796,355.200 144.937,355.200 146.990 L 355.200 149.180 356.500 148.940 C 358.166 148.633,360.341 145.633,360.394 143.567 C 360.407 143.068,359.127 143.366,358.676 143.967 M354.019 155.180 C 353.700 155.382,353.307 155.466,353.147 155.367 C 352.986 155.268,352.754 155.351,352.630 155.552 C 352.506 155.752,352.674 156.019,353.002 156.146 C 353.331 156.272,353.600 156.171,353.600 155.921 C 353.600 155.671,353.703 155.569,353.828 155.695 C 354.186 156.053,352.506 159.074,351.796 159.346 C 351.427 159.488,351.261 159.424,351.403 159.195 C 351.537 158.978,351.304 158.800,350.884 158.800 C 350.212 158.800,350.111 159.143,350.037 161.676 C 349.991 163.258,349.863 164.698,349.753 164.876 C 349.116 165.907,352.306 164.618,353.452 163.382 C 354.411 162.347,355.049 160.026,354.657 159.003 C 354.529 158.671,354.599 158.400,354.813 158.400 C 355.026 158.400,355.200 157.590,355.200 156.600 C 355.200 154.752,355.026 154.543,354.019 155.180 M351.742 157.415 C 351.099 158.112,351.016 158.397,351.412 158.549 C 352.006 158.777,352.938 157.872,352.530 157.463 C 352.385 157.318,352.477 157.200,352.733 157.200 C 352.990 157.200,353.200 157.020,353.200 156.800 C 353.200 156.178,352.680 156.398,351.742 157.415 M349.200 166.400 C 349.200 166.840,349.380 167.200,349.600 167.200 C 349.820 167.200,350.000 166.840,350.000 166.400 C 350.000 165.960,349.820 165.600,349.600 165.600 C 349.380 165.600,349.200 165.960,349.200 166.400 M349.200 168.125 C 349.200 169.147,347.018 170.853,346.420 170.299 C 345.985 169.895,345.945 169.909,346.207 170.368 C 346.447 170.789,346.360 170.870,345.870 170.682 C 345.108 170.390,344.891 171.065,344.714 174.281 C 344.642 175.595,344.740 176.221,344.980 175.981 C 345.189 175.771,345.648 175.600,346.000 175.600 C 347.291 175.600,348.825 174.587,349.030 173.600 C 349.143 173.050,349.408 171.949,349.618 171.154 C 350.114 169.275,350.106 167.600,349.600 167.600 C 349.380 167.600,349.200 167.836,349.200 168.125 M344.308 177.983 C 344.031 178.967,344.197 179.537,344.632 179.101 C 344.760 178.973,344.801 178.448,344.724 177.934 L 344.584 177.000 344.308 177.983 M343.475 180.550 C 343.359 180.852,342.703 181.295,342.018 181.534 C 341.294 181.786,340.872 181.807,341.010 181.584 C 341.140 181.373,341.102 181.203,340.924 181.206 C 339.513 181.233,338.922 186.400,340.330 186.400 C 342.959 186.400,344.081 185.167,344.611 181.700 C 344.870 180.004,344.016 179.140,343.475 180.550 M339.079 190.957 C 338.915 191.374,338.875 191.809,338.991 191.924 C 339.355 192.289,339.676 191.691,339.524 190.931 C 339.383 190.235,339.362 190.236,339.079 190.957 M337.847 193.021 C 337.699 193.408,337.773 193.540,338.044 193.373 C 338.344 193.187,338.338 193.368,338.026 193.952 C 337.776 194.418,337.478 194.800,337.362 194.800 C 337.247 194.800,337.256 194.632,337.383 194.428 C 337.509 194.223,337.468 193.966,337.291 193.856 C 337.114 193.747,336.933 194.105,336.888 194.651 C 336.830 195.349,336.953 195.555,337.303 195.345 C 337.636 195.145,337.619 195.270,337.251 195.723 C 336.663 196.448,336.371 196.585,336.447 196.100 C 336.574 195.297,336.339 195.151,335.723 195.651 C 335.275 196.015,335.147 196.033,335.344 195.705 C 335.539 195.380,335.448 195.283,335.081 195.424 C 334.684 195.577,334.496 196.474,334.437 198.496 C 334.391 200.067,334.246 201.526,334.114 201.738 C 333.692 202.422,336.913 201.667,337.635 200.913 C 339.315 199.159,340.274 192.400,338.843 192.400 C 338.426 192.400,337.978 192.679,337.847 193.021 M333.867 202.667 C 333.720 202.813,333.600 203.263,333.600 203.667 C 333.600 204.070,333.414 204.400,333.186 204.400 C 332.920 204.400,332.943 204.722,333.251 205.300 C 333.692 206.126,333.674 206.153,333.043 205.632 C 332.449 205.142,332.372 205.142,332.477 205.632 C 332.546 205.951,332.351 206.146,332.032 206.077 C 331.542 205.972,331.542 206.049,332.032 206.643 C 332.553 207.274,332.526 207.292,331.700 206.851 C 330.904 206.427,330.800 206.466,330.800 207.186 C 330.800 207.819,331.060 208.000,331.971 208.000 C 333.747 208.000,334.400 207.078,334.400 204.571 C 334.400 202.375,334.347 202.186,333.867 202.667 M329.000 207.600 C 328.864 207.820,329.123 208.000,329.576 208.000 C 330.029 208.000,330.400 207.820,330.400 207.600 C 330.400 207.380,330.141 207.200,329.824 207.200 C 329.507 207.200,329.136 207.380,329.000 207.600 M327.674 218.030 C 327.280 218.661,327.028 218.755,326.624 218.420 C 326.226 218.090,326.035 218.132,325.859 218.590 C 325.730 218.925,325.394 219.197,325.113 219.194 C 324.754 219.190,324.780 219.071,325.200 218.800 C 325.620 218.529,325.646 218.410,325.287 218.406 C 325.006 218.403,324.672 218.669,324.546 218.998 C 324.419 219.326,324.185 219.514,324.025 219.415 C 323.864 219.316,323.733 219.489,323.733 219.800 C 323.733 220.111,323.928 220.248,324.167 220.106 C 324.476 219.920,324.478 220.011,324.171 220.423 C 323.935 220.740,323.705 221.610,323.660 222.356 L 323.579 223.712 325.406 223.461 C 328.523 223.034,328.800 222.734,328.800 219.786 C 328.800 217.070,328.533 216.654,327.674 218.030 M322.571 229.829 C 323.377 230.634,323.391 231.057,322.591 230.392 C 322.086 229.973,322.022 229.992,322.218 230.503 C 322.515 231.275,320.840 232.901,320.057 232.601 C 319.589 232.421,319.577 232.491,319.992 232.991 C 320.657 233.791,320.234 233.777,319.429 232.971 C 318.857 232.400,318.800 232.418,318.800 233.171 C 318.800 234.761,323.026 234.369,323.350 232.750 C 323.844 230.278,323.669 229.200,322.771 229.200 C 322.018 229.200,322.000 229.257,322.571 229.829 M317.902 240.600 C 317.797 241.150,317.866 241.600,318.055 241.600 C 318.245 241.600,318.400 241.150,318.400 240.600 C 318.400 240.050,318.331 239.600,318.247 239.600 C 318.162 239.600,318.007 240.050,317.902 240.600 M317.751 243.016 C 317.891 243.380,317.785 243.600,317.494 243.553 C 316.516 243.396,315.600 244.104,315.600 245.016 C 315.600 245.592,315.144 246.270,314.400 246.800 C 312.963 247.824,312.828 248.800,314.125 248.800 C 315.272 248.800,316.919 247.102,317.763 245.051 C 318.511 243.233,318.572 242.400,317.957 242.400 C 317.714 242.400,317.621 242.677,317.751 243.016 M313.900 244.676 C 313.197 244.859,312.866 246.800,313.538 246.800 C 314.018 246.800,315.200 245.427,315.200 244.869 C 315.200 244.384,315.082 244.367,313.900 244.676 M312.110 254.400 C 312.182 255.358,312.620 255.445,312.957 254.567 C 313.299 253.677,313.272 253.600,312.625 253.600 C 312.296 253.600,312.076 253.943,312.110 254.400 M308.700 255.105 C 308.161 255.223,308.000 255.669,308.000 257.040 L 308.000 258.821 309.141 258.231 C 310.253 257.656,311.600 256.018,311.600 255.241 C 311.600 254.864,310.116 254.795,308.700 255.105 M306.490 265.670 C 306.129 266.031,306.134 266.282,306.510 266.745 C 306.917 267.247,306.885 267.307,306.320 267.095 C 305.852 266.920,305.705 267.008,305.848 267.380 C 305.961 267.676,305.859 268.040,305.621 268.187 C 305.382 268.335,305.308 268.651,305.455 268.889 C 305.607 269.135,305.539 269.210,305.298 269.061 C 304.600 268.629,303.413 269.228,304.066 269.682 C 304.431 269.935,304.315 269.972,303.700 269.799 C 303.075 269.623,302.800 269.717,302.800 270.106 C 302.800 270.679,304.556 270.918,306.260 270.577 C 307.236 270.382,308.000 268.610,308.000 266.540 C 308.000 265.151,307.371 264.789,306.490 265.670 M302.360 279.200 C 302.129 281.000,302.202 281.531,302.625 281.108 C 302.749 280.985,302.792 280.100,302.721 279.142 L 302.592 277.400 302.360 279.200 M301.922 301.700 C 301.988 308.795,302.184 323.870,302.357 335.200 L 302.671 355.800 302.735 322.300 C 302.787 295.732,302.697 288.800,302.300 288.800 C 301.908 288.799,301.826 291.581,301.922 301.700 M301.293 325.200 C 301.293 325.970,301.375 326.285,301.476 325.900 C 301.576 325.515,301.576 324.885,301.476 324.500 C 301.375 324.115,301.293 324.430,301.293 325.200 M301.778 343.200 C 301.778 350.130,301.833 352.965,301.899 349.500 C 301.966 346.035,301.966 340.365,301.899 336.900 C 301.833 333.435,301.778 336.270,301.778 343.200 M301.367 368.400 C 301.367 372.690,301.426 374.445,301.498 372.300 C 301.570 370.155,301.570 366.645,301.498 364.500 C 301.426 362.355,301.367 364.110,301.367 368.400 M302.167 368.400 C 302.167 372.690,302.226 374.445,302.298 372.300 C 302.370 370.155,302.370 366.645,302.298 364.500 C 302.226 362.355,302.167 364.110,302.167 368.400 M301.765 388.600 C 301.766 392.560,301.826 394.126,301.898 392.080 C 301.971 390.034,301.971 386.794,301.898 384.880 C 301.824 382.966,301.765 384.640,301.765 388.600 M302.360 391.800 C 302.228 397.520,302.183 402.275,302.260 402.367 C 302.725 402.920,302.803 401.063,302.707 391.760 L 302.600 381.400 302.360 391.800 M302.166 417.100 C 302.303 418.309,302.266 418.637,302.066 418.000 C 301.758 417.020,301.746 417.027,301.481 418.327 C 301.331 419.059,301.030 419.542,300.809 419.406 C 300.569 419.257,300.514 419.433,300.673 419.845 C 300.865 420.347,300.794 420.444,300.406 420.204 C 300.041 419.978,299.971 420.030,300.182 420.370 C 300.367 420.671,300.154 421.097,299.637 421.459 C 299.169 421.787,298.906 422.249,299.053 422.486 C 299.230 422.772,298.985 422.833,298.326 422.667 C 297.618 422.490,297.333 422.581,297.333 422.986 C 297.333 424.188,301.802 422.782,302.160 421.467 C 302.730 419.370,302.912 415.200,302.433 415.200 C 302.094 415.200,302.015 415.766,302.166 417.100 M301.392 421.066 C 300.997 421.800,300.510 422.400,300.310 422.400 C 300.109 422.400,300.318 421.877,300.773 421.238 C 301.228 420.599,301.614 419.744,301.632 419.338 C 301.654 418.814,301.728 418.764,301.887 419.166 C 302.010 419.477,301.787 420.332,301.392 421.066 M296.700 428.863 C 296.825 429.337,296.763 429.625,296.563 429.502 C 296.363 429.379,296.181 429.795,296.158 430.427 C 296.135 431.064,296.286 431.470,296.498 431.339 C 296.708 431.210,296.681 431.475,296.438 431.929 C 296.195 432.384,295.772 432.890,295.498 433.055 C 295.172 433.250,295.193 433.116,295.557 432.667 C 296.403 431.625,295.788 431.412,294.796 432.404 C 294.274 432.926,293.621 433.194,293.162 433.074 C 292.743 432.964,292.488 433.019,292.597 433.195 C 292.706 433.372,292.526 433.619,292.198 433.746 C 291.869 433.872,291.614 434.206,291.632 434.487 C 291.656 434.889,291.707 434.892,291.865 434.500 C 291.976 434.225,292.592 434.000,293.233 434.000 C 293.875 434.000,294.400 433.808,294.400 433.573 C 294.400 433.325,294.743 433.255,295.219 433.406 C 296.590 433.841,297.118 432.990,297.093 430.386 C 297.081 429.074,296.937 428.000,296.773 428.000 C 296.609 428.000,296.576 428.388,296.700 428.863 M291.344 436.690 C 291.375 437.070,291.130 437.385,290.800 437.390 C 290.470 437.396,290.196 437.670,290.190 438.000 C 290.185 438.330,289.870 438.575,289.490 438.544 C 289.111 438.514,288.800 438.631,288.800 438.804 C 288.800 438.978,289.430 439.120,290.200 439.120 C 290.970 439.120,291.600 438.947,291.600 438.736 C 291.600 438.525,291.375 438.467,291.100 438.606 C 290.825 438.745,290.915 438.601,291.300 438.286 C 292.021 437.694,292.277 436.000,291.644 436.000 C 291.449 436.000,291.314 436.311,291.344 436.690 M285.855 441.400 C 285.729 441.730,285.799 442.000,286.013 442.000 C 286.226 442.000,286.400 442.199,286.400 442.443 C 286.400 442.686,286.130 442.782,285.800 442.655 C 285.470 442.529,285.200 442.599,285.200 442.813 C 285.200 443.026,284.975 443.155,284.700 443.100 C 284.425 443.045,284.253 443.248,284.317 443.551 C 284.397 443.927,284.175 444.034,283.617 443.889 C 283.168 443.771,282.800 443.827,282.800 444.012 C 282.800 444.198,283.533 444.340,284.428 444.327 C 286.123 444.304,286.800 443.518,286.800 441.574 C 286.800 440.658,286.184 440.544,285.855 441.400 M276.550 444.987 C 276.125 446.094,276.600 446.326,277.319 445.363 C 277.946 444.523,277.957 444.400,277.406 444.400 C 277.059 444.400,276.674 444.664,276.550 444.987 M278.813 445.366 C 278.611 445.897,278.076 446.449,277.623 446.593 C 277.170 446.736,276.800 447.032,276.800 447.251 C 276.800 447.469,276.608 447.529,276.373 447.383 C 276.139 447.238,275.980 447.363,276.021 447.660 C 276.158 448.661,276.002 449.200,275.576 449.200 C 275.343 449.200,275.272 449.007,275.418 448.770 C 275.564 448.534,275.305 448.578,274.842 448.867 C 274.379 449.156,274.000 449.529,274.000 449.696 C 274.000 450.260,275.086 450.005,276.109 449.200 C 276.669 448.760,277.391 448.400,277.716 448.400 C 278.422 448.400,280.400 445.914,280.400 445.027 C 280.400 444.042,279.220 444.294,278.813 445.366 M257.000 451.008 C 258.320 451.531,259.130 451.984,258.800 452.015 C 258.470 452.047,258.805 452.246,259.544 452.459 C 261.569 453.042,260.890 453.185,258.424 452.696 C 256.890 452.391,256.470 452.186,257.000 452.000 C 257.585 451.795,257.396 451.645,256.151 451.330 C 254.663 450.952,254.551 450.982,254.575 451.753 C 254.602 452.656,250.090 454.563,248.956 454.128 C 248.620 453.999,248.400 454.175,248.400 454.573 C 248.400 455.396,266.016 455.239,268.312 454.395 C 269.666 453.898,270.800 452.268,270.800 450.820 C 270.800 449.524,267.666 449.652,266.400 451.000 C 265.883 451.550,265.212 452.000,264.908 452.000 C 264.595 452.000,264.841 451.582,265.475 451.037 L 266.595 450.073 264.998 450.164 C 264.119 450.213,262.791 450.574,262.046 450.965 C 260.733 451.655,260.612 451.651,258.137 450.838 C 254.718 449.716,254.008 449.822,257.000 451.008 M264.224 451.013 C 263.796 451.336,263.256 451.603,263.024 451.606 C 262.791 451.609,262.842 451.766,263.138 451.953 C 263.533 452.204,263.388 452.367,262.591 452.567 C 261.994 452.716,261.407 452.740,261.286 452.619 C 261.165 452.499,261.397 452.400,261.800 452.400 C 262.203 452.400,262.414 452.280,262.267 452.134 C 262.121 451.988,262.496 451.551,263.101 451.163 C 264.434 450.309,265.310 450.191,264.224 451.013 M244.600 454.800 C 243.406 455.104,243.407 455.106,244.900 455.153 C 245.725 455.179,246.400 455.020,246.400 454.800 C 246.400 454.359,246.332 454.359,244.600 454.800 M177.117 456.300 C 177.846 460.186,177.950 460.200,205.800 460.200 C 231.503 460.200,232.712 460.104,233.812 457.977 C 234.778 456.110,234.554 455.381,233.413 456.678 C 232.424 457.802,232.052 457.398,232.796 456.007 C 233.169 455.310,232.965 455.267,229.327 455.267 C 227.200 455.267,225.685 455.405,225.959 455.574 C 227.765 456.691,223.663 457.200,212.140 457.291 L 200.600 457.382 212.400 457.600 L 224.200 457.818 212.800 457.911 C 206.530 457.962,199.330 458.138,196.800 458.302 L 192.200 458.600 196.600 458.821 C 200.754 459.030,200.576 459.052,193.400 459.221 C 179.763 459.542,179.364 459.479,178.135 456.815 C 177.280 454.960,176.822 454.728,177.117 456.300 M213.200 456.000 C 202.160 456.212,202.015 456.225,208.600 456.409 C 218.664 456.691,224.396 456.564,224.912 456.048 C 225.158 455.802,225.189 455.641,224.980 455.691 C 224.771 455.740,219.470 455.880,213.200 456.000 M228.400 455.767 C 228.400 456.087,225.703 457.600,225.153 457.589 C 224.849 457.583,225.410 457.146,226.400 456.619 C 228.468 455.518,228.400 455.547,228.400 455.767 M178.800 456.698 C 178.800 457.396,181.430 458.828,183.084 459.030 C 184.464 459.198,184.428 459.166,182.688 458.666 C 181.637 458.365,180.332 457.700,179.788 457.189 C 179.245 456.678,178.800 456.457,178.800 456.698 M191.100 459.891 C 190.275 459.978,188.925 459.978,188.100 459.891 C 187.275 459.805,187.950 459.734,189.600 459.734 C 191.250 459.734,191.925 459.805,191.100 459.891 " stroke="none" fill="#110909" fill-rule="evenodd"></path><path id="path1" d="M315.800 79.457 C 314.576 79.816,310.540 80.184,305.400 80.406 C 294.808 80.863,274.714 81.597,272.600 81.605 C 271.226 81.609,270.877 81.800,270.131 82.953 C 269.588 83.791,268.574 84.578,267.432 85.048 C 265.850 85.698,265.571 85.990,265.377 87.200 C 264.147 94.856,263.163 97.200,261.180 97.200 C 260.610 97.200,260.394 97.618,260.197 99.100 C 259.271 106.084,257.676 110.000,255.758 110.000 C 255.265 110.000,254.400 113.191,254.400 115.011 C 254.400 117.522,252.793 120.986,251.204 121.901 C 249.757 122.733,249.643 122.937,249.416 125.095 C 248.784 131.103,247.568 134.000,245.680 134.000 C 244.928 134.000,243.599 138.868,243.600 141.620 C 243.600 143.320,241.779 146.339,240.569 146.643 C 239.680 146.867,239.287 148.077,238.374 153.400 C 237.737 157.113,236.518 159.144,234.900 159.187 C 234.625 159.194,234.400 159.245,234.399 159.300 C 234.396 159.969,233.097 166.512,232.755 167.580 C 232.159 169.446,230.887 170.800,229.730 170.800 C 228.888 170.800,228.799 170.980,228.793 172.700 C 228.777 177.171,226.187 183.969,224.490 183.993 C 223.766 184.003,223.199 185.736,223.203 187.926 C 223.207 190.544,221.407 194.782,219.762 196.024 C 218.593 196.908,218.428 197.303,218.016 200.200 C 217.245 205.624,216.158 206.823,211.293 207.620 C 206.293 208.439,205.420 207.663,204.006 201.144 C 203.177 197.324,202.919 196.673,202.113 196.367 C 200.301 195.678,199.658 194.650,199.002 191.391 C 197.985 186.336,197.720 185.724,196.440 185.468 C 195.040 185.188,194.107 183.377,193.566 179.889 C 193.015 176.333,192.476 175.195,191.225 174.945 C 190.582 174.816,189.982 174.314,189.697 173.667 C 188.696 171.389,188.000 169.051,188.000 167.969 C 188.000 166.257,187.247 164.951,185.817 164.181 C 184.469 163.455,182.400 158.433,182.400 155.886 C 182.400 155.128,182.082 154.656,181.299 154.251 C 179.494 153.318,178.966 152.398,177.826 148.200 C 176.393 142.922,176.501 143.200,175.882 143.200 C 174.976 143.200,173.520 141.334,173.169 139.721 C 172.013 134.411,171.263 132.601,170.057 132.218 C 169.131 131.924,168.197 129.888,167.205 126.000 C 166.624 123.721,166.157 122.760,165.264 122.000 C 163.940 120.874,162.000 117.136,162.000 115.712 C 162.000 114.272,160.955 112.095,159.777 111.081 C 159.192 110.579,158.479 109.545,158.191 108.784 C 157.135 105.990,156.407 103.775,156.223 102.800 C 156.119 102.250,155.350 101.066,154.513 100.169 C 153.159 98.718,151.174 94.159,151.194 92.549 C 151.208 91.501,150.082 91.329,145.054 91.611 L 139.909 91.900 138.620 93.350 C 136.958 95.218,134.975 95.810,127.503 96.672 C 122.690 97.227,121.566 97.477,121.390 98.030 C 120.937 99.459,118.330 100.676,114.701 101.154 C 104.304 102.524,104.660 102.445,103.600 103.631 C 102.395 104.982,99.766 106.400,98.470 106.400 C 97.029 106.400,95.925 107.958,96.642 108.981 C 96.949 109.419,97.200 110.098,97.200 110.489 C 97.200 110.880,97.342 111.200,97.517 111.200 C 98.788 111.200,101.585 115.200,102.167 117.851 C 102.333 118.607,103.041 119.581,103.960 120.320 C 104.795 120.991,105.706 122.138,105.986 122.870 C 106.265 123.601,106.744 124.771,107.051 125.468 C 107.357 126.166,107.717 127.285,107.851 127.956 C 107.990 128.650,108.418 129.279,108.842 129.413 C 110.104 129.814,112.000 131.996,112.000 133.047 C 112.000 134.227,113.366 137.028,114.162 137.479 C 115.055 137.985,117.600 141.897,117.600 142.764 C 117.600 144.220,118.346 145.523,119.604 146.263 C 120.292 146.668,121.129 147.630,121.463 148.400 C 121.798 149.170,122.305 150.250,122.590 150.800 C 122.875 151.350,123.232 152.380,123.383 153.089 C 123.624 154.216,125.570 156.400,126.333 156.400 C 126.669 156.400,127.366 157.960,128.226 160.638 C 128.670 162.018,129.233 162.883,129.971 163.319 C 131.053 163.958,133.623 168.611,134.158 170.900 C 134.299 171.505,134.669 172.000,134.978 172.000 C 135.727 172.000,138.000 174.789,138.000 175.707 C 138.000 176.929,139.615 179.693,141.600 181.871 C 142.959 183.362,143.562 184.401,143.750 185.577 C 143.937 186.744,144.467 187.667,145.606 188.806 C 146.483 189.683,147.200 190.555,147.200 190.744 C 147.200 190.933,147.614 191.698,148.120 192.444 C 148.626 193.190,149.274 194.636,149.560 195.659 C 149.956 197.072,150.389 197.683,151.365 198.209 C 152.660 198.906,152.882 199.268,154.377 203.112 C 154.828 204.274,155.807 205.834,156.551 206.578 C 157.946 207.972,159.783 211.368,160.184 213.293 C 160.319 213.942,160.864 214.619,161.526 214.962 C 162.139 215.279,162.976 216.227,163.385 217.069 C 163.794 217.911,164.460 219.255,164.864 220.054 C 165.269 220.854,165.600 221.743,165.600 222.028 C 165.600 222.313,166.500 223.415,167.600 224.475 C 168.710 225.545,169.600 226.764,169.600 227.215 C 169.600 228.408,171.401 231.721,172.366 232.303 C 172.825 232.580,173.200 232.997,173.200 233.230 C 173.200 233.463,173.630 234.226,174.156 234.927 C 174.682 235.627,175.228 236.747,175.370 237.416 C 175.721 239.080,177.063 241.200,177.765 241.200 C 178.082 241.200,178.823 242.235,179.411 243.500 C 182.028 249.122,182.596 250.126,183.256 250.299 C 183.966 250.484,186.000 253.919,186.000 254.931 C 186.000 255.726,187.197 258.000,187.616 258.000 C 188.263 258.000,191.195 262.825,191.653 264.644 C 191.900 265.624,192.394 266.647,192.751 266.917 C 195.392 268.915,196.072 272.892,195.716 284.262 C 195.492 291.417,195.532 292.065,196.315 294.062 C 196.777 295.238,197.214 296.560,197.286 297.000 C 197.402 297.700,197.668 297.781,199.409 297.651 C 200.504 297.569,205.360 297.438,210.200 297.361 C 247.758 296.760,245.017 296.970,245.400 294.671 C 245.554 293.752,245.812 284.540,245.975 274.200 C 246.303 253.367,246.325 253.191,248.991 250.400 C 250.117 249.221,250.399 248.530,250.779 246.028 C 251.209 243.193,252.267 240.622,253.628 239.104 C 254.794 237.804,255.949 235.014,256.237 232.800 C 256.395 231.590,256.946 229.929,257.462 229.108 C 257.978 228.287,258.400 227.382,258.400 227.097 C 258.400 226.812,258.895 226.036,259.500 225.373 C 260.256 224.545,260.839 223.174,261.364 220.984 C 262.126 217.808,263.605 214.460,264.864 213.063 C 265.477 212.384,267.600 206.292,267.600 205.215 C 267.600 204.957,268.050 204.157,268.600 203.436 C 269.150 202.714,269.600 201.883,269.600 201.588 C 269.600 201.293,269.929 200.680,270.332 200.226 C 270.735 199.772,271.288 198.590,271.562 197.600 C 272.089 195.695,273.656 191.481,274.652 189.288 C 274.980 188.567,275.598 187.758,276.024 187.492 C 276.489 187.202,276.800 186.563,276.800 185.899 C 276.800 185.290,277.153 184.028,277.585 183.096 C 278.017 182.163,278.541 180.624,278.748 179.676 C 279.138 177.897,280.933 174.800,281.574 174.800 C 281.773 174.800,282.058 174.215,282.207 173.500 C 282.962 169.877,285.022 164.610,286.266 163.121 C 287.002 162.239,287.697 161.041,287.809 160.459 C 288.584 156.433,290.138 152.384,291.288 151.395 C 291.821 150.936,292.542 149.540,292.942 148.191 C 294.988 141.289,295.428 140.114,296.334 139.141 C 297.599 137.783,299.163 134.163,299.184 132.548 C 299.205 130.883,301.058 126.899,301.942 126.619 C 302.688 126.382,303.631 124.017,304.419 120.400 C 305.153 117.036,305.597 116.074,306.934 114.949 C 308.162 113.915,309.198 111.041,309.981 106.492 C 310.254 104.910,311.142 103.557,312.916 102.020 C 313.321 101.669,313.884 100.189,314.214 98.608 C 315.257 93.612,315.926 91.844,317.323 90.400 C 319.055 88.610,319.600 87.558,319.600 86.007 C 319.600 85.322,319.955 84.026,320.390 83.126 C 321.209 81.431,321.179 81.242,319.853 79.717 C 318.944 78.671,318.567 78.647,315.800 79.457 M226.082 397.496 C 227.558 397.573,230.078 397.573,231.682 397.497 C 233.287 397.421,232.080 397.358,229.000 397.358 C 225.920 397.357,224.607 397.419,226.082 397.496 " stroke="none" fill="#f33434" fill-rule="evenodd"></path><path id="path2" d="M261.429 29.829 C 261.027 30.230,260.800 31.170,260.800 32.429 L 260.800 34.400 253.000 34.400 L 245.200 34.400 245.200 37.000 L 245.200 39.600 242.600 39.600 L 240.000 39.600 240.000 42.400 L 240.000 45.200 237.200 45.200 L 234.400 45.200 234.400 47.781 L 234.400 50.362 231.900 50.481 L 229.400 50.600 229.281 53.081 L 229.163 55.563 226.681 55.681 L 224.200 55.800 224.088 60.881 L 223.976 65.962 221.488 66.081 L 219.000 66.200 218.883 72.200 L 218.766 78.200 217.483 78.800 C 216.742 79.146,215.958 79.949,215.628 80.700 C 215.018 82.086,215.328 82.000,210.400 82.147 C 209.410 82.176,208.468 82.380,208.306 82.600 C 208.144 82.820,208.012 82.190,208.012 81.200 C 208.012 79.217,208.254 78.669,209.300 78.283 C 209.685 78.141,210.000 77.749,210.000 77.413 C 210.000 77.076,210.163 76.800,210.362 76.800 C 210.562 76.800,210.517 76.351,210.262 75.803 C 210.008 75.255,209.678 74.805,209.529 74.803 C 209.379 74.801,208.974 74.517,208.629 74.171 C 208.083 73.625,208.000 73.622,208.000 74.143 C 208.000 74.473,207.717 75.026,207.371 75.371 C 206.800 75.943,206.809 76.002,207.471 76.025 C 208.818 76.072,206.315 76.901,204.539 76.996 L 202.878 77.085 202.580 73.043 C 202.162 67.368,202.158 66.850,202.530 67.080 C 202.711 67.192,202.622 66.905,202.333 66.442 C 202.044 65.979,201.536 65.587,201.204 65.572 C 200.765 65.551,200.799 65.465,201.330 65.256 C 201.731 65.098,202.031 64.816,201.995 64.629 C 201.960 64.442,202.151 64.154,202.419 63.988 C 202.755 63.781,202.641 63.604,202.053 63.417 C 201.428 63.218,201.200 62.820,201.200 61.924 C 201.200 60.822,201.268 60.756,201.889 61.251 C 202.327 61.599,202.254 61.378,201.689 60.646 C 201.200 60.011,200.800 59.280,200.800 59.021 C 200.800 58.519,199.060 57.117,197.900 56.686 C 197.515 56.542,197.200 56.239,197.200 56.013 C 197.200 55.786,196.858 55.600,196.439 55.600 C 195.954 55.600,195.527 55.167,195.261 54.404 C 194.997 53.645,194.325 52.961,193.422 52.530 C 192.640 52.157,192.000 51.627,192.000 51.353 C 192.000 50.874,190.852 50.306,190.141 50.434 C 187.737 50.864,186.000 50.354,186.000 49.216 C 186.000 45.761,183.461 45.200,167.823 45.200 L 155.200 45.200 155.200 43.033 C 155.200 39.302,156.306 39.600,142.437 39.600 C 128.529 39.600,129.200 39.434,129.200 42.880 L 129.200 45.200 113.643 45.200 C 96.155 45.200,97.600 44.910,97.600 48.421 L 97.600 50.376 92.500 50.488 L 87.400 50.600 87.281 53.100 L 87.162 55.600 81.981 55.600 L 76.800 55.600 76.800 58.182 L 76.800 60.763 74.100 60.882 L 71.400 61.000 71.281 63.500 L 71.162 66.000 66.604 66.000 C 61.356 66.000,60.800 66.334,60.800 69.489 L 60.800 71.200 58.823 71.200 C 55.933 71.200,55.600 71.850,55.600 77.489 L 55.600 82.000 53.629 82.000 C 50.272 82.000,50.400 81.434,50.400 96.261 L 50.400 109.264 48.882 109.861 C 45.893 111.035,45.126 115.878,45.246 132.844 C 45.311 141.929,45.396 143.185,45.960 143.336 C 46.497 143.480,46.487 143.515,45.900 143.554 C 45.374 143.588,45.200 143.952,45.200 145.020 C 45.200 146.872,46.257 148.941,47.048 148.637 C 47.374 148.512,47.537 148.578,47.410 148.784 C 47.124 149.246,49.772 149.788,50.405 149.397 C 50.736 149.192,50.786 149.620,50.585 150.957 C 50.342 152.581,50.398 152.804,51.055 152.832 C 51.476 152.849,51.583 152.951,51.300 153.065 C 51.025 153.176,50.800 153.442,50.800 153.657 C 50.800 153.872,51.025 153.912,51.300 153.747 C 51.690 153.513,51.696 153.575,51.328 154.030 C 50.951 154.497,51.052 154.801,51.828 155.549 C 52.363 156.063,52.800 156.736,52.800 157.043 C 52.800 157.351,53.489 157.901,54.332 158.266 C 55.597 158.814,55.833 159.093,55.685 159.865 C 55.564 160.499,55.694 160.800,56.089 160.800 C 56.756 160.800,57.748 162.569,57.827 163.900 C 57.891 164.979,57.853 164.991,57.149 164.123 C 56.776 163.663,56.760 163.543,57.100 163.747 C 57.375 163.912,57.600 163.857,57.600 163.624 C 57.600 163.391,57.409 163.200,57.176 163.200 C 56.943 163.200,56.864 163.020,57.000 162.800 C 57.136 162.580,57.046 162.400,56.800 162.400 C 56.554 162.400,56.464 162.220,56.600 162.000 C 56.736 161.780,56.657 161.600,56.424 161.600 C 55.959 161.600,55.884 162.526,56.239 163.851 C 56.648 165.372,59.969 166.291,60.032 164.900 C 60.056 164.349,60.109 164.327,60.278 164.800 C 60.396 165.130,60.786 165.646,61.146 165.946 C 61.627 166.347,61.668 166.541,61.300 166.679 C 60.505 166.977,60.677 168.799,61.500 168.806 C 62.094 168.811,62.110 168.869,61.603 169.189 C 61.131 169.488,61.109 169.669,61.499 170.059 C 62.179 170.739,63.318 170.853,63.684 170.278 C 63.918 169.910,63.989 169.913,63.994 170.287 C 63.997 170.556,64.241 170.682,64.536 170.569 C 65.422 170.229,66.051 171.427,66.103 173.550 C 66.130 174.652,66.298 175.463,66.476 175.353 C 66.654 175.243,66.803 175.478,66.806 175.876 C 66.811 176.490,66.871 176.509,67.200 176.000 C 67.413 175.670,67.591 175.595,67.594 175.833 C 67.604 176.569,67.100 176.815,66.537 176.348 C 66.116 175.999,66.000 176.086,66.000 176.751 C 66.000 177.333,66.251 177.600,66.800 177.600 C 67.240 177.600,67.600 177.865,67.600 178.188 C 67.600 178.511,68.140 179.175,68.800 179.663 C 69.460 180.151,70.000 180.787,70.000 181.075 C 70.000 181.364,70.248 181.600,70.551 181.600 C 71.390 181.600,72.167 182.669,71.517 182.930 C 71.115 183.091,71.122 183.144,71.549 183.168 C 72.003 183.195,72.008 183.309,71.575 183.830 C 71.146 184.347,71.145 184.519,71.571 184.782 C 71.967 185.027,71.975 185.142,71.603 185.266 C 70.105 185.765,73.138 191.382,74.740 191.075 C 75.512 190.928,76.005 191.147,76.686 191.939 C 77.625 193.030,77.909 193.838,77.200 193.400 C 76.980 193.264,76.800 193.343,76.800 193.576 C 76.800 193.809,76.966 194.000,77.169 194.000 C 77.650 194.000,80.000 196.350,80.000 196.831 C 80.000 197.034,80.501 197.200,81.114 197.200 C 82.225 197.200,82.228 197.208,82.088 199.600 C 81.976 201.533,82.066 202.000,82.551 202.000 C 82.882 202.000,83.263 202.178,83.397 202.395 C 83.537 202.622,83.377 202.689,83.021 202.553 C 82.539 202.368,82.400 202.602,82.400 203.597 C 82.400 205.014,84.330 207.200,85.581 207.200 C 86.520 207.200,88.369 208.847,87.700 209.087 C 86.925 209.365,87.092 210.799,87.900 210.806 C 88.415 210.811,88.464 210.898,88.086 211.138 C 87.467 211.531,87.870 212.800,88.613 212.800 C 88.904 212.800,89.224 212.485,89.324 212.100 C 89.462 211.573,89.519 211.623,89.554 212.300 C 89.601 213.216,91.200 213.673,91.200 212.771 C 91.200 211.179,92.422 213.923,92.459 215.601 C 92.498 217.299,92.615 217.607,93.153 217.422 C 93.687 217.237,93.677 217.293,93.100 217.743 C 92.356 218.323,92.155 219.200,92.767 219.200 C 92.968 219.200,93.217 218.975,93.319 218.700 C 93.454 218.334,93.700 218.387,94.238 218.900 C 94.641 219.285,94.768 219.600,94.519 219.600 C 94.270 219.600,93.976 219.375,93.865 219.100 C 93.739 218.788,93.651 218.851,93.632 219.267 C 93.614 219.633,93.375 220.008,93.100 220.100 C 92.442 220.320,93.245 222.645,93.929 222.500 C 94.188 222.445,94.400 222.580,94.400 222.800 C 94.400 223.020,94.760 223.200,95.200 223.200 C 95.640 223.200,96.000 223.020,96.000 222.800 C 96.000 222.580,96.180 222.400,96.400 222.400 C 96.620 222.400,96.800 222.604,96.800 222.853 C 96.800 223.102,97.169 223.626,97.620 224.017 C 98.127 224.457,98.280 224.827,98.020 224.988 C 97.138 225.533,97.524 227.996,98.500 228.046 C 99.111 228.078,99.188 228.149,98.741 228.268 C 96.951 228.743,99.917 232.935,102.372 233.402 C 103.403 233.598,103.602 233.755,103.172 234.032 C 102.679 234.349,102.683 234.460,103.200 234.830 C 103.652 235.155,103.676 235.311,103.300 235.464 C 101.817 236.065,103.129 237.527,104.900 237.247 C 105.065 237.221,105.179 237.335,105.153 237.500 C 105.017 238.360,105.249 239.200,105.624 239.200 C 105.857 239.200,105.919 238.992,105.762 238.738 C 105.566 238.422,105.653 238.387,106.038 238.628 C 106.347 238.821,106.780 239.001,107.000 239.029 C 107.220 239.056,107.625 239.106,107.900 239.139 C 108.253 239.182,108.400 240.139,108.400 242.400 C 108.400 244.978,108.517 245.600,109.000 245.600 C 109.330 245.600,109.600 245.780,109.600 246.000 C 109.600 246.220,109.330 246.400,109.000 246.400 C 108.107 246.400,108.275 247.852,109.275 248.784 C 110.252 249.694,111.825 249.868,112.135 249.100 C 112.249 248.818,112.351 248.925,112.368 249.347 C 112.391 249.871,112.621 250.035,113.141 249.899 C 113.783 249.732,113.860 249.901,113.718 251.153 C 113.582 252.344,113.708 252.671,114.431 253.000 C 115.411 253.447,115.490 254.271,114.534 254.073 C 114.194 254.003,114.033 254.130,114.174 254.358 C 114.617 255.075,117.243 255.374,117.644 254.753 C 118.336 253.678,118.936 255.305,118.878 258.100 C 118.866 258.705,119.023 259.200,119.228 259.200 C 119.433 259.200,119.600 259.391,119.600 259.624 C 119.600 259.857,119.420 259.936,119.200 259.800 C 118.980 259.664,118.800 259.743,118.800 259.976 C 118.800 260.209,119.115 260.414,119.500 260.432 C 119.918 260.450,119.999 260.544,119.700 260.665 C 119.092 260.910,119.027 262.800,119.627 262.800 C 119.871 262.800,119.946 263.141,119.801 263.597 C 119.457 264.679,121.256 265.584,122.198 264.802 C 122.540 264.518,122.729 264.196,122.619 264.086 C 122.509 263.976,122.169 264.094,121.863 264.348 C 121.140 264.947,120.300 264.010,120.300 262.606 C 120.300 262.028,120.128 261.721,119.888 261.869 C 119.651 262.016,119.597 261.928,119.762 261.662 C 120.180 260.986,120.308 261.067,121.090 262.500 C 121.481 263.215,122.070 263.800,122.400 263.800 C 122.730 263.800,122.975 264.115,122.944 264.500 C 122.881 265.304,123.435 265.444,123.735 264.700 C 123.856 264.401,123.950 264.482,123.968 264.900 C 123.986 265.285,124.225 265.603,124.500 265.606 C 124.825 265.610,124.854 265.715,124.583 265.906 C 123.975 266.335,123.910 268.399,124.504 268.406 C 124.844 268.410,124.821 268.526,124.429 268.774 C 123.938 269.085,123.952 269.427,124.529 271.214 C 124.898 272.357,125.200 273.502,125.200 273.760 C 125.200 274.379,127.272 275.582,128.515 275.685 C 129.416 275.759,129.484 275.897,129.298 277.283 C 129.137 278.482,129.226 278.800,129.724 278.800 C 130.070 278.800,130.463 278.978,130.597 279.195 C 130.737 279.422,130.577 279.489,130.221 279.353 C 129.495 279.074,129.441 279.356,130.014 280.426 C 130.530 281.391,131.481 281.432,131.724 280.500 C 131.862 279.973,131.919 280.023,131.954 280.700 C 131.991 281.418,132.237 281.600,133.173 281.600 C 134.526 281.600,134.818 282.213,134.599 284.592 C 134.513 285.524,134.648 286.325,134.926 286.523 C 135.288 286.781,135.282 286.909,134.900 287.064 C 133.978 287.438,134.300 289.195,135.300 289.246 C 135.977 289.281,136.027 289.338,135.500 289.476 C 133.422 290.019,135.678 292.138,138.126 291.942 L 139.896 291.800 140.019 295.200 C 140.086 297.070,140.120 299.217,140.094 299.970 C 140.068 300.724,140.234 301.691,140.463 302.119 C 140.762 302.676,140.755 302.820,140.440 302.625 C 140.164 302.454,140.000 302.734,140.000 303.376 C 140.000 304.020,140.223 304.400,140.600 304.400 C 140.930 304.400,141.200 304.580,141.200 304.800 C 141.200 305.020,140.930 305.200,140.600 305.200 C 139.469 305.200,140.125 310.068,141.433 311.376 C 141.765 311.708,142.748 312.171,143.618 312.405 L 145.200 312.831 145.200 371.186 C 145.200 426.426,145.237 429.551,145.900 429.724 C 146.526 429.888,146.521 429.912,145.850 429.954 C 145.034 430.004,145.148 431.974,146.029 433.034 C 146.542 433.653,148.884 433.658,149.294 433.042 C 149.476 432.768,149.590 432.867,149.594 433.300 C 149.597 433.685,149.753 434.000,149.941 434.000 C 150.128 434.000,150.392 435.438,150.528 437.195 C 150.875 441.696,153.111 444.734,155.423 443.846 C 155.735 443.727,155.959 443.757,155.921 443.914 C 155.468 445.767,156.564 448.379,158.041 448.970 C 159.874 449.703,160.800 449.773,160.800 449.176 C 160.800 448.943,160.575 448.882,160.300 449.041 C 160.025 449.199,159.933 449.181,160.097 449.001 C 160.260 448.821,160.170 448.401,159.897 448.067 C 159.526 447.615,159.674 447.639,160.476 448.160 C 161.152 448.600,161.466 449.085,161.320 449.465 C 161.135 449.947,161.403 450.054,162.644 449.996 C 164.953 449.887,167.071 450.035,166.500 450.265 C 165.578 450.637,165.900 452.395,166.900 452.446 C 167.577 452.481,167.627 452.538,167.100 452.676 C 166.139 452.927,166.221 453.876,167.251 454.427 C 167.915 454.782,168.177 454.764,168.445 454.341 C 168.711 453.921,168.789 453.956,168.794 454.500 C 168.801 455.317,170.796 455.516,170.806 454.700 C 170.811 454.331,170.890 454.322,171.109 454.666 C 171.319 454.997,173.199 455.094,177.602 455.002 C 181.011 454.931,188.660 454.766,194.600 454.636 C 200.540 454.505,209.360 454.335,214.200 454.258 C 224.014 454.100,226.500 453.533,227.055 451.325 C 227.551 449.348,233.384 448.538,243.730 449.009 C 256.917 449.610,264.464 449.193,265.870 447.787 C 266.193 447.464,266.635 447.200,266.852 447.200 C 267.069 447.200,267.144 447.032,267.017 446.828 C 266.891 446.623,266.970 446.342,267.193 446.204 C 267.417 446.066,267.600 445.603,267.600 445.176 C 267.600 444.749,267.842 444.400,268.139 444.400 C 268.435 444.400,269.262 444.108,269.976 443.752 C 270.952 443.265,271.920 443.160,273.860 443.331 C 276.729 443.583,277.600 443.397,277.600 442.534 C 277.600 442.214,277.745 442.042,277.922 442.152 C 278.099 442.261,278.210 441.676,278.168 440.851 C 278.107 439.660,278.267 439.273,278.945 438.975 C 279.415 438.769,280.340 437.520,281.000 436.200 C 281.913 434.374,282.436 433.767,283.187 433.661 C 284.293 433.505,285.244 432.542,286.499 430.310 C 286.965 429.479,287.629 428.794,287.974 428.787 C 289.237 428.762,290.009 427.686,290.438 425.354 C 290.676 424.059,291.024 422.640,291.212 422.200 C 291.400 421.760,291.663 420.841,291.796 420.158 C 291.993 419.147,292.321 418.831,293.553 418.461 C 294.973 418.036,295.920 416.904,296.238 415.255 C 296.997 411.308,297.221 330.214,296.558 299.400 C 295.955 271.358,296.092 268.800,298.203 268.800 C 300.031 268.800,300.722 267.613,301.008 263.978 C 301.441 258.465,302.454 256.177,304.514 256.055 C 306.645 255.930,306.528 256.161,306.434 252.278 C 306.322 247.619,307.602 243.059,308.812 243.807 C 310.104 244.606,311.961 239.513,311.992 235.086 C 312.003 233.534,313.025 232.135,314.340 231.872 C 315.677 231.605,316.383 230.240,316.643 227.419 C 317.123 222.231,318.461 219.202,320.276 219.200 C 321.000 219.200,321.223 218.632,321.816 215.281 C 323.006 208.564,323.289 207.856,324.937 207.467 C 326.862 207.011,327.042 206.583,327.368 201.655 C 327.656 197.316,328.514 195.200,329.986 195.200 C 331.808 195.200,332.400 194.102,332.400 190.721 C 332.400 186.570,333.428 184.196,335.384 183.829 C 337.847 183.367,338.118 182.893,338.052 179.165 C 337.973 174.661,339.213 171.206,340.914 171.194 C 342.886 171.180,343.493 169.278,343.593 162.800 C 343.630 160.360,344.374 159.094,346.011 158.683 C 348.290 158.111,348.596 157.538,348.655 153.727 C 348.729 148.932,349.446 147.200,351.354 147.200 C 354.163 147.200,354.939 146.605,354.629 144.690 C 353.953 140.509,353.934 139.307,354.515 137.583 L 355.116 135.800 357.593 135.680 L 360.070 135.560 359.735 133.480 C 359.379 131.270,359.376 128.053,359.728 126.400 C 359.845 125.850,359.954 124.831,359.970 124.135 C 359.997 122.985,360.141 122.847,361.554 122.608 C 364.720 122.073,365.317 120.623,364.614 115.179 C 364.383 113.391,364.452 112.855,364.964 112.430 C 365.314 112.140,365.600 111.654,365.600 111.351 C 365.600 110.956,366.172 110.800,367.626 110.800 C 371.206 110.800,371.703 109.930,370.256 106.200 C 368.964 102.869,370.231 98.811,372.571 98.787 C 375.254 98.760,375.150 99.379,375.351 82.167 C 375.451 73.605,375.609 66.150,375.704 65.600 C 375.798 65.050,376.016 63.307,376.187 61.726 L 376.498 58.852 378.449 60.773 C 379.522 61.829,380.400 62.636,380.400 62.567 C 380.400 62.092,377.794 58.718,377.171 58.384 C 376.619 58.089,376.400 57.543,376.400 56.466 C 376.400 55.638,376.184 54.744,375.920 54.480 C 375.547 54.107,375.569 53.999,376.020 53.994 C 376.498 53.989,376.504 53.927,376.057 53.644 C 375.679 53.404,375.649 53.217,375.957 53.026 C 376.634 52.608,376.484 52.002,375.700 51.987 C 375.033 51.975,375.033 51.949,375.700 51.443 C 376.741 50.653,376.617 50.596,373.995 50.648 C 371.331 50.701,370.901 50.217,371.286 47.595 C 371.383 46.938,371.323 46.400,371.154 46.400 C 370.984 46.400,370.915 46.040,371.000 45.600 C 371.114 45.006,370.929 44.788,370.277 44.754 C 369.600 44.718,369.560 44.665,370.100 44.524 C 371.140 44.252,370.983 42.315,369.819 41.058 C 368.643 39.790,366.409 39.556,366.386 40.700 C 366.378 41.085,365.973 40.230,365.486 38.800 C 364.236 35.131,363.458 34.800,355.398 34.506 C 349.495 34.290,349.200 34.241,349.200 33.462 C 349.200 32.391,347.277 30.403,346.225 30.387 C 345.771 30.380,345.051 30.110,344.624 29.787 C 343.404 28.865,262.352 28.905,261.429 29.829 M336.041 52.915 C 336.788 53.418,337.629 54.306,337.909 54.888 C 338.189 55.470,339.089 56.352,339.909 56.850 C 341.718 57.947,343.142 59.395,343.603 60.608 C 343.792 61.104,344.714 61.936,345.653 62.455 C 348.866 64.234,348.982 64.715,349.129 76.862 L 349.257 87.523 348.024 91.062 C 347.346 93.008,346.453 94.870,346.039 95.200 C 344.949 96.069,344.135 97.886,343.642 100.554 C 343.172 103.101,341.887 106.084,340.653 107.495 C 339.818 108.450,338.000 113.240,338.000 114.486 C 338.000 115.154,335.627 119.969,334.785 121.008 C 334.604 121.232,333.787 123.392,332.970 125.807 C 331.569 129.951,330.153 132.811,329.216 133.390 C 328.987 133.531,328.800 134.052,328.800 134.548 C 328.800 135.043,328.350 136.597,327.800 138.000 C 327.250 139.403,326.799 140.833,326.797 141.176 C 326.796 141.519,325.986 143.055,324.997 144.588 C 324.009 146.121,323.200 147.711,323.200 148.120 C 323.200 149.488,319.793 157.627,319.090 157.937 C 318.668 158.123,317.600 160.736,317.600 161.581 C 317.600 161.957,317.167 163.119,316.639 164.163 C 316.110 165.208,315.565 166.660,315.428 167.391 C 315.291 168.122,314.914 168.940,314.589 169.209 C 314.265 169.478,314.000 169.946,314.000 170.249 C 314.000 170.552,313.838 170.800,313.639 170.800 C 313.275 170.800,312.592 172.384,311.998 174.600 C 311.331 177.094,309.716 181.210,309.138 181.892 C 308.198 182.999,306.400 186.984,306.400 187.959 C 306.400 188.443,306.040 189.584,305.600 190.494 C 305.160 191.405,304.800 192.373,304.800 192.644 C 304.800 192.916,304.384 193.647,303.874 194.269 C 302.673 195.737,301.762 197.737,301.049 200.475 C 300.290 203.389,299.057 206.043,298.031 206.972 C 297.574 207.386,297.200 207.961,297.200 208.250 C 297.200 208.540,296.750 209.760,296.200 210.963 C 295.650 212.165,295.200 213.553,295.200 214.048 C 295.200 215.174,293.762 218.235,292.531 219.731 C 292.019 220.353,291.600 221.097,291.600 221.385 C 291.600 221.673,291.335 222.419,291.011 223.044 C 290.687 223.668,290.315 224.994,290.184 225.989 C 289.857 228.472,289.335 229.556,287.402 231.769 C 286.840 232.412,286.284 233.402,286.165 233.969 C 286.047 234.536,285.601 236.093,285.175 237.428 C 284.749 238.764,284.400 240.144,284.400 240.495 C 284.400 240.846,283.600 241.992,282.622 243.041 C 281.350 244.408,280.773 245.411,280.591 246.575 C 280.132 249.517,278.620 253.782,277.677 254.800 C 275.724 256.908,274.723 260.046,273.596 267.600 C 273.415 268.810,273.252 300.765,273.234 338.611 C 273.196 414.736,273.436 407.850,270.727 410.503 C 270.107 411.110,269.600 411.781,269.600 411.994 C 269.600 412.207,269.150 412.676,268.600 413.037 C 268.050 413.397,267.600 413.941,267.600 414.246 C 267.600 414.551,267.418 414.800,267.195 414.800 C 266.973 414.800,265.448 416.105,263.806 417.700 C 260.346 421.063,260.015 421.351,258.975 421.903 C 257.905 422.470,253.442 423.102,248.200 423.429 C 244.018 423.690,242.432 423.946,236.400 425.332 C 233.847 425.919,228.529 426.747,221.400 427.668 C 211.896 428.895,180.400 428.225,180.400 426.796 C 180.400 426.608,180.040 426.340,179.600 426.200 C 179.160 426.060,178.800 425.701,178.800 425.402 C 178.800 424.570,176.495 422.351,173.604 420.400 C 173.441 420.290,173.186 419.811,173.038 419.335 C 172.890 418.859,171.964 417.690,170.980 416.737 C 169.996 415.784,169.099 414.713,168.986 414.357 C 168.874 414.002,168.739 384.031,168.687 347.755 L 168.594 281.800 167.676 279.092 C 167.085 277.349,166.266 275.893,165.379 275.005 C 164.620 274.247,164.000 273.456,164.000 273.247 C 164.000 273.038,163.865 272.807,163.700 272.733 C 163.535 272.660,163.085 271.925,162.700 271.100 C 160.942 267.334,160.531 266.625,159.500 265.578 C 158.895 264.964,158.400 264.268,158.400 264.031 C 158.400 263.794,158.242 263.600,158.049 263.600 C 157.856 263.600,157.286 262.500,156.783 261.156 C 156.281 259.811,155.457 258.326,154.953 257.856 C 154.448 257.385,153.551 256.100,152.959 255.000 C 152.367 253.900,151.640 252.550,151.344 252.000 C 151.047 251.450,150.802 250.730,150.799 250.400 C 150.796 250.070,149.985 249.086,148.997 248.213 C 148.009 247.340,147.200 246.295,147.200 245.892 C 147.200 245.488,146.750 244.495,146.200 243.686 C 145.650 242.877,145.198 241.941,145.196 241.607 C 145.194 241.273,144.389 240.100,143.407 239.000 C 142.425 237.900,141.617 236.750,141.611 236.444 C 141.595 235.641,139.888 232.256,139.313 231.887 C 138.684 231.484,136.000 227.445,136.000 226.902 C 136.000 225.972,134.480 223.311,133.183 221.972 C 132.422 221.187,131.594 220.107,131.342 219.572 C 131.090 219.037,130.383 217.520,129.771 216.200 C 129.158 214.880,128.346 213.576,127.964 213.302 C 127.062 212.654,125.200 209.315,125.200 208.345 C 125.200 207.930,124.302 206.648,123.204 205.495 C 122.106 204.343,121.206 203.263,121.204 203.096 C 121.202 202.928,120.857 202.028,120.438 201.096 C 120.019 200.163,119.575 198.944,119.452 198.388 C 119.329 197.831,118.503 196.841,117.616 196.188 C 116.567 195.415,115.866 194.510,115.611 193.600 C 115.014 191.465,113.875 189.439,112.039 187.247 C 111.099 186.124,110.112 184.375,109.772 183.229 C 109.383 181.920,108.627 180.668,107.643 179.700 C 106.047 178.131,105.506 177.234,103.959 173.600 C 103.444 172.390,102.375 170.770,101.584 170.000 C 100.793 169.230,99.933 168.015,99.673 167.300 C 99.413 166.585,99.001 165.467,98.758 164.815 C 98.514 164.163,97.694 163.038,96.935 162.315 C 95.375 160.828,93.600 157.660,93.600 156.362 C 93.600 155.866,92.868 154.793,91.884 153.848 C 90.319 152.344,88.465 149.184,87.802 146.888 C 87.657 146.386,86.832 145.322,85.969 144.523 C 85.106 143.725,84.400 142.828,84.400 142.530 C 84.400 142.233,84.243 141.677,84.050 141.295 C 82.425 138.066,81.863 137.183,80.527 135.758 C 79.687 134.862,78.480 132.862,77.845 131.314 C 77.155 129.635,76.216 128.117,75.515 127.550 C 74.258 126.532,73.200 124.828,73.200 123.821 C 73.200 123.134,70.498 119.200,70.026 119.200 C 68.793 119.200,68.124 98.449,69.284 96.221 C 70.012 94.824,73.140 91.335,76.800 87.838 C 77.790 86.892,78.983 85.594,79.452 84.954 C 79.920 84.314,81.148 83.368,82.181 82.853 C 83.213 82.337,84.156 81.659,84.276 81.347 C 84.755 80.098,89.321 78.497,95.000 77.587 C 99.028 76.942,100.937 76.450,101.800 75.834 C 103.816 74.397,106.850 73.284,110.000 72.826 C 115.212 72.068,118.971 71.094,119.600 70.338 C 120.339 69.449,125.510 67.603,127.292 67.591 C 129.350 67.578,135.558 66.092,137.515 65.144 C 142.230 62.862,158.566 63.988,163.340 66.924 C 165.399 68.190,173.200 75.642,173.200 76.343 C 173.200 76.547,173.476 76.820,173.813 76.950 C 174.151 77.079,174.924 78.237,175.532 79.523 C 176.140 80.808,177.124 82.385,177.719 83.026 C 178.314 83.667,178.800 84.421,178.800 84.700 C 178.800 84.980,179.138 85.972,179.551 86.904 C 179.964 87.837,180.623 89.500,181.015 90.600 C 181.408 91.700,182.330 93.307,183.065 94.172 C 183.799 95.037,184.400 96.081,184.400 96.493 C 184.400 96.905,184.742 97.907,185.161 98.721 C 185.579 99.534,186.145 100.920,186.420 101.800 C 186.694 102.680,187.505 104.089,188.223 104.930 C 188.941 105.772,189.648 106.936,189.793 107.516 C 189.939 108.097,190.405 109.334,190.829 110.264 C 191.253 111.195,191.600 112.312,191.600 112.747 C 191.600 113.183,192.045 114.067,192.588 114.713 C 193.823 116.181,195.240 119.022,196.420 122.400 C 196.920 123.830,197.708 125.450,198.170 126.000 C 199.438 127.506,200.333 129.285,201.220 132.063 C 202.106 134.836,203.384 137.229,204.241 137.720 C 204.549 137.896,204.800 138.296,204.800 138.610 C 204.800 138.924,205.159 139.770,205.599 140.490 C 206.038 141.211,206.398 142.155,206.399 142.589 C 206.401 144.094,208.153 149.036,208.384 148.190 C 208.904 146.286,212.639 141.605,213.641 141.601 C 213.774 141.600,214.300 139.544,214.811 137.031 C 215.746 132.428,216.083 131.769,218.565 129.701 C 218.894 129.427,219.272 128.527,219.406 127.701 C 220.039 123.779,221.476 119.594,222.628 118.321 C 224.090 116.705,225.200 114.430,225.200 113.048 C 225.200 111.056,226.935 106.636,228.103 105.652 C 229.629 104.368,230.249 103.011,230.506 100.397 C 230.774 97.671,232.578 93.583,233.635 93.307 C 234.446 93.095,235.221 90.968,236.002 86.808 C 236.422 84.572,238.628 80.400,239.390 80.400 C 239.621 80.400,240.031 79.545,240.300 78.500 C 241.580 73.526,242.070 72.142,243.051 70.727 C 243.633 69.887,244.354 69.200,244.654 69.200 C 244.954 69.200,245.200 69.028,245.200 68.817 C 245.200 68.484,248.095 65.524,253.800 60.024 C 256.505 57.415,258.565 56.926,268.203 56.600 C 276.256 56.328,282.385 55.719,285.800 54.850 C 289.639 53.874,295.458 53.093,301.400 52.756 C 304.920 52.557,308.250 52.332,308.800 52.257 C 313.924 51.555,334.768 52.058,336.041 52.915 M66.400 178.984 C 66.400 179.306,66.794 179.936,67.275 180.384 C 68.216 181.260,69.600 181.482,69.600 180.757 C 69.600 180.514,69.336 180.416,69.013 180.540 C 68.690 180.664,68.302 180.565,68.151 180.321 C 67.969 180.026,68.065 179.990,68.438 180.215 C 68.917 180.503,68.919 180.453,68.451 179.877 C 68.149 179.505,67.643 179.200,67.327 179.200 C 67.011 179.200,66.864 179.020,67.000 178.800 C 67.136 178.580,67.057 178.400,66.824 178.400 C 66.591 178.400,66.400 178.663,66.400 178.984 M74.406 188.197 C 75.295 189.267,75.305 189.314,74.500 188.635 C 73.704 187.964,73.165 188.232,73.878 188.945 C 74.308 189.375,74.377 190.433,73.958 190.174 C 73.754 190.048,73.691 189.776,73.819 189.570 C 73.946 189.363,73.765 189.085,73.415 188.950 C 72.946 188.770,72.892 188.571,73.209 188.189 C 73.508 187.829,73.511 187.592,73.219 187.412 C 72.989 187.269,72.800 186.947,72.800 186.696 C 72.800 186.421,72.921 186.391,73.106 186.620 C 73.274 186.829,73.859 187.539,74.406 188.197 M76.726 189.787 C 75.985 190.405,74.933 190.694,74.933 190.278 C 74.933 190.015,75.365 189.773,75.893 189.741 C 76.420 189.708,76.795 189.729,76.726 189.787 M76.806 195.100 C 76.821 195.809,77.632 196.603,78.385 196.645 C 79.397 196.702,79.398 196.598,78.400 195.600 C 77.595 194.795,76.795 194.544,76.806 195.100 M84.229 203.068 C 84.088 203.436,84.203 203.882,84.486 204.062 C 84.852 204.294,84.863 204.390,84.524 204.394 C 84.262 204.397,83.946 204.236,83.822 204.036 C 83.586 203.654,83.941 202.400,84.286 202.400 C 84.396 202.400,84.370 202.701,84.229 203.068 M87.187 206.149 C 87.194 206.341,86.946 206.287,86.636 206.030 C 86.204 205.672,86.003 205.672,85.780 206.032 C 85.572 206.368,85.384 206.314,85.120 205.843 C 84.917 205.480,84.594 205.280,84.403 205.398 C 84.212 205.516,83.952 205.446,83.826 205.242 C 83.567 204.823,84.625 204.892,85.055 205.322 C 85.645 205.911,86.070 205.565,85.549 204.919 C 85.117 204.382,85.231 204.403,86.087 205.019 C 86.686 205.448,87.181 205.957,87.187 206.149 M95.600 222.484 C 95.600 222.673,95.264 222.648,94.853 222.428 C 94.442 222.208,93.963 222.157,93.788 222.314 C 93.614 222.471,93.594 222.387,93.742 222.128 C 93.891 221.868,93.827 221.540,93.600 221.400 C 93.373 221.260,93.299 220.964,93.436 220.742 C 93.694 220.324,95.600 221.857,95.600 222.484 M100.787 229.477 C 100.794 229.300,101.205 229.438,101.700 229.785 C 102.688 230.476,103.072 232.879,102.138 232.521 C 101.856 232.413,101.665 232.116,101.713 231.862 C 101.761 231.608,101.461 231.399,101.047 231.398 C 100.633 231.397,100.003 230.954,99.647 230.415 C 99.194 229.728,99.163 229.534,99.543 229.767 C 99.966 230.027,100.023 229.890,99.801 229.150 C 99.524 228.222,99.532 228.219,100.146 229.000 C 100.492 229.440,100.780 229.655,100.787 229.477 M100.000 230.376 C 100.000 230.583,100.180 230.864,100.400 231.000 C 100.620 231.136,100.800 231.021,100.800 230.744 C 100.800 230.352,100.907 230.347,101.280 230.720 C 101.974 231.414,102.590 231.311,102.000 230.600 C 101.452 229.940,100.000 229.778,100.000 230.376 M103.200 237.951 C 103.200 238.463,104.376 239.357,104.667 239.067 C 104.957 238.776,104.063 237.600,103.551 237.600 C 103.358 237.600,103.200 237.758,103.200 237.951 M110.543 247.780 C 111.142 248.379,111.344 248.824,111.061 248.925 C 110.247 249.219,109.212 248.434,109.483 247.728 C 109.666 247.251,109.590 247.159,109.206 247.396 C 108.854 247.614,108.772 247.569,108.962 247.262 C 109.349 246.635,109.422 246.658,110.543 247.780 M137.004 290.894 C 137.182 290.732,137.198 290.825,137.040 291.101 C 136.828 291.470,136.544 291.491,135.965 291.181 C 135.532 290.949,135.300 290.562,135.450 290.319 C 135.633 290.023,135.879 290.093,136.201 290.533 C 136.464 290.893,136.825 291.055,137.004 290.894 M302.131 358.200 C 302.133 359.740,302.205 360.321,302.292 359.491 C 302.379 358.661,302.377 357.401,302.289 356.691 C 302.200 355.981,302.129 356.660,302.131 358.200 M302.134 378.800 C 302.134 380.450,302.205 381.125,302.291 380.300 C 302.378 379.475,302.378 378.125,302.291 377.300 C 302.205 376.475,302.134 377.150,302.134 378.800 " stroke="none" fill="#f7f7f7" fill-rule="evenodd"></path><path id="path3" d="M316.200 74.482 C 313.780 74.675,309.100 75.267,305.800 75.798 C 294.288 77.648,289.735 78.110,280.200 78.394 C 271.536 78.652,270.427 78.763,268.825 79.540 C 267.849 80.013,266.847 80.400,266.600 80.400 C 265.484 80.400,263.478 84.031,261.992 88.736 C 261.495 90.311,260.972 91.600,260.830 91.600 C 260.308 91.600,258.408 95.914,257.159 99.937 C 256.453 102.212,255.633 104.166,255.337 104.279 C 255.042 104.393,254.800 104.709,254.800 104.982 C 254.800 105.254,254.435 105.898,253.989 106.413 C 253.543 106.927,253.083 107.809,252.966 108.374 C 252.300 111.597,251.951 112.810,251.205 114.496 C 250.750 115.525,250.214 116.468,250.014 116.591 C 249.390 116.977,247.513 121.285,247.310 122.796 C 247.204 123.588,246.515 125.398,245.779 126.818 C 243.035 132.111,242.048 134.341,241.779 135.850 C 241.395 138.005,239.967 141.282,239.099 142.000 C 238.382 142.593,236.000 149.072,236.000 150.428 C 236.000 150.813,235.283 152.036,234.406 153.145 C 233.461 154.340,232.643 155.916,232.397 157.015 C 231.643 160.379,230.126 164.167,228.639 166.400 C 227.834 167.610,227.086 169.050,226.977 169.600 C 226.514 171.933,224.671 177.209,224.175 177.621 C 223.031 178.570,221.431 181.894,221.158 183.886 C 221.001 185.033,220.586 186.545,220.236 187.247 C 219.886 187.949,219.600 188.722,219.600 188.965 C 219.600 189.209,219.230 189.638,218.779 189.921 C 217.808 190.527,216.715 192.940,216.026 196.000 C 215.299 199.225,215.194 199.544,214.674 200.115 C 214.413 200.400,214.001 200.986,213.758 201.417 C 213.403 202.047,212.806 202.223,210.708 202.317 C 207.803 202.448,206.873 201.624,206.257 198.377 C 206.113 197.620,205.727 196.484,205.398 195.854 C 205.069 195.224,204.800 194.576,204.800 194.414 C 204.800 194.251,203.983 192.877,202.985 191.359 C 201.986 189.842,201.074 188.150,200.958 187.600 C 200.646 186.122,199.143 182.772,198.176 181.400 C 196.944 179.652,195.200 176.118,195.200 175.369 C 195.200 174.660,193.061 170.572,192.164 169.569 C 191.854 169.221,191.600 168.760,191.600 168.544 C 191.600 168.327,191.240 167.405,190.800 166.494 C 190.360 165.584,190.000 164.585,190.000 164.275 C 190.000 163.965,189.595 163.094,189.100 162.338 C 188.605 161.583,187.857 160.298,187.437 159.483 C 187.017 158.667,186.542 158.000,186.382 158.000 C 186.221 158.000,185.978 157.415,185.841 156.700 C 185.631 155.598,184.292 152.754,181.083 146.600 C 180.739 145.940,179.981 144.267,179.398 142.882 C 178.815 141.497,177.633 139.117,176.769 137.594 C 175.906 136.071,175.200 134.647,175.200 134.430 C 175.200 134.063,173.546 130.567,171.119 125.800 C 169.140 121.915,167.600 118.496,167.600 117.989 C 167.600 117.706,167.150 116.886,166.600 116.164 C 166.050 115.443,165.596 114.616,165.591 114.327 C 165.586 114.037,165.230 113.350,164.800 112.800 C 164.370 112.250,164.014 111.561,164.009 111.269 C 163.999 110.690,161.225 104.725,160.815 104.400 C 160.545 104.186,159.339 101.648,157.205 96.800 C 156.479 95.150,155.640 93.516,155.342 93.169 C 155.044 92.821,154.800 92.388,154.800 92.206 C 154.800 91.559,152.688 89.120,151.504 88.400 C 149.748 87.332,147.927 87.531,136.466 90.036 C 135.513 90.244,133.443 91.025,131.866 91.770 C 129.129 93.065,126.541 93.779,120.800 94.822 C 119.370 95.082,116.723 95.998,114.919 96.858 C 113.114 97.717,110.594 98.607,109.319 98.835 C 101.677 100.204,95.831 102.132,95.325 103.450 C 95.216 103.736,94.802 104.072,94.406 104.198 C 94.010 104.324,93.584 104.736,93.458 105.113 C 93.332 105.491,92.821 106.304,92.322 106.919 C 91.751 107.624,91.568 108.142,91.829 108.319 C 92.056 108.474,92.772 109.320,93.419 110.200 C 94.066 111.080,94.704 111.890,94.836 112.000 C 94.969 112.110,95.196 112.686,95.341 113.281 C 95.487 113.875,96.241 115.045,97.017 115.881 C 98.336 117.300,100.800 121.775,100.800 122.750 C 100.800 123.138,101.555 124.102,103.646 126.386 C 104.001 126.774,104.755 128.103,105.320 129.338 C 105.886 130.574,107.125 132.713,108.074 134.092 C 109.023 135.472,110.340 137.654,111.000 138.942 C 111.660 140.230,112.740 141.863,113.400 142.570 C 114.060 143.277,114.841 144.383,115.136 145.028 C 116.870 148.821,117.877 150.657,118.465 151.098 C 119.237 151.677,121.200 155.061,121.200 155.814 C 121.200 156.096,121.979 157.288,122.931 158.463 C 123.883 159.638,125.326 161.987,126.138 163.683 C 126.949 165.378,128.159 167.358,128.825 168.083 C 129.491 168.807,130.691 170.738,131.492 172.374 C 132.292 174.009,133.229 175.645,133.574 176.009 C 134.425 176.908,134.927 177.729,136.625 181.000 C 137.424 182.540,138.496 184.250,139.007 184.800 C 139.518 185.350,140.727 187.330,141.693 189.200 C 142.660 191.070,144.139 193.500,144.981 194.600 C 145.822 195.700,146.844 197.376,147.252 198.325 C 147.660 199.274,148.265 200.322,148.597 200.654 C 148.928 200.986,149.200 201.514,149.200 201.829 C 149.200 202.143,149.376 202.400,149.592 202.400 C 149.807 202.400,150.368 203.154,150.838 204.075 C 151.308 204.996,151.942 205.999,152.246 206.303 C 152.551 206.608,152.800 207.190,152.800 207.598 C 152.800 208.005,153.250 208.873,153.800 209.527 C 154.350 210.181,154.800 210.895,154.800 211.115 C 154.800 211.335,155.040 211.607,155.334 211.719 C 155.627 211.832,156.560 213.336,157.408 215.062 C 159.057 218.422,160.307 220.411,161.079 220.908 C 161.343 221.078,162.209 222.552,163.005 224.184 C 163.801 225.816,165.019 227.927,165.713 228.876 C 166.406 229.824,167.644 231.903,168.464 233.495 C 169.284 235.087,170.508 237.079,171.185 237.922 C 171.862 238.764,173.144 240.877,174.034 242.617 C 174.924 244.357,176.236 246.505,176.951 247.391 C 177.665 248.276,178.834 250.170,179.549 251.600 C 180.264 253.030,181.482 255.100,182.257 256.200 C 183.031 257.300,184.017 258.920,184.446 259.800 C 185.571 262.105,186.086 262.902,187.096 263.904 C 188.079 264.878,189.208 267.110,190.280 270.200 C 191.048 272.414,191.623 396.672,190.884 400.737 C 190.060 405.271,194.013 407.093,202.633 406.153 C 216.314 404.661,219.686 404.206,226.000 402.995 C 228.750 402.468,233.610 401.858,236.800 401.640 C 243.279 401.197,246.609 400.557,247.800 399.525 C 248.240 399.144,248.925 398.595,249.322 398.305 C 250.734 397.275,250.781 394.972,250.790 326.564 L 250.800 258.528 251.655 255.364 C 252.126 253.624,252.596 251.513,252.700 250.674 C 252.804 249.835,253.499 248.035,254.244 246.674 C 256.412 242.719,257.591 240.061,258.066 238.062 C 258.632 235.681,259.946 232.841,260.992 231.741 C 261.733 230.962,264.000 224.862,264.000 223.648 C 264.000 223.139,266.123 219.847,267.081 218.871 C 267.366 218.581,267.600 217.964,267.600 217.502 C 267.600 216.315,269.551 210.798,270.394 209.600 C 271.552 207.953,273.200 204.479,273.200 203.682 C 273.200 202.606,275.015 198.302,276.790 195.170 C 277.633 193.683,278.449 191.866,278.605 191.133 C 278.953 189.495,281.116 184.301,281.571 184.011 C 282.061 183.699,284.400 178.039,284.400 177.167 C 284.400 176.755,284.918 175.469,285.551 174.309 C 287.646 170.471,287.937 169.831,289.352 165.961 C 290.124 163.850,291.371 160.880,292.122 159.361 C 292.873 157.843,293.709 155.970,293.981 155.200 C 295.066 152.122,295.933 150.048,297.493 146.800 C 298.391 144.930,299.518 142.320,299.998 141.000 C 300.478 139.680,301.755 136.784,302.835 134.565 C 303.916 132.346,304.800 130.236,304.800 129.875 C 304.800 129.514,305.159 128.630,305.599 127.910 C 306.038 127.189,306.398 126.290,306.399 125.912 C 306.399 125.534,306.741 124.617,307.158 123.874 C 307.575 123.132,308.489 121.191,309.189 119.562 C 309.889 117.933,310.808 115.837,311.231 114.904 C 311.654 113.972,312.000 112.978,312.000 112.697 C 312.000 112.415,312.728 110.748,313.617 108.992 C 314.507 107.237,315.601 104.720,316.049 103.400 C 316.497 102.080,317.029 100.829,317.232 100.620 C 317.434 100.411,317.600 99.866,317.600 99.409 C 317.600 98.952,317.897 98.154,318.260 97.635 C 319.203 96.289,321.200 92.087,321.200 91.449 C 321.200 90.546,323.581 85.075,324.349 84.211 C 327.008 81.222,327.263 75.874,324.808 74.604 C 323.551 73.954,322.918 73.945,316.200 74.482 M319.853 79.717 C 321.179 81.242,321.209 81.431,320.390 83.126 C 319.955 84.026,319.600 85.322,319.600 86.007 C 319.600 87.558,319.055 88.610,317.323 90.400 C 315.926 91.844,315.257 93.612,314.214 98.608 C 313.884 100.189,313.321 101.669,312.916 102.020 C 311.142 103.557,310.254 104.910,309.981 106.492 C 309.198 111.041,308.162 113.915,306.934 114.949 C 305.597 116.074,305.153 117.036,304.419 120.400 C 303.631 124.017,302.688 126.382,301.942 126.619 C 301.058 126.899,299.205 130.883,299.184 132.548 C 299.163 134.163,297.599 137.783,296.334 139.141 C 295.428 140.114,294.988 141.289,292.942 148.191 C 292.542 149.540,291.821 150.936,291.288 151.395 C 290.138 152.384,288.584 156.433,287.809 160.459 C 287.697 161.041,287.002 162.239,286.266 163.121 C 285.022 164.610,282.962 169.877,282.207 173.500 C 282.058 174.215,281.773 174.800,281.574 174.800 C 280.933 174.800,279.138 177.897,278.748 179.676 C 278.541 180.624,278.017 182.163,277.585 183.096 C 277.153 184.028,276.800 185.290,276.800 185.899 C 276.800 186.563,276.489 187.202,276.024 187.492 C 275.598 187.758,274.980 188.567,274.652 189.288 C 273.656 191.481,272.089 195.695,271.562 197.600 C 271.288 198.590,270.735 199.772,270.332 200.226 C 269.929 200.680,269.600 201.293,269.600 201.588 C 269.600 201.883,269.150 202.714,268.600 203.436 C 268.050 204.157,267.600 204.957,267.600 205.215 C 267.600 206.292,265.477 212.384,264.864 213.063 C 263.605 214.460,262.126 217.808,261.364 220.984 C 260.839 223.174,260.256 224.545,259.500 225.373 C 258.895 226.036,258.400 226.812,258.400 227.097 C 258.400 227.382,257.978 228.287,257.462 229.108 C 256.946 229.929,256.395 231.590,256.237 232.800 C 255.949 235.014,254.794 237.804,253.628 239.104 C 252.267 240.622,251.209 243.193,250.779 246.028 C 250.399 248.530,250.117 249.221,248.991 250.400 C 246.325 253.191,246.303 253.367,245.975 274.200 C 245.812 284.540,245.554 293.752,245.400 294.671 C 245.017 296.970,247.758 296.760,210.200 297.361 C 205.360 297.438,200.504 297.569,199.409 297.651 C 197.668 297.781,197.402 297.700,197.286 297.000 C 197.214 296.560,196.777 295.238,196.315 294.062 C 195.532 292.065,195.492 291.417,195.716 284.262 C 196.072 272.892,195.392 268.915,192.751 266.917 C 192.394 266.647,191.900 265.624,191.653 264.644 C 191.195 262.825,188.263 258.000,187.616 258.000 C 187.197 258.000,186.000 255.726,186.000 254.931 C 186.000 253.919,183.966 250.484,183.256 250.299 C 182.596 250.126,182.028 249.122,179.411 243.500 C 178.823 242.235,178.082 241.200,177.765 241.200 C 177.063 241.200,175.721 239.080,175.370 237.416 C 175.228 236.747,174.682 235.627,174.156 234.927 C 173.630 234.226,173.200 233.463,173.200 233.230 C 173.200 232.997,172.825 232.580,172.366 232.303 C 171.401 231.721,169.600 228.408,169.600 227.215 C 169.600 226.764,168.710 225.545,167.600 224.475 C 166.500 223.415,165.600 222.313,165.600 222.028 C 165.600 221.743,165.269 220.854,164.864 220.054 C 164.460 219.255,163.794 217.911,163.385 217.069 C 162.976 216.227,162.139 215.279,161.526 214.962 C 160.864 214.619,160.319 213.942,160.184 213.293 C 159.783 211.368,157.946 207.972,156.551 206.578 C 155.807 205.834,154.828 204.274,154.377 203.112 C 152.882 199.268,152.660 198.906,151.365 198.209 C 150.389 197.683,149.956 197.072,149.560 195.659 C 149.274 194.636,148.626 193.190,148.120 192.444 C 147.614 191.698,147.200 190.933,147.200 190.744 C 147.200 190.555,146.483 189.683,145.606 188.806 C 144.467 187.667,143.937 186.744,143.750 185.577 C 143.562 184.401,142.959 183.362,141.600 181.871 C 139.615 179.693,138.000 176.929,138.000 175.707 C 138.000 174.789,135.727 172.000,134.978 172.000 C 134.669 172.000,134.299 171.505,134.158 170.900 C 133.623 168.611,131.053 163.958,129.971 163.319 C 129.233 162.883,128.670 162.018,128.226 160.638 C 127.366 157.960,126.669 156.400,126.333 156.400 C 125.570 156.400,123.624 154.216,123.383 153.089 C 123.232 152.380,122.875 151.350,122.590 150.800 C 122.305 150.250,121.798 149.170,121.463 148.400 C 121.129 147.630,120.292 146.668,119.604 146.263 C 118.346 145.523,117.600 144.220,117.600 142.764 C 117.600 141.897,115.055 137.985,114.162 137.479 C 113.366 137.028,112.000 134.227,112.000 133.047 C 112.000 131.996,110.104 129.814,108.842 129.413 C 108.418 129.279,107.990 128.650,107.851 127.956 C 107.717 127.285,107.357 126.166,107.051 125.468 C 106.744 124.771,106.265 123.601,105.986 122.870 C 105.706 122.138,104.795 120.991,103.960 120.320 C 103.041 119.581,102.333 118.607,102.167 117.851 C 101.585 115.200,98.788 111.200,97.517 111.200 C 97.342 111.200,97.200 110.880,97.200 110.489 C 97.200 110.098,96.949 109.419,96.642 108.981 C 95.925 107.958,97.029 106.400,98.470 106.400 C 99.766 106.400,102.395 104.982,103.600 103.631 C 104.660 102.445,104.304 102.524,114.701 101.154 C 118.330 100.676,120.937 99.459,121.390 98.030 C 121.566 97.477,122.690 97.227,127.503 96.672 C 134.975 95.810,136.958 95.218,138.620 93.350 L 139.909 91.900 145.054 91.611 C 150.082 91.329,151.208 91.501,151.194 92.549 C 151.174 94.159,153.159 98.718,154.513 100.169 C 155.350 101.066,156.119 102.250,156.223 102.800 C 156.407 103.775,157.135 105.990,158.191 108.784 C 158.479 109.545,159.192 110.579,159.777 111.081 C 160.955 112.095,162.000 114.272,162.000 115.712 C 162.000 117.136,163.940 120.874,165.264 122.000 C 166.157 122.760,166.624 123.721,167.205 126.000 C 168.197 129.888,169.131 131.924,170.057 132.218 C 171.263 132.601,172.013 134.411,173.169 139.721 C 173.520 141.334,174.976 143.200,175.882 143.200 C 176.501 143.200,176.393 142.922,177.826 148.200 C 178.966 152.398,179.494 153.318,181.299 154.251 C 182.082 154.656,182.400 155.128,182.400 155.886 C 182.400 158.433,184.469 163.455,185.817 164.181 C 187.247 164.951,188.000 166.257,188.000 167.969 C 188.000 169.051,188.696 171.389,189.697 173.667 C 189.982 174.314,190.582 174.816,191.225 174.945 C 192.476 175.195,193.015 176.333,193.566 179.889 C 194.107 183.377,195.040 185.188,196.440 185.468 C 197.720 185.724,197.985 186.336,199.002 191.391 C 199.658 194.650,200.301 195.678,202.113 196.367 C 202.919 196.673,203.177 197.324,204.006 201.144 C 205.420 207.663,206.293 208.439,211.293 207.620 C 216.158 206.823,217.245 205.624,218.016 200.200 C 218.428 197.303,218.593 196.908,219.762 196.024 C 221.407 194.782,223.207 190.544,223.203 187.926 C 223.199 185.736,223.766 184.003,224.490 183.993 C 226.187 183.969,228.777 177.171,228.793 172.700 C 228.799 170.980,228.888 170.800,229.730 170.800 C 230.887 170.800,232.159 169.446,232.755 167.580 C 233.097 166.512,234.396 159.969,234.399 159.300 C 234.400 159.245,234.625 159.194,234.900 159.187 C 236.518 159.144,237.737 157.113,238.374 153.400 C 239.287 148.077,239.680 146.867,240.569 146.643 C 241.779 146.339,243.600 143.320,243.600 141.620 C 243.599 138.868,244.928 134.000,245.680 134.000 C 247.568 134.000,248.784 131.103,249.416 125.095 C 249.643 122.937,249.757 122.733,251.204 121.901 C 252.793 120.986,254.400 117.522,254.400 115.011 C 254.400 113.191,255.265 110.000,255.758 110.000 C 257.676 110.000,259.271 106.084,260.197 99.100 C 260.394 97.618,260.610 97.200,261.180 97.200 C 263.163 97.200,264.147 94.856,265.377 87.200 C 265.571 85.990,265.850 85.698,267.432 85.048 C 268.574 84.578,269.588 83.791,270.131 82.953 C 270.877 81.800,271.226 81.609,272.600 81.605 C 274.714 81.597,294.808 80.863,305.400 80.406 C 310.540 80.184,314.576 79.816,315.800 79.457 C 318.567 78.647,318.944 78.671,319.853 79.717 M231.682 397.497 C 230.078 397.573,227.558 397.573,226.082 397.496 C 224.607 397.419,225.920 397.357,229.000 397.358 C 232.080 397.358,233.287 397.421,231.682 397.497 " stroke="none" fill="#d11212" fill-rule="evenodd"></path><path id="path4" d="M370.933 45.800 C 370.933 46.130,371.052 46.400,371.197 46.400 C 371.343 46.400,371.383 46.938,371.286 47.595 C 370.932 50.007,371.360 50.588,373.587 50.720 C 375.497 50.834,377.101 49.767,375.714 49.305 C 375.478 49.226,375.377 48.810,375.489 48.381 C 375.606 47.933,375.493 47.600,375.223 47.600 C 374.964 47.600,374.859 47.428,374.989 47.218 C 375.319 46.684,373.339 45.461,372.603 45.743 C 372.271 45.871,372.000 45.801,372.000 45.587 C 372.000 45.374,371.760 45.200,371.467 45.200 C 371.173 45.200,370.933 45.470,370.933 45.800 M308.800 52.257 C 308.250 52.332,304.920 52.557,301.400 52.756 C 295.458 53.093,289.639 53.874,285.800 54.850 C 282.385 55.719,276.256 56.328,268.203 56.600 C 258.565 56.926,256.505 57.415,253.800 60.024 C 248.095 65.524,245.200 68.484,245.200 68.817 C 245.200 69.028,244.954 69.200,244.654 69.200 C 244.354 69.200,243.633 69.887,243.051 70.727 C 242.070 72.142,241.580 73.526,240.300 78.500 C 240.031 79.545,239.621 80.400,239.390 80.400 C 238.628 80.400,236.422 84.572,236.002 86.808 C 235.221 90.968,234.446 93.095,233.635 93.307 C 232.578 93.583,230.774 97.671,230.506 100.397 C 230.249 103.011,229.629 104.368,228.103 105.652 C 226.935 106.636,225.200 111.056,225.200 113.048 C 225.200 114.430,224.090 116.705,222.628 118.321 C 221.476 119.594,220.039 123.779,219.406 127.701 C 219.272 128.527,218.894 129.427,218.565 129.701 C 216.083 131.769,215.746 132.428,214.811 137.031 C 214.300 139.544,213.774 141.600,213.641 141.601 C 212.639 141.605,208.904 146.286,208.384 148.190 C 208.153 149.036,206.401 144.094,206.399 142.589 C 206.398 142.155,206.038 141.211,205.599 140.490 C 205.159 139.770,204.800 138.924,204.800 138.610 C 204.800 138.296,204.549 137.896,204.241 137.720 C 203.384 137.229,202.106 134.836,201.220 132.063 C 200.333 129.285,199.438 127.506,198.170 126.000 C 197.708 125.450,196.920 123.830,196.420 122.400 C 195.240 119.022,193.823 116.181,192.588 114.713 C 192.045 114.067,191.600 113.183,191.600 112.747 C 191.600 112.312,191.253 111.195,190.829 110.264 C 190.405 109.334,189.939 108.097,189.793 107.516 C 189.648 106.936,188.941 105.772,188.223 104.930 C 187.505 104.089,186.694 102.680,186.420 101.800 C 186.145 100.920,185.579 99.534,185.161 98.721 C 184.742 97.907,184.400 96.905,184.400 96.493 C 184.400 96.081,183.799 95.037,183.065 94.172 C 182.330 93.307,181.408 91.700,181.015 90.600 C 180.623 89.500,179.964 87.837,179.551 86.904 C 179.138 85.972,178.800 84.980,178.800 84.700 C 178.800 84.421,178.314 83.667,177.719 83.026 C 177.124 82.385,176.140 80.808,175.532 79.523 C 174.924 78.237,174.151 77.079,173.813 76.950 C 173.476 76.820,173.200 76.547,173.200 76.343 C 173.200 75.642,165.399 68.190,163.340 66.924 C 158.566 63.988,142.230 62.862,137.515 65.144 C 135.558 66.092,129.350 67.578,127.292 67.591 C 125.510 67.603,120.339 69.449,119.600 70.338 C 118.971 71.094,115.212 72.068,110.000 72.826 C 106.850 73.284,103.816 74.397,101.800 75.834 C 100.937 76.450,99.028 76.942,95.000 77.587 C 89.321 78.497,84.755 80.098,84.276 81.347 C 84.156 81.659,83.213 82.337,82.181 82.853 C 81.148 83.368,79.920 84.314,79.452 84.954 C 78.983 85.594,77.790 86.892,76.800 87.838 C 73.140 91.335,70.012 94.824,69.284 96.221 C 68.124 98.449,68.793 119.200,70.026 119.200 C 70.498 119.200,73.200 123.134,73.200 123.821 C 73.200 124.828,74.258 126.532,75.515 127.550 C 76.216 128.117,77.155 129.635,77.845 131.314 C 78.480 132.862,79.687 134.862,80.527 135.758 C 81.863 137.183,82.425 138.066,84.050 141.295 C 84.243 141.677,84.400 142.233,84.400 142.530 C 84.400 142.828,85.106 143.725,85.969 144.523 C 86.832 145.322,87.657 146.386,87.802 146.888 C 88.465 149.184,90.319 152.344,91.884 153.848 C 92.868 154.793,93.600 155.866,93.600 156.362 C 93.600 157.660,95.375 160.828,96.935 162.315 C 97.694 163.038,98.514 164.163,98.758 164.815 C 99.001 165.467,99.413 166.585,99.673 167.300 C 99.933 168.015,100.793 169.230,101.584 170.000 C 102.375 170.770,103.444 172.390,103.959 173.600 C 105.506 177.234,106.047 178.131,107.643 179.700 C 108.627 180.668,109.383 181.920,109.772 183.229 C 110.112 184.375,111.099 186.124,112.039 187.247 C 113.875 189.439,115.014 191.465,115.611 193.600 C 115.866 194.510,116.567 195.415,117.616 196.188 C 118.503 196.841,119.329 197.831,119.452 198.388 C 119.575 198.944,120.019 200.163,120.438 201.096 C 120.857 202.028,121.202 202.928,121.204 203.096 C 121.206 203.263,122.106 204.343,123.204 205.495 C 124.302 206.648,125.200 207.930,125.200 208.345 C 125.200 209.315,127.062 212.654,127.964 213.302 C 128.346 213.576,129.158 214.880,129.771 216.200 C 130.383 217.520,131.090 219.037,131.342 219.572 C 131.594 220.107,132.422 221.187,133.183 221.972 C 134.480 223.311,136.000 225.972,136.000 226.902 C 136.000 227.445,138.684 231.484,139.313 231.887 C 139.888 232.256,141.595 235.641,141.611 236.444 C 141.617 236.750,142.425 237.900,143.407 239.000 C 144.389 240.100,145.194 241.273,145.196 241.607 C 145.198 241.941,145.650 242.877,146.200 243.686 C 146.750 244.495,147.200 245.488,147.200 245.892 C 147.200 246.295,148.009 247.340,148.997 248.213 C 149.985 249.086,150.796 250.070,150.799 250.400 C 150.802 250.730,151.047 251.450,151.344 252.000 C 151.640 252.550,152.367 253.900,152.959 255.000 C 153.551 256.100,154.448 257.385,154.953 257.856 C 155.457 258.326,156.281 259.811,156.783 261.156 C 157.286 262.500,157.856 263.600,158.049 263.600 C 158.242 263.600,158.400 263.794,158.400 264.031 C 158.400 264.268,158.895 264.964,159.500 265.578 C 160.531 266.625,160.942 267.334,162.700 271.100 C 163.085 271.925,163.535 272.660,163.700 272.733 C 163.865 272.807,164.000 273.038,164.000 273.247 C 164.000 273.456,164.620 274.247,165.379 275.005 C 166.266 275.893,167.085 277.349,167.676 279.092 L 168.594 281.800 168.687 347.755 C 168.739 384.031,168.874 414.002,168.986 414.357 C 169.099 414.713,169.996 415.784,170.980 416.737 C 171.964 417.690,172.890 418.859,173.038 419.335 C 173.186 419.811,173.441 420.290,173.604 420.400 C 176.495 422.351,178.800 424.570,178.800 425.402 C 178.800 425.701,179.160 426.060,179.600 426.200 C 180.040 426.340,180.400 426.608,180.400 426.796 C 180.400 428.225,211.896 428.895,221.400 427.668 C 228.529 426.747,233.847 425.919,236.400 425.332 C 242.432 423.946,244.018 423.690,248.200 423.429 C 253.442 423.102,257.905 422.470,258.975 421.903 C 260.015 421.351,260.346 421.063,263.806 417.700 C 265.448 416.105,266.973 414.800,267.195 414.800 C 267.418 414.800,267.600 414.551,267.600 414.246 C 267.600 413.941,268.050 413.397,268.600 413.037 C 269.150 412.676,269.600 412.207,269.600 411.994 C 269.600 411.781,270.107 411.110,270.727 410.503 C 273.436 407.850,273.196 414.736,273.234 338.611 C 273.252 300.765,273.415 268.810,273.596 267.600 C 274.723 260.046,275.724 256.908,277.677 254.800 C 278.620 253.782,280.132 249.517,280.591 246.575 C 280.773 245.411,281.350 244.408,282.622 243.041 C 283.600 241.992,284.400 240.846,284.400 240.495 C 284.400 240.144,284.749 238.764,285.175 237.428 C 285.601 236.093,286.047 234.536,286.165 233.969 C 286.284 233.402,286.840 232.412,287.402 231.769 C 289.335 229.556,289.857 228.472,290.184 225.989 C 290.315 224.994,290.687 223.668,291.011 223.044 C 291.335 222.419,291.600 221.673,291.600 221.385 C 291.600 221.097,292.019 220.353,292.531 219.731 C 293.762 218.235,295.200 215.174,295.200 214.048 C 295.200 213.553,295.650 212.165,296.200 210.963 C 296.750 209.760,297.200 208.540,297.200 208.250 C 297.200 207.961,297.574 207.386,298.031 206.972 C 299.057 206.043,300.290 203.389,301.049 200.475 C 301.762 197.737,302.673 195.737,303.874 194.269 C 304.384 193.647,304.800 192.916,304.800 192.644 C 304.800 192.373,305.160 191.405,305.600 190.494 C 306.040 189.584,306.400 188.443,306.400 187.959 C 306.400 186.984,308.198 182.999,309.138 181.892 C 309.716 181.210,311.331 177.094,311.998 174.600 C 312.592 172.384,313.275 170.800,313.639 170.800 C 313.838 170.800,314.000 170.552,314.000 170.249 C 314.000 169.946,314.265 169.478,314.589 169.209 C 314.914 168.940,315.291 168.122,315.428 167.391 C 315.565 166.660,316.110 165.208,316.639 164.163 C 317.167 163.119,317.600 161.957,317.600 161.581 C 317.600 160.736,318.668 158.123,319.090 157.937 C 319.793 157.627,323.200 149.488,323.200 148.120 C 323.200 147.711,324.009 146.121,324.997 144.588 C 325.986 143.055,326.796 141.519,326.797 141.176 C 326.799 140.833,327.250 139.403,327.800 138.000 C 328.350 136.597,328.800 135.043,328.800 134.548 C 328.800 134.052,328.987 133.531,329.216 133.390 C 330.153 132.811,331.569 129.951,332.970 125.807 C 333.787 123.392,334.604 121.232,334.785 121.008 C 335.627 119.969,338.000 115.154,338.000 114.486 C 338.000 113.240,339.818 108.450,340.653 107.495 C 341.887 106.084,343.172 103.101,343.642 100.554 C 344.135 97.886,344.949 96.069,346.039 95.200 C 346.453 94.870,347.346 93.008,348.024 91.062 L 349.257 87.523 349.129 76.862 C 348.982 64.715,348.866 64.234,345.653 62.455 C 344.714 61.936,343.792 61.104,343.603 60.608 C 343.142 59.395,341.718 57.947,339.909 56.850 C 339.089 56.352,338.189 55.470,337.909 54.888 C 336.563 52.089,336.034 51.993,322.241 52.060 C 315.398 52.093,309.350 52.182,308.800 52.257 M335.060 57.436 C 335.433 58.005,336.698 59.013,337.869 59.674 C 339.041 60.335,340.000 61.160,340.000 61.507 C 340.000 62.351,343.429 65.600,344.320 65.600 C 346.588 65.600,346.502 88.861,344.231 89.733 C 343.884 89.866,343.600 90.326,343.600 90.754 C 343.600 91.183,343.465 91.593,343.300 91.667 C 342.786 91.895,341.600 94.285,341.600 95.093 C 341.600 96.369,339.725 101.319,338.913 102.188 C 337.850 103.325,336.435 106.511,336.008 108.730 C 335.431 111.724,334.472 114.042,333.398 115.037 C 332.849 115.546,332.400 116.204,332.400 116.501 C 332.400 116.797,332.244 117.211,332.053 117.420 C 331.518 118.006,330.400 121.619,330.397 122.771 C 330.395 123.800,329.603 125.247,327.930 127.280 C 327.075 128.319,325.257 133.119,325.219 134.439 C 325.199 135.111,324.471 136.600,323.182 138.600 C 321.939 140.531,321.312 142.009,320.385 145.200 C 319.275 149.024,318.520 150.800,318.006 150.800 C 317.783 150.800,317.600 151.048,317.600 151.351 C 317.600 151.654,317.360 152.102,317.066 152.345 C 316.772 152.589,316.300 153.556,316.017 154.494 C 314.327 160.096,313.490 162.394,312.987 162.811 C 312.179 163.482,310.000 168.227,310.000 169.316 C 310.000 169.819,309.640 170.937,309.200 171.800 C 308.760 172.663,308.400 173.617,308.400 173.920 C 308.400 174.224,308.052 174.771,307.626 175.136 C 306.817 175.830,304.800 180.310,304.800 181.414 C 304.800 181.764,304.350 183.035,303.800 184.237 C 303.250 185.440,302.800 186.516,302.800 186.628 C 302.800 186.740,302.414 187.354,301.943 187.992 C 301.043 189.208,299.786 192.337,299.155 194.931 C 298.950 195.773,298.328 197.303,297.773 198.331 C 295.626 202.309,295.255 203.068,294.441 205.153 C 293.978 206.338,293.600 207.570,293.600 207.893 C 293.600 208.484,292.431 211.229,292.021 211.600 C 291.339 212.217,289.193 217.363,287.625 222.139 C 287.347 222.986,286.620 224.426,286.010 225.339 C 285.400 226.253,284.773 227.450,284.618 228.000 C 284.463 228.550,283.973 229.799,283.530 230.775 C 283.088 231.751,282.628 233.191,282.510 233.975 C 282.391 234.759,281.868 235.973,281.347 236.673 C 280.826 237.374,280.400 238.169,280.400 238.442 C 280.400 238.714,280.145 239.221,279.832 239.569 C 279.199 240.273,276.800 246.948,276.800 248.006 C 276.800 248.378,276.395 249.131,275.900 249.677 C 274.761 250.935,273.645 253.071,273.205 254.833 C 272.681 256.931,270.963 261.522,270.487 262.095 C 268.527 264.457,268.624 260.876,268.506 334.626 C 268.378 414.164,268.897 405.853,263.741 410.922 C 262.469 412.173,258.873 415.970,256.938 418.105 C 255.342 419.867,254.932 419.940,244.200 420.367 C 234.760 420.742,225.651 421.936,222.197 423.251 C 221.096 423.671,218.578 424.198,216.602 424.422 C 214.626 424.647,211.837 425.000,210.404 425.207 C 205.876 425.863,186.694 425.706,185.346 425.002 C 184.716 424.674,183.916 424.404,183.568 424.402 C 183.220 424.401,182.346 423.579,181.626 422.576 C 179.956 420.251,178.505 418.800,177.849 418.800 C 177.566 418.800,176.735 417.855,176.002 416.700 C 175.270 415.545,174.430 414.316,174.136 413.969 C 173.696 413.450,173.584 401.667,173.501 347.096 L 173.400 280.852 172.342 279.726 C 171.398 278.721,169.600 275.323,169.600 274.543 C 169.600 274.181,167.716 271.317,166.738 270.193 C 165.821 269.140,164.202 266.074,163.880 264.784 C 163.741 264.225,162.921 263.065,162.057 262.207 C 161.083 261.238,159.991 259.470,159.175 257.541 C 158.453 255.832,157.288 253.842,156.587 253.117 C 155.885 252.393,154.674 250.419,153.896 248.730 C 153.117 247.042,152.102 245.337,151.640 244.941 C 151.178 244.546,150.800 244.084,150.800 243.916 C 150.800 243.747,150.516 243.277,150.169 242.872 C 149.822 242.467,148.961 240.869,148.256 239.323 C 147.551 237.776,146.323 235.896,145.527 235.145 C 144.651 234.320,143.901 233.119,143.629 232.107 C 143.381 231.187,142.988 230.316,142.756 230.173 C 142.524 230.029,141.995 229.122,141.581 228.156 C 141.167 227.190,140.650 226.400,140.431 226.400 C 139.924 226.400,138.000 223.140,138.000 222.280 C 138.000 221.923,137.230 220.679,136.288 219.516 C 134.291 217.048,132.618 214.239,132.262 212.753 C 132.124 212.177,131.333 211.007,130.505 210.153 C 129.676 209.299,128.114 206.828,127.034 204.662 C 125.953 202.496,124.807 200.624,124.487 200.501 C 124.167 200.378,123.206 198.820,122.351 197.039 C 121.496 195.258,120.160 193.171,119.381 192.402 C 118.603 191.633,117.855 190.562,117.720 190.022 C 117.396 188.733,115.295 184.711,114.678 184.200 C 113.425 183.163,112.000 181.048,112.000 180.227 C 112.000 179.725,111.103 178.114,110.006 176.647 C 108.097 174.093,107.658 173.348,105.573 169.130 C 105.065 168.101,104.278 167.087,103.825 166.876 C 103.327 166.644,102.207 164.817,101.000 162.267 C 99.900 159.943,98.640 157.841,98.200 157.596 C 97.760 157.351,96.877 155.947,96.237 154.475 C 95.598 153.004,94.743 151.501,94.337 151.136 C 93.932 150.771,93.600 150.286,93.600 150.059 C 93.600 149.831,93.271 149.410,92.869 149.123 C 92.129 148.594,90.000 144.337,90.000 143.388 C 90.000 143.104,89.188 142.098,88.196 141.153 C 87.203 140.207,86.233 138.886,86.039 138.216 C 85.497 136.346,83.563 133.059,81.900 131.186 C 81.075 130.256,80.400 129.202,80.400 128.842 C 80.400 127.902,78.919 125.273,77.820 124.263 C 74.527 121.238,73.526 117.055,73.455 106.028 L 73.400 97.456 74.400 96.243 C 78.799 90.910,85.875 84.681,88.274 84.031 C 89.113 83.804,90.430 83.195,91.200 82.679 C 93.167 81.360,95.775 80.400,97.388 80.400 C 100.146 80.400,107.652 78.436,108.782 77.419 C 109.970 76.350,113.514 75.254,117.061 74.858 C 119.028 74.638,121.349 74.191,122.219 73.863 C 123.088 73.536,124.282 73.163,124.872 73.033 C 125.462 72.904,126.248 72.495,126.618 72.124 C 128.581 70.162,133.437 69.474,146.550 69.301 C 161.107 69.109,160.103 68.936,163.421 72.206 C 164.869 73.633,166.210 74.800,166.402 74.800 C 166.594 74.800,167.316 75.587,168.006 76.549 C 168.697 77.511,169.654 78.517,170.131 78.785 C 171.529 79.567,172.800 81.429,173.342 83.486 C 173.619 84.539,174.375 86.196,175.023 87.168 C 177.125 90.326,178.041 92.159,178.624 94.378 C 178.939 95.576,179.693 97.265,180.298 98.131 C 180.904 98.997,181.719 100.177,182.108 100.753 C 182.497 101.329,183.280 103.273,183.847 105.073 C 184.518 107.204,185.358 108.908,186.254 109.955 C 187.151 111.003,188.100 112.928,188.978 115.481 C 190.147 118.880,190.863 120.133,193.010 122.540 C 193.236 122.793,193.623 123.900,193.870 125.000 C 194.572 128.123,195.363 129.913,196.660 131.311 C 198.435 133.224,199.200 134.629,199.200 135.974 C 199.200 137.451,200.967 141.425,201.759 141.729 C 202.848 142.147,204.365 145.357,204.633 147.811 C 204.913 150.379,206.319 153.315,207.597 153.998 C 208.441 154.450,212.000 151.386,212.000 150.208 C 212.000 149.893,212.450 149.186,213.000 148.636 C 213.550 148.086,214.000 147.467,214.000 147.261 C 214.000 147.055,214.240 146.794,214.532 146.681 C 215.177 146.434,217.041 141.424,217.599 138.440 C 217.876 136.956,218.443 135.742,219.410 134.562 C 220.763 132.911,223.183 126.555,223.204 124.600 C 223.214 123.593,223.606 123.013,224.500 122.683 C 224.885 122.541,225.200 122.149,225.200 121.813 C 225.200 121.476,225.373 121.200,225.584 121.200 C 225.795 121.200,226.178 120.435,226.434 119.500 C 228.171 113.162,228.933 110.926,229.535 110.400 C 230.879 109.226,232.158 106.625,232.450 104.472 C 232.737 102.354,234.938 97.200,235.554 97.200 C 236.114 97.200,237.631 93.665,237.991 91.521 C 238.522 88.365,239.176 86.740,240.470 85.364 C 241.785 83.966,243.579 79.293,243.592 77.231 C 243.598 76.137,243.961 75.517,245.400 74.138 C 246.390 73.190,247.201 72.275,247.202 72.107 C 247.206 71.509,251.397 67.600,252.034 67.600 C 252.206 67.600,252.460 67.243,252.598 66.806 C 252.887 65.897,255.070 63.600,255.645 63.600 C 256.198 63.600,258.010 62.428,259.400 61.171 L 260.600 60.085 269.200 59.887 C 278.299 59.676,290.906 58.803,300.200 57.738 C 303.280 57.385,306.970 56.966,308.400 56.805 C 309.830 56.645,316.261 56.488,322.691 56.457 L 334.382 56.400 335.060 57.436 M376.187 61.726 C 376.016 63.307,375.798 65.050,375.704 65.600 C 375.609 66.150,375.451 73.605,375.351 82.167 C 375.150 99.379,375.254 98.760,372.571 98.787 C 370.087 98.813,368.873 103.488,370.450 106.950 C 371.020 108.201,374.162 108.392,375.130 107.234 C 375.549 106.732,375.599 106.725,375.371 107.200 C 375.135 107.690,375.182 107.707,375.627 107.294 C 376.333 106.639,376.377 105.859,376.446 92.800 C 376.478 86.750,376.616 82.520,376.752 83.400 L 377.000 85.000 377.683 82.200 C 378.058 80.660,378.571 77.690,378.822 75.600 C 379.355 71.159,379.578 70.632,379.657 73.633 C 379.712 75.760,379.718 75.771,379.985 74.200 L 380.256 72.600 380.461 74.200 C 380.573 75.080,380.670 73.370,380.676 70.400 C 380.683 67.036,380.578 65.603,380.400 66.600 C 380.121 68.157,380.112 68.165,380.057 66.887 C 380.026 66.165,379.728 64.922,379.395 64.126 C 378.656 62.357,378.904 61.899,379.753 63.465 C 380.352 64.571,380.368 64.576,380.384 63.647 C 380.394 63.022,379.727 62.031,378.449 60.773 L 376.498 58.852 376.187 61.726 M201.200 61.934 C 201.200 62.660,201.453 63.211,201.857 63.367 C 202.761 63.714,202.887 63.481,202.436 62.294 C 201.850 60.753,201.200 60.564,201.200 61.934 M201.067 63.867 C 200.545 64.389,200.810 64.890,201.364 64.430 C 201.754 64.106,202.010 64.092,202.190 64.384 C 202.334 64.617,202.035 64.974,201.526 65.178 C 200.834 65.456,200.777 65.556,201.300 65.575 C 202.074 65.603,202.079 65.614,202.197 67.600 C 202.243 68.370,202.415 70.819,202.579 73.043 L 202.878 77.085 204.539 76.996 C 206.315 76.901,208.818 76.072,207.471 76.025 C 206.809 76.002,206.800 75.943,207.371 75.371 C 208.095 74.648,208.167 72.992,207.606 70.032 C 207.128 67.511,206.466 66.786,204.389 66.508 C 202.972 66.318,202.800 66.175,202.800 65.190 C 202.800 64.552,202.533 63.983,202.167 63.843 C 201.384 63.542,201.391 63.542,201.067 63.867 M377.569 77.969 C 377.285 79.078,376.975 79.909,376.881 79.814 C 376.787 79.720,376.930 78.724,377.200 77.600 C 377.470 76.476,377.779 75.646,377.888 75.755 C 377.997 75.864,377.853 76.860,377.569 77.969 M378.901 80.600 C 378.905 81.480,378.987 81.793,379.083 81.295 C 379.179 80.798,379.175 80.078,379.075 79.695 C 378.975 79.313,378.896 79.720,378.901 80.600 M378.800 97.019 C 378.800 97.360,378.324 98.080,377.742 98.619 C 376.645 99.636,376.889 99.963,378.073 99.063 C 378.734 98.560,379.521 96.400,379.043 96.400 C 378.910 96.400,378.800 96.679,378.800 97.019 M370.400 110.400 C 370.070 110.613,368.855 110.791,367.700 110.794 C 366.186 110.798,365.600 110.954,365.600 111.351 C 365.600 111.654,365.314 112.140,364.964 112.430 C 364.452 112.855,364.383 113.391,364.614 115.179 C 365.137 119.228,364.996 120.586,363.954 121.557 C 363.489 121.991,362.409 122.463,361.554 122.608 C 360.141 122.847,359.997 122.985,359.970 124.135 C 359.954 124.831,359.845 125.850,359.728 126.400 C 359.376 128.053,359.379 131.270,359.735 133.480 L 360.070 135.560 357.593 135.680 L 355.116 135.800 354.515 137.583 C 353.934 139.307,353.953 140.509,354.629 144.690 C 354.939 146.605,354.163 147.200,351.354 147.200 C 349.446 147.200,348.729 148.932,348.655 153.727 C 348.596 157.538,348.290 158.111,346.011 158.683 C 344.374 159.094,343.630 160.360,343.593 162.800 C 343.493 169.278,342.886 171.180,340.914 171.194 C 339.213 171.206,337.973 174.661,338.052 179.165 C 338.118 182.893,337.847 183.367,335.384 183.829 C 333.428 184.196,332.400 186.570,332.400 190.721 C 332.400 194.102,331.808 195.200,329.986 195.200 C 328.514 195.200,327.656 197.316,327.368 201.655 C 327.042 206.583,326.862 207.011,324.937 207.467 C 323.289 207.856,323.006 208.564,321.816 215.281 C 321.223 218.632,321.000 219.200,320.276 219.200 C 318.461 219.202,317.123 222.231,316.643 227.419 C 316.383 230.240,315.677 231.605,314.340 231.872 C 313.025 232.135,312.003 233.534,311.992 235.086 C 311.961 239.513,310.104 244.606,308.812 243.807 C 307.602 243.059,306.322 247.619,306.434 252.278 C 306.528 256.161,306.645 255.930,304.514 256.055 C 302.454 256.177,301.441 258.465,301.008 263.978 C 300.722 267.613,300.031 268.800,298.203 268.800 C 296.092 268.800,295.955 271.358,296.558 299.400 C 297.221 330.214,296.997 411.308,296.238 415.255 C 295.920 416.904,294.973 418.036,293.553 418.461 C 292.321 418.831,291.993 419.147,291.796 420.158 C 291.663 420.841,291.400 421.760,291.212 422.200 C 291.024 422.640,290.676 424.059,290.438 425.354 C 290.009 427.686,289.237 428.762,287.974 428.787 C 287.629 428.794,286.965 429.479,286.499 430.310 C 285.244 432.542,284.293 433.505,283.187 433.661 C 282.436 433.767,281.913 434.374,281.000 436.200 C 280.340 437.520,279.415 438.769,278.945 438.975 C 278.267 439.273,278.107 439.660,278.168 440.851 C 278.210 441.676,278.099 442.261,277.922 442.152 C 277.745 442.042,277.600 442.214,277.600 442.534 C 277.600 443.397,276.729 443.583,273.860 443.331 C 271.920 443.160,270.952 443.265,269.976 443.752 C 269.262 444.108,268.435 444.400,268.139 444.400 C 267.842 444.400,267.600 444.749,267.600 445.176 C 267.600 445.603,267.417 446.066,267.193 446.204 C 266.970 446.342,266.891 446.623,267.017 446.828 C 267.144 447.032,267.069 447.200,266.852 447.200 C 266.635 447.200,266.193 447.464,265.870 447.787 C 264.464 449.193,256.917 449.610,243.730 449.009 C 233.384 448.538,227.551 449.348,227.055 451.325 C 226.500 453.533,224.014 454.100,214.200 454.258 C 188.433 454.671,184.099 454.767,183.000 454.950 C 182.340 455.060,180.874 455.188,179.742 455.235 L 177.684 455.321 178.082 456.463 C 178.586 457.908,180.207 459.200,181.517 459.200 C 182.384 459.200,182.283 459.071,180.790 458.282 C 179.836 457.777,178.969 457.108,178.865 456.794 C 178.760 456.480,179.257 456.713,179.968 457.312 C 180.680 457.911,182.013 458.524,182.931 458.675 C 184.461 458.926,184.517 458.976,183.600 459.269 C 182.986 459.465,183.588 459.514,185.159 459.394 C 186.566 459.287,190.706 459.164,194.359 459.121 C 200.734 459.045,200.824 459.033,196.600 458.821 L 192.200 458.600 196.800 458.302 C 199.330 458.138,206.530 457.962,212.800 457.911 L 224.200 457.818 212.400 457.600 L 200.600 457.382 212.140 457.291 C 223.663 457.200,227.765 456.691,225.959 455.574 C 225.685 455.405,227.200 455.267,229.327 455.267 C 232.965 455.267,233.169 455.310,232.796 456.007 C 232.578 456.414,232.400 456.950,232.400 457.197 C 232.400 457.911,233.213 457.217,233.615 456.161 C 233.970 455.226,234.100 455.200,238.490 455.190 C 240.971 455.185,243.720 455.013,244.600 454.808 C 245.609 454.573,246.249 454.577,246.333 454.818 C 246.568 455.489,248.400 455.258,248.400 454.557 C 248.400 454.173,248.623 454.000,248.956 454.128 C 250.090 454.563,254.602 452.656,254.575 451.753 C 254.551 450.982,254.663 450.952,256.151 451.330 C 257.396 451.645,257.585 451.795,257.000 452.000 C 256.470 452.186,256.890 452.391,258.424 452.696 C 260.890 453.185,261.569 453.042,259.544 452.459 C 258.805 452.246,258.470 452.047,258.800 452.015 C 259.130 451.984,258.320 451.531,257.000 451.008 C 254.008 449.822,254.718 449.716,258.137 450.838 C 260.612 451.651,260.733 451.655,262.046 450.965 C 262.791 450.574,264.119 450.213,264.998 450.164 L 266.595 450.073 265.475 451.037 C 264.859 451.566,264.581 452.000,264.856 452.000 C 265.131 452.000,265.828 451.548,266.406 450.995 C 267.335 450.104,267.828 449.981,270.728 449.920 C 272.527 449.881,274.000 449.684,274.000 449.482 C 274.000 449.280,274.265 449.216,274.588 449.340 C 275.382 449.645,276.427 448.537,276.115 447.723 C 275.947 447.285,276.019 447.165,276.332 447.358 C 276.589 447.517,276.800 447.469,276.800 447.251 C 276.800 447.032,277.170 446.736,277.623 446.593 C 278.076 446.449,278.611 445.897,278.813 445.366 C 279.127 444.541,279.445 444.400,280.990 444.400 C 281.986 444.400,282.800 444.224,282.800 444.010 C 282.800 443.767,283.151 443.753,283.733 443.975 C 284.429 444.239,284.667 444.190,284.667 443.782 C 284.667 443.481,284.489 443.345,284.272 443.479 C 284.049 443.617,284.002 443.520,284.166 443.255 C 284.325 442.998,284.623 442.891,284.828 443.017 C 285.032 443.144,285.200 443.062,285.200 442.836 C 285.200 442.610,285.470 442.529,285.800 442.655 C 286.130 442.782,286.400 442.701,286.400 442.476 C 286.400 442.251,286.196 441.999,285.946 441.915 C 285.643 441.814,285.694 441.563,286.103 441.154 C 286.439 440.818,286.783 440.196,286.867 439.772 C 286.973 439.235,287.291 439.038,287.910 439.125 C 288.399 439.194,288.800 439.053,288.800 438.811 C 288.800 438.506,289.028 438.494,289.547 438.771 C 290.175 439.107,290.286 439.030,290.247 438.288 C 290.218 437.753,290.437 437.400,290.800 437.393 C 291.130 437.386,291.375 437.070,291.344 436.690 C 291.314 436.311,291.468 436.000,291.688 436.000 C 291.915 436.000,291.977 435.564,291.834 434.991 C 291.656 434.285,291.763 433.912,292.188 433.749 C 292.522 433.621,292.706 433.372,292.597 433.195 C 292.488 433.019,292.743 432.964,293.162 433.074 C 293.621 433.194,294.274 432.926,294.796 432.404 C 295.275 431.925,295.787 431.654,295.933 431.801 C 296.080 431.948,295.775 432.413,295.256 432.834 C 294.736 433.255,294.483 433.600,294.694 433.600 C 295.088 433.600,296.032 432.628,296.601 431.638 C 296.800 431.292,296.769 431.172,296.520 431.326 C 296.281 431.474,296.133 431.106,296.158 430.427 C 296.201 429.253,296.800 429.125,296.800 430.290 C 296.800 430.644,296.911 430.823,297.046 430.687 C 297.182 430.552,297.105 429.902,296.875 429.244 C 296.646 428.586,296.615 427.992,296.807 427.924 C 296.999 427.856,297.194 426.589,297.241 425.108 C 297.324 422.454,297.340 422.420,298.322 422.666 C 298.984 422.833,299.230 422.772,299.053 422.486 C 298.906 422.249,299.169 421.787,299.637 421.459 C 300.154 421.097,300.367 420.671,300.182 420.370 C 299.971 420.030,300.041 419.978,300.406 420.204 C 300.794 420.444,300.865 420.347,300.673 419.845 C 300.522 419.452,300.572 419.259,300.789 419.393 C 300.999 419.523,301.354 419.037,301.580 418.314 C 301.986 417.016,301.988 417.020,301.761 418.586 C 301.635 419.459,301.174 420.674,300.738 421.286 C 300.302 421.899,300.099 422.400,300.287 422.400 C 301.159 422.400,302.178 419.726,302.153 417.500 C 302.139 416.235,302.278 415.200,302.464 415.200 C 302.649 415.200,302.800 412.320,302.800 408.800 C 302.800 405.280,302.665 402.400,302.500 402.400 C 302.335 402.400,302.169 377.549,302.131 347.176 C 302.093 316.803,301.942 291.243,301.796 290.376 C 301.579 289.091,301.647 288.800,302.165 288.800 C 302.877 288.800,303.146 281.396,302.444 281.133 C 302.240 281.057,302.229 280.146,302.420 279.000 C 302.603 277.900,302.763 275.323,302.776 273.273 C 302.800 269.604,302.814 269.550,303.700 269.799 C 304.315 269.972,304.431 269.935,304.066 269.682 C 303.413 269.228,304.600 268.629,305.298 269.061 C 305.539 269.210,305.607 269.135,305.455 268.889 C 305.308 268.651,305.382 268.335,305.621 268.187 C 305.859 268.040,305.961 267.676,305.848 267.380 C 305.705 267.008,305.852 266.920,306.320 267.095 C 306.885 267.307,306.917 267.247,306.510 266.745 C 305.981 266.094,306.506 265.200,307.416 265.200 C 307.727 265.200,307.900 263.647,307.963 260.306 C 308.069 254.653,307.881 255.094,310.221 254.992 C 311.226 254.948,312.262 254.681,312.524 254.398 C 312.894 253.997,312.889 253.945,312.500 254.165 C 312.225 254.320,312.000 254.257,312.000 254.024 C 312.000 253.791,312.234 253.600,312.520 253.600 C 312.890 253.600,313.066 252.766,313.130 250.700 C 313.214 248.023,313.312 247.723,314.414 246.800 C 315.070 246.250,315.606 245.438,315.604 244.996 C 315.602 244.554,316.005 243.940,316.500 243.632 C 317.308 243.129,317.347 243.136,316.881 243.700 C 316.480 244.185,316.472 244.397,316.842 244.626 C 317.149 244.815,317.219 244.755,317.036 244.459 C 316.876 244.199,317.024 243.889,317.372 243.755 C 317.715 243.624,317.883 243.335,317.746 243.113 C 317.610 242.892,317.746 242.537,318.049 242.325 C 318.442 242.050,318.467 241.884,318.134 241.748 C 317.806 241.613,317.777 241.179,318.034 240.281 C 318.235 239.579,318.418 237.924,318.440 236.603 C 318.474 234.523,319.049 231.378,319.160 232.657 C 319.182 232.909,319.495 233.228,319.857 233.366 C 320.409 233.579,320.432 233.521,320.000 233.000 C 319.576 232.489,319.586 232.420,320.057 232.601 C 320.840 232.901,322.515 231.275,322.218 230.503 C 322.022 229.992,322.086 229.973,322.591 230.392 C 323.391 231.057,323.377 230.634,322.571 229.829 C 322.000 229.257,322.009 229.200,322.671 229.200 C 323.149 229.200,323.413 228.890,323.438 228.300 C 323.459 227.805,323.527 225.960,323.589 224.200 C 323.651 222.440,323.904 220.740,324.151 220.423 C 324.451 220.038,324.456 219.933,324.167 220.106 C 323.928 220.248,323.733 220.111,323.733 219.800 C 323.733 219.489,323.864 219.316,324.025 219.415 C 324.185 219.514,324.419 219.326,324.546 218.998 C 324.672 218.669,325.006 218.403,325.287 218.406 C 325.646 218.410,325.620 218.529,325.200 218.800 C 324.780 219.071,324.754 219.190,325.113 219.194 C 325.394 219.197,325.730 218.925,325.859 218.590 C 326.024 218.161,326.239 218.100,326.580 218.383 C 326.925 218.670,327.290 218.527,327.833 217.894 C 328.718 216.862,328.662 217.239,328.740 211.787 C 328.800 207.544,329.417 206.035,330.434 207.642 C 330.699 208.060,330.789 207.971,330.794 207.286 C 330.799 206.463,330.890 206.420,331.700 206.851 C 332.526 207.292,332.553 207.274,332.032 206.643 C 331.542 206.049,331.542 205.972,332.032 206.077 C 332.351 206.146,332.546 205.951,332.477 205.632 C 332.372 205.142,332.449 205.142,333.043 205.632 C 333.674 206.153,333.692 206.126,333.251 205.300 C 332.943 204.722,332.920 204.400,333.186 204.400 C 333.414 204.400,333.600 204.070,333.600 203.667 C 333.600 203.263,333.725 202.808,333.878 202.655 C 334.247 202.287,334.346 201.523,334.441 198.320 C 334.496 196.447,334.689 195.575,335.081 195.424 C 335.448 195.283,335.539 195.380,335.344 195.705 C 335.147 196.033,335.275 196.015,335.723 195.651 C 336.357 195.137,336.588 195.307,336.425 196.168 C 336.386 196.370,336.635 196.303,336.977 196.019 C 337.668 195.446,337.825 195.014,337.203 195.398 C 336.974 195.540,336.840 195.223,336.888 194.651 C 336.933 194.105,337.114 193.747,337.291 193.856 C 337.468 193.966,337.509 194.223,337.383 194.428 C 337.256 194.632,337.247 194.800,337.362 194.800 C 337.478 194.800,337.776 194.418,338.026 193.952 C 338.338 193.368,338.344 193.187,338.044 193.373 C 337.773 193.540,337.699 193.408,337.847 193.021 C 337.978 192.679,338.471 192.397,338.943 192.394 C 339.574 192.389,339.658 192.298,339.259 192.045 C 338.850 191.786,338.822 191.506,339.145 190.902 C 339.381 190.462,339.599 188.201,339.629 185.877 C 339.673 182.559,339.812 181.604,340.275 181.427 C 341.109 181.106,341.282 181.143,341.010 181.584 C 340.872 181.807,341.294 181.786,342.018 181.534 C 342.703 181.295,343.359 180.852,343.475 180.550 C 343.591 180.247,343.936 180.000,344.243 180.000 C 344.895 180.000,344.996 179.332,344.375 179.125 C 344.094 179.031,344.074 178.647,344.316 177.992 C 344.517 177.446,344.715 175.830,344.756 174.400 C 344.851 171.076,345.065 170.373,345.886 170.688 C 346.361 170.871,346.446 170.786,346.207 170.368 C 345.945 169.909,345.985 169.895,346.420 170.299 C 347.007 170.843,349.200 169.155,349.200 168.158 C 349.200 167.888,349.425 167.576,349.700 167.465 C 350.100 167.304,350.100 167.257,349.700 167.232 C 349.150 167.197,348.993 165.600,349.539 165.600 C 349.726 165.600,349.926 164.295,349.985 162.700 C 350.043 161.105,350.100 159.575,350.112 159.300 C 350.124 159.025,350.474 158.800,350.890 158.800 C 351.307 158.800,351.537 158.978,351.403 159.195 C 351.261 159.424,351.427 159.488,351.796 159.346 C 352.506 159.074,354.186 156.053,353.828 155.695 C 353.703 155.569,353.600 155.671,353.600 155.921 C 353.600 156.171,353.322 156.268,352.983 156.138 C 352.414 155.920,352.512 155.426,353.133 155.380 C 354.965 155.245,355.068 154.966,355.163 149.900 C 355.213 147.212,355.287 144.981,355.327 144.943 C 355.367 144.905,356.030 144.812,356.800 144.737 C 357.570 144.662,358.470 144.322,358.800 143.981 C 359.130 143.641,359.256 143.580,359.081 143.846 C 358.900 144.119,358.970 144.458,359.242 144.626 C 359.529 144.803,359.619 144.755,359.466 144.507 C 359.325 144.278,359.450 143.891,359.745 143.646 C 360.116 143.338,360.292 142.066,360.318 139.501 C 360.338 137.465,360.365 135.294,360.378 134.676 C 360.390 134.034,360.571 133.659,360.800 133.800 C 361.020 133.936,361.200 133.664,361.200 133.195 C 361.200 132.420,361.257 132.400,361.829 132.971 C 362.667 133.810,363.040 133.776,362.349 132.923 C 361.916 132.390,361.912 132.314,362.331 132.566 C 362.664 132.767,363.147 132.579,363.631 132.059 C 364.486 131.141,364.649 130.599,363.938 131.038 C 363.645 131.219,363.585 131.147,363.774 130.842 C 364.002 130.474,364.203 130.471,364.636 130.830 C 365.402 131.465,365.353 131.010,364.571 130.229 C 364.000 129.657,364.013 129.600,364.715 129.600 C 365.409 129.600,365.495 129.267,365.566 126.300 C 365.637 123.331,365.753 122.882,366.722 121.823 L 367.800 120.646 366.748 121.301 L 365.696 121.955 365.748 120.429 C 365.784 119.387,365.959 118.963,366.300 119.094 C 366.870 119.313,366.933 119.668,366.500 120.228 C 366.335 120.442,366.515 120.278,366.900 119.864 C 367.285 119.450,367.600 119.303,367.600 119.538 C 367.600 119.772,368.052 119.512,368.603 118.960 C 369.157 118.407,369.812 118.084,370.065 118.240 C 370.348 118.415,370.414 118.347,370.238 118.062 C 370.073 117.795,370.194 117.600,370.526 117.600 C 370.977 117.600,371.113 116.798,371.169 113.800 C 371.208 111.710,371.186 110.003,371.120 110.006 C 371.054 110.009,370.730 110.187,370.400 110.400 M368.255 118.678 C 367.823 119.111,366.800 119.171,366.800 118.765 C 366.800 118.564,367.190 118.400,367.667 118.400 C 368.143 118.400,368.408 118.525,368.255 118.678 M353.200 156.800 C 353.200 157.020,352.990 157.200,352.733 157.200 C 352.477 157.200,352.385 157.318,352.530 157.463 C 352.938 157.872,352.006 158.777,351.412 158.549 C 351.016 158.397,351.099 158.112,351.742 157.415 C 352.680 156.398,353.200 156.178,353.200 156.800 M56.000 161.200 C 56.000 161.420,56.191 161.600,56.424 161.600 C 56.657 161.600,56.736 161.780,56.600 162.000 C 56.464 162.220,56.554 162.400,56.800 162.400 C 57.046 162.400,57.136 162.580,57.000 162.800 C 56.864 163.020,56.943 163.200,57.176 163.200 C 57.409 163.200,57.600 163.391,57.600 163.624 C 57.600 163.857,57.375 163.912,57.100 163.747 C 56.760 163.543,56.776 163.663,57.149 164.123 C 57.853 164.991,57.891 164.979,57.827 163.900 C 57.728 162.236,56.000 159.683,56.000 161.200 M66.273 175.481 C 66.128 175.717,66.261 176.118,66.569 176.374 C 67.143 176.851,67.959 176.226,67.440 175.707 C 67.308 175.575,67.187 175.722,67.172 176.033 C 67.155 176.369,67.020 176.284,66.841 175.827 C 66.658 175.358,66.434 175.222,66.273 175.481 M66.400 178.000 C 66.400 178.220,66.591 178.400,66.824 178.400 C 67.057 178.400,67.136 178.580,67.000 178.800 C 66.864 179.020,67.078 179.203,67.476 179.206 C 68.025 179.211,68.071 179.294,67.666 179.550 C 67.109 179.904,68.163 180.629,68.963 180.442 C 69.163 180.396,69.475 180.592,69.657 180.879 C 69.839 181.165,69.991 181.209,69.994 180.975 C 69.997 180.742,69.460 180.151,68.800 179.663 C 68.140 179.175,67.600 178.511,67.600 178.188 C 67.600 177.865,67.330 177.600,67.000 177.600 C 66.670 177.600,66.400 177.780,66.400 178.000 M72.800 186.696 C 72.800 186.947,72.989 187.269,73.219 187.412 C 73.511 187.592,73.508 187.829,73.209 188.189 C 72.892 188.571,72.946 188.770,73.415 188.950 C 73.765 189.085,73.946 189.363,73.819 189.570 C 73.691 189.776,73.754 190.048,73.958 190.174 C 74.377 190.433,74.308 189.375,73.878 188.945 C 73.165 188.232,73.704 187.964,74.500 188.635 C 75.305 189.314,75.295 189.267,74.406 188.197 C 73.859 187.539,73.274 186.829,73.106 186.620 C 72.921 186.391,72.800 186.421,72.800 186.696 M74.985 190.378 C 75.032 190.696,75.284 190.998,75.545 191.048 C 75.904 191.118,75.905 191.086,75.549 190.916 C 75.259 190.778,75.443 190.498,76.032 190.183 L 76.984 189.673 75.942 189.737 C 75.284 189.777,74.932 190.013,74.985 190.378 M76.800 194.400 C 76.800 194.620,77.070 194.800,77.400 194.800 C 77.730 194.800,78.000 194.991,78.000 195.224 C 78.000 195.457,77.775 195.516,77.500 195.355 C 77.225 195.194,77.343 195.453,77.762 195.931 C 78.551 196.831,79.033 197.100,78.600 196.400 C 78.464 196.180,78.528 196.000,78.743 196.000 C 78.958 196.000,79.214 196.225,79.312 196.500 C 79.410 196.775,79.613 196.887,79.763 196.749 C 79.913 196.611,79.474 195.936,78.787 195.249 C 77.520 193.982,76.800 193.674,76.800 194.400 M83.841 203.036 C 83.552 203.791,83.859 204.402,84.524 204.394 C 84.863 204.390,84.852 204.294,84.486 204.062 C 84.203 203.882,84.088 203.436,84.229 203.068 C 84.370 202.701,84.396 202.400,84.286 202.400 C 84.176 202.400,83.976 202.686,83.841 203.036 M85.549 204.919 C 86.070 205.565,85.645 205.911,85.055 205.322 C 84.625 204.892,83.567 204.823,83.826 205.242 C 83.952 205.446,84.212 205.516,84.403 205.398 C 84.594 205.280,84.917 205.480,85.120 205.843 C 85.384 206.314,85.572 206.368,85.780 206.032 C 86.003 205.672,86.204 205.672,86.636 206.030 C 86.946 206.287,87.194 206.341,87.187 206.149 C 87.181 205.957,86.686 205.448,86.087 205.019 C 85.231 204.403,85.117 204.382,85.549 204.919 M93.043 219.033 C 92.715 219.886,92.734 220.000,93.200 220.000 C 93.420 220.000,93.614 219.685,93.632 219.300 C 93.650 218.882,93.744 218.801,93.865 219.100 C 93.976 219.375,94.254 219.600,94.482 219.600 C 94.733 219.600,94.701 219.362,94.400 219.000 C 93.761 218.230,93.347 218.240,93.043 219.033 M93.481 220.652 C 93.339 220.795,93.349 221.111,93.505 221.356 C 93.660 221.600,93.791 221.965,93.794 222.167 C 93.797 222.369,94.205 222.564,94.700 222.600 C 95.195 222.636,95.600 222.548,95.600 222.403 C 95.600 221.921,93.745 220.388,93.481 220.652 M99.801 229.150 C 100.023 229.890,99.966 230.027,99.543 229.767 C 99.163 229.534,99.194 229.728,99.647 230.415 C 100.003 230.954,100.633 231.397,101.047 231.398 C 101.461 231.399,101.761 231.608,101.713 231.862 C 101.665 232.116,101.856 232.413,102.138 232.521 C 103.072 232.879,102.688 230.476,101.700 229.785 C 101.205 229.438,100.794 229.300,100.787 229.477 C 100.780 229.655,100.492 229.440,100.146 229.000 C 99.532 228.219,99.524 228.222,99.801 229.150 M102.000 230.600 C 102.590 231.311,101.974 231.414,101.280 230.720 C 100.907 230.347,100.800 230.352,100.800 230.744 C 100.800 231.021,100.620 231.136,100.400 231.000 C 99.740 230.592,99.948 230.000,100.751 230.000 C 101.164 230.000,101.726 230.270,102.000 230.600 M103.687 237.623 C 104.065 237.844,104.556 238.335,104.777 238.713 C 105.117 239.293,105.169 239.241,105.109 238.381 C 105.055 237.594,104.806 237.345,104.019 237.291 C 103.159 237.231,103.107 237.283,103.687 237.623 M315.200 244.869 C 315.200 245.427,314.018 246.800,313.538 246.800 C 312.866 246.800,313.197 244.859,313.900 244.676 C 315.082 244.367,315.200 244.384,315.200 244.869 M108.400 246.000 C 108.400 246.220,108.670 246.400,109.000 246.400 C 109.330 246.400,109.600 246.220,109.600 246.000 C 109.600 245.780,109.330 245.600,109.000 245.600 C 108.670 245.600,108.400 245.780,108.400 246.000 M108.962 247.262 C 108.772 247.569,108.854 247.614,109.206 247.396 C 109.590 247.159,109.666 247.251,109.483 247.728 C 109.212 248.434,110.247 249.219,111.061 248.925 C 111.344 248.824,111.142 248.379,110.543 247.780 C 109.422 246.658,109.349 246.635,108.962 247.262 M114.400 253.200 C 114.933 253.545,114.933 253.589,114.400 253.600 C 113.880 253.611,113.878 253.661,114.381 253.980 C 114.700 254.182,115.114 254.253,115.300 254.138 C 115.720 253.879,114.868 252.798,114.251 252.806 C 114.003 252.809,114.070 252.987,114.400 253.200 M119.762 261.662 C 119.585 261.948,119.652 262.015,119.938 261.838 C 120.192 261.681,120.400 261.733,120.400 261.953 C 120.400 262.173,120.220 262.464,120.000 262.600 C 119.780 262.736,119.603 263.062,119.606 263.324 C 119.610 263.610,119.767 263.561,120.000 263.200 C 120.337 262.678,120.389 262.685,120.394 263.251 C 120.402 264.117,121.438 264.985,121.788 264.419 C 121.931 264.189,122.239 264.000,122.473 264.000 C 122.724 264.000,122.673 264.273,122.349 264.665 C 121.878 265.235,121.886 265.302,122.400 265.132 C 122.730 265.023,123.000 264.678,123.000 264.367 C 123.000 264.055,122.730 263.800,122.400 263.800 C 122.070 263.800,121.481 263.215,121.090 262.500 C 120.308 261.067,120.180 260.986,119.762 261.662 M135.450 290.319 C 135.300 290.562,135.532 290.949,135.965 291.181 C 136.544 291.491,136.828 291.470,137.040 291.101 C 137.198 290.825,137.182 290.732,137.004 290.894 C 136.825 291.055,136.464 290.893,136.201 290.533 C 135.879 290.093,135.633 290.023,135.450 290.319 M140.000 304.800 C 140.000 305.020,140.270 305.200,140.600 305.200 C 140.930 305.200,141.200 305.020,141.200 304.800 C 141.200 304.580,140.930 304.400,140.600 304.400 C 140.270 304.400,140.000 304.580,140.000 304.800 M301.476 325.900 C 301.375 326.285,301.293 325.970,301.293 325.200 C 301.293 324.430,301.375 324.115,301.476 324.500 C 301.576 324.885,301.576 325.515,301.476 325.900 M301.899 349.500 C 301.833 352.965,301.778 350.130,301.778 343.200 C 301.778 336.270,301.833 333.435,301.899 336.900 C 301.966 340.365,301.966 346.035,301.899 349.500 M301.498 372.300 C 301.426 374.445,301.367 372.690,301.367 368.400 C 301.367 364.110,301.426 362.355,301.498 364.500 C 301.570 366.645,301.570 370.155,301.498 372.300 M301.898 392.080 C 301.826 394.126,301.766 392.560,301.765 388.600 C 301.765 384.640,301.824 382.966,301.898 384.880 C 301.971 386.794,301.971 390.034,301.898 392.080 M277.289 445.400 C 276.460 446.509,276.216 446.387,276.556 445.033 C 276.724 444.365,277.005 444.104,277.394 444.253 C 277.893 444.445,277.878 444.613,277.289 445.400 M159.897 448.067 C 160.170 448.401,160.260 448.821,160.097 449.001 C 159.933 449.181,160.010 449.208,160.266 449.062 C 160.522 448.915,160.804 449.012,160.893 449.278 C 161.005 449.615,161.135 449.629,161.323 449.324 C 161.472 449.084,161.100 448.566,160.497 448.174 C 159.699 447.655,159.536 447.626,159.897 448.067 M263.101 451.163 C 262.496 451.551,262.121 451.988,262.267 452.134 C 262.414 452.280,262.203 452.400,261.800 452.400 C 261.397 452.400,261.165 452.499,261.286 452.619 C 261.407 452.740,261.994 452.716,262.591 452.567 C 263.388 452.367,263.533 452.204,263.138 451.953 C 262.842 451.766,262.791 451.609,263.024 451.606 C 263.256 451.603,263.796 451.336,264.224 451.013 C 265.310 450.191,264.434 450.309,263.101 451.163 M224.912 456.048 C 224.396 456.564,218.664 456.691,208.600 456.409 C 202.015 456.225,202.160 456.212,213.200 456.000 C 219.470 455.880,224.771 455.740,224.980 455.691 C 225.189 455.641,225.158 455.802,224.912 456.048 M226.400 456.619 C 225.410 457.146,224.849 457.583,225.153 457.589 C 225.703 457.600,228.400 456.087,228.400 455.767 C 228.400 455.547,228.468 455.518,226.400 456.619 M188.100 459.891 C 188.925 459.978,190.275 459.978,191.100 459.891 C 191.925 459.805,191.250 459.734,189.600 459.734 C 187.950 459.734,187.275 459.805,188.100 459.891 " stroke="none" fill="#848484" fill-rule="evenodd"></path></g></svg><a title="Expérimentations et tests
|
||
" href="/">YannStatic</a></div><!--<button class="button button--secondary button--circle search-button js-search-toggle"><i class="fas fa-search"></i></button>--><!-- <li><button class="button button--secondary button--circle search-button js-search-toggle"><i class="fas fa-search"></i></button></li> -->
|
||
<!-- Champ de recherche -->
|
||
<div id="searchbox" class="search search--dark" style="visibility: visible">
|
||
<div class="main">
|
||
<div class="search__header"></div>
|
||
<div class="search-bar">
|
||
<div class="search-box js-search-box">
|
||
<div class="search-box__icon-search"><i class="fas fa-search"></i></div>
|
||
<input id="search-input" type="text" />
|
||
<!-- <div class="search-box__icon-clear js-icon-clear">
|
||
<a><i class="fas fa-times"></i></a>
|
||
</div> -->
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<!-- Script pointing to search-script.js -->
|
||
<script>/*!
|
||
* Simple-Jekyll-Search
|
||
* Copyright 2015-2020, Christian Fei
|
||
* Licensed under the MIT License.
|
||
*/
|
||
|
||
(function(){
|
||
'use strict'
|
||
|
||
var _$Templater_7 = {
|
||
compile: compile,
|
||
setOptions: setOptions
|
||
}
|
||
|
||
const options = {}
|
||
options.pattern = /\{(.*?)\}/g
|
||
options.template = ''
|
||
options.middleware = function () {}
|
||
|
||
function setOptions (_options) {
|
||
options.pattern = _options.pattern || options.pattern
|
||
options.template = _options.template || options.template
|
||
if (typeof _options.middleware === 'function') {
|
||
options.middleware = _options.middleware
|
||
}
|
||
}
|
||
|
||
function compile (data) {
|
||
return options.template.replace(options.pattern, function (match, prop) {
|
||
const value = options.middleware(prop, data[prop], options.template)
|
||
if (typeof value !== 'undefined') {
|
||
return value
|
||
}
|
||
return data[prop] || match
|
||
})
|
||
}
|
||
|
||
'use strict';
|
||
|
||
function fuzzysearch (needle, haystack) {
|
||
var tlen = haystack.length;
|
||
var qlen = needle.length;
|
||
if (qlen > tlen) {
|
||
return false;
|
||
}
|
||
if (qlen === tlen) {
|
||
return needle === haystack;
|
||
}
|
||
outer: for (var i = 0, j = 0; i < qlen; i++) {
|
||
var nch = needle.charCodeAt(i);
|
||
while (j < tlen) {
|
||
if (haystack.charCodeAt(j++) === nch) {
|
||
continue outer;
|
||
}
|
||
}
|
||
return false;
|
||
}
|
||
return true;
|
||
}
|
||
|
||
var _$fuzzysearch_1 = fuzzysearch;
|
||
|
||
'use strict'
|
||
|
||
/* removed: const _$fuzzysearch_1 = require('fuzzysearch') */;
|
||
|
||
var _$FuzzySearchStrategy_5 = new FuzzySearchStrategy()
|
||
|
||
function FuzzySearchStrategy () {
|
||
this.matches = function (string, crit) {
|
||
return _$fuzzysearch_1(crit.toLowerCase(), string.toLowerCase())
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$LiteralSearchStrategy_6 = new LiteralSearchStrategy()
|
||
|
||
function LiteralSearchStrategy () {
|
||
this.matches = function (str, crit) {
|
||
if (!str) return false
|
||
|
||
str = str.trim().toLowerCase()
|
||
crit = crit.trim().toLowerCase()
|
||
|
||
return crit.split(' ').filter(function (word) {
|
||
return str.indexOf(word) >= 0
|
||
}).length === crit.split(' ').length
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$Repository_4 = {
|
||
put: put,
|
||
clear: clear,
|
||
search: search,
|
||
setOptions: __setOptions_4
|
||
}
|
||
|
||
/* removed: const _$FuzzySearchStrategy_5 = require('./SearchStrategies/FuzzySearchStrategy') */;
|
||
/* removed: const _$LiteralSearchStrategy_6 = require('./SearchStrategies/LiteralSearchStrategy') */;
|
||
|
||
function NoSort () {
|
||
return 0
|
||
}
|
||
|
||
const data = []
|
||
let opt = {}
|
||
|
||
opt.fuzzy = false
|
||
opt.limit = 10
|
||
opt.searchStrategy = opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
|
||
opt.sort = NoSort
|
||
opt.exclude = []
|
||
|
||
function put (data) {
|
||
if (isObject(data)) {
|
||
return addObject(data)
|
||
}
|
||
if (isArray(data)) {
|
||
return addArray(data)
|
||
}
|
||
return undefined
|
||
}
|
||
function clear () {
|
||
data.length = 0
|
||
return data
|
||
}
|
||
|
||
function isObject (obj) {
|
||
return Boolean(obj) && Object.prototype.toString.call(obj) === '[object Object]'
|
||
}
|
||
|
||
function isArray (obj) {
|
||
return Boolean(obj) && Object.prototype.toString.call(obj) === '[object Array]'
|
||
}
|
||
|
||
function addObject (_data) {
|
||
data.push(_data)
|
||
return data
|
||
}
|
||
|
||
function addArray (_data) {
|
||
const added = []
|
||
clear()
|
||
for (let i = 0, len = _data.length; i < len; i++) {
|
||
if (isObject(_data[i])) {
|
||
added.push(addObject(_data[i]))
|
||
}
|
||
}
|
||
return added
|
||
}
|
||
|
||
function search (crit) {
|
||
if (!crit) {
|
||
return []
|
||
}
|
||
return findMatches(data, crit, opt.searchStrategy, opt).sort(opt.sort)
|
||
}
|
||
|
||
function __setOptions_4 (_opt) {
|
||
opt = _opt || {}
|
||
|
||
opt.fuzzy = _opt.fuzzy || false
|
||
opt.limit = _opt.limit || 10
|
||
opt.searchStrategy = _opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
|
||
opt.sort = _opt.sort || NoSort
|
||
opt.exclude = _opt.exclude || []
|
||
}
|
||
|
||
function findMatches (data, crit, strategy, opt) {
|
||
const matches = []
|
||
for (let i = 0; i < data.length && matches.length < opt.limit; i++) {
|
||
const match = findMatchesInObject(data[i], crit, strategy, opt)
|
||
if (match) {
|
||
matches.push(match)
|
||
}
|
||
}
|
||
return matches
|
||
}
|
||
|
||
function findMatchesInObject (obj, crit, strategy, opt) {
|
||
for (const key in obj) {
|
||
if (!isExcluded(obj[key], opt.exclude) && strategy.matches(obj[key], crit)) {
|
||
return obj
|
||
}
|
||
}
|
||
}
|
||
|
||
function isExcluded (term, excludedTerms) {
|
||
for (let i = 0, len = excludedTerms.length; i < len; i++) {
|
||
const excludedTerm = excludedTerms[i]
|
||
if (new RegExp(excludedTerm).test(term)) {
|
||
return true
|
||
}
|
||
}
|
||
return false
|
||
}
|
||
|
||
/* globals ActiveXObject:false */
|
||
|
||
'use strict'
|
||
|
||
var _$JSONLoader_2 = {
|
||
load: load
|
||
}
|
||
|
||
function load (location, callback) {
|
||
const xhr = getXHR()
|
||
xhr.open('GET', location, true)
|
||
xhr.onreadystatechange = createStateChangeListener(xhr, callback)
|
||
xhr.send()
|
||
}
|
||
|
||
function createStateChangeListener (xhr, callback) {
|
||
return function () {
|
||
if (xhr.readyState === 4 && xhr.status === 200) {
|
||
try {
|
||
callback(null, JSON.parse(xhr.responseText))
|
||
} catch (err) {
|
||
callback(err, null)
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
function getXHR () {
|
||
return window.XMLHttpRequest ? new window.XMLHttpRequest() : new ActiveXObject('Microsoft.XMLHTTP')
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$OptionsValidator_3 = function OptionsValidator (params) {
|
||
if (!validateParams(params)) {
|
||
throw new Error('-- OptionsValidator: required options missing')
|
||
}
|
||
|
||
if (!(this instanceof OptionsValidator)) {
|
||
return new OptionsValidator(params)
|
||
}
|
||
|
||
const requiredOptions = params.required
|
||
|
||
this.getRequiredOptions = function () {
|
||
return requiredOptions
|
||
}
|
||
|
||
this.validate = function (parameters) {
|
||
const errors = []
|
||
requiredOptions.forEach(function (requiredOptionName) {
|
||
if (typeof parameters[requiredOptionName] === 'undefined') {
|
||
errors.push(requiredOptionName)
|
||
}
|
||
})
|
||
return errors
|
||
}
|
||
|
||
function validateParams (params) {
|
||
if (!params) {
|
||
return false
|
||
}
|
||
return typeof params.required !== 'undefined' && params.required instanceof Array
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$utils_9 = {
|
||
merge: merge,
|
||
isJSON: isJSON
|
||
}
|
||
|
||
function merge (defaultParams, mergeParams) {
|
||
const mergedOptions = {}
|
||
for (const option in defaultParams) {
|
||
mergedOptions[option] = defaultParams[option]
|
||
if (typeof mergeParams[option] !== 'undefined') {
|
||
mergedOptions[option] = mergeParams[option]
|
||
}
|
||
}
|
||
return mergedOptions
|
||
}
|
||
|
||
function isJSON (json) {
|
||
try {
|
||
if (json instanceof Object && JSON.parse(JSON.stringify(json))) {
|
||
return true
|
||
}
|
||
return false
|
||
} catch (err) {
|
||
return false
|
||
}
|
||
}
|
||
|
||
var _$src_8 = {};
|
||
(function (window) {
|
||
'use strict'
|
||
|
||
let options = {
|
||
searchInput: null,
|
||
resultsContainer: null,
|
||
json: [],
|
||
success: Function.prototype,
|
||
searchResultTemplate: '<li><a href="{url}" title="{desc}">{title}</a></li>',
|
||
templateMiddleware: Function.prototype,
|
||
sortMiddleware: function () {
|
||
return 0
|
||
},
|
||
noResultsText: 'No results found',
|
||
limit: 10,
|
||
fuzzy: false,
|
||
debounceTime: null,
|
||
exclude: []
|
||
}
|
||
|
||
let debounceTimerHandle
|
||
const debounce = function (func, delayMillis) {
|
||
if (delayMillis) {
|
||
clearTimeout(debounceTimerHandle)
|
||
debounceTimerHandle = setTimeout(func, delayMillis)
|
||
} else {
|
||
func.call()
|
||
}
|
||
}
|
||
|
||
const requiredOptions = ['searchInput', 'resultsContainer', 'json']
|
||
|
||
/* removed: const _$Templater_7 = require('./Templater') */;
|
||
/* removed: const _$Repository_4 = require('./Repository') */;
|
||
/* removed: const _$JSONLoader_2 = require('./JSONLoader') */;
|
||
const optionsValidator = _$OptionsValidator_3({
|
||
required: requiredOptions
|
||
})
|
||
/* removed: const _$utils_9 = require('./utils') */;
|
||
|
||
window.SimpleJekyllSearch = function (_options) {
|
||
const errors = optionsValidator.validate(_options)
|
||
if (errors.length > 0) {
|
||
throwError('You must specify the following required options: ' + requiredOptions)
|
||
}
|
||
|
||
options = _$utils_9.merge(options, _options)
|
||
|
||
_$Templater_7.setOptions({
|
||
template: options.searchResultTemplate,
|
||
middleware: options.templateMiddleware
|
||
})
|
||
|
||
_$Repository_4.setOptions({
|
||
fuzzy: options.fuzzy,
|
||
limit: options.limit,
|
||
sort: options.sortMiddleware,
|
||
exclude: options.exclude
|
||
})
|
||
|
||
if (_$utils_9.isJSON(options.json)) {
|
||
initWithJSON(options.json)
|
||
} else {
|
||
initWithURL(options.json)
|
||
}
|
||
|
||
const rv = {
|
||
search: search
|
||
}
|
||
|
||
typeof options.success === 'function' && options.success.call(rv)
|
||
return rv
|
||
}
|
||
|
||
function initWithJSON (json) {
|
||
_$Repository_4.put(json)
|
||
registerInput()
|
||
}
|
||
|
||
function initWithURL (url) {
|
||
_$JSONLoader_2.load(url, function (err, json) {
|
||
if (err) {
|
||
throwError('failed to get JSON (' + url + ')')
|
||
}
|
||
initWithJSON(json)
|
||
})
|
||
}
|
||
|
||
function emptyResultsContainer () {
|
||
options.resultsContainer.innerHTML = ''
|
||
}
|
||
|
||
function appendToResultsContainer (text) {
|
||
options.resultsContainer.innerHTML += text
|
||
}
|
||
|
||
function registerInput () {
|
||
options.searchInput.addEventListener('input', function (e) {
|
||
if (isWhitelistedKey(e.which)) {
|
||
emptyResultsContainer()
|
||
debounce(function () { search(e.target.value) }, options.debounceTime)
|
||
}
|
||
})
|
||
}
|
||
|
||
function search (query) {
|
||
if (isValidQuery(query)) {
|
||
emptyResultsContainer()
|
||
render(_$Repository_4.search(query), query)
|
||
}
|
||
}
|
||
|
||
function render (results, query) {
|
||
const len = results.length
|
||
if (len === 0) {
|
||
return appendToResultsContainer(options.noResultsText)
|
||
}
|
||
for (let i = 0; i < len; i++) {
|
||
results[i].query = query
|
||
appendToResultsContainer(_$Templater_7.compile(results[i]))
|
||
}
|
||
}
|
||
|
||
function isValidQuery (query) {
|
||
return query && query.length > 0
|
||
}
|
||
|
||
function isWhitelistedKey (key) {
|
||
return [13, 16, 20, 37, 38, 39, 40, 91].indexOf(key) === -1
|
||
}
|
||
|
||
function throwError (message) {
|
||
throw new Error('SimpleJekyllSearch --- ' + message)
|
||
}
|
||
})(window)
|
||
|
||
}());
|
||
</script>
|
||
|
||
<!-- Configuration -->
|
||
<script>
|
||
SimpleJekyllSearch({
|
||
searchInput: document.getElementById('search-input'),
|
||
resultsContainer: document.getElementById('results-container'),
|
||
json: '/search.json',
|
||
//searchResultTemplate: '<li><a href="https://static.rnmkcy.eu{url}">{date} {title}</a></li>'
|
||
searchResultTemplate: '<li><a href="{url}">{date} {title}</a></li>'
|
||
})
|
||
</script>
|
||
<!-- Fin déclaration champ de recherche --></div><nav class="navigation">
|
||
<ul><li class="navigation__item"><a href="/archive.html">Etiquettes</a></li><li class="navigation__item"><a href="/htmldoc.html">Documents</a></li><li class="navigation__item"><a href="/liens_ttrss.html">Liens</a></li><li class="navigation__item"><a href="/aide-jekyll-text-theme.html">Aide</a></li></ul>
|
||
</nav></div>
|
||
</header>
|
||
|
||
</div><div class="page__content"><div class ="main"><div class="grid grid--reverse">
|
||
<div class="col-main cell cell--auto"><!-- start custom main top snippet --><div id="results-container" class="search-result js-search-result"></div><!-- end custom main top snippet -->
|
||
<article itemscope itemtype="http://schema.org/Article"><div class="article__header"><header><h1 style="color:Tomato;">OpenLDAP installation et configuration annuaire xoyize.xyz</h1></header></div><meta itemprop="headline" content="OpenLDAP installation et configuration annuaire xoyize.xyz"><div class="article__info clearfix"><ul class="left-col menu"><li>
|
||
<a class="button button--secondary button--pill button--sm" style="color:#00FFFF" href="/archive.html?tag=debian">debian</a>
|
||
</li></ul><ul class="right-col menu"><li>
|
||
<i class="far fa-calendar-alt"></i> <span title="Création" style="color:#FF00FF">21 oct. 2019</span>
|
||
|
||
<span title="Modification" style="color:#00FF7F">22 oct. 2019</span></li></ul></div><meta itemprop="datePublished" content="2019-10-22T00:00:00+02:00">
|
||
<meta itemprop="keywords" content="debian"><div class="js-article-content">
|
||
<div class="layout--article"><!-- start custom article top snippet -->
|
||
<style>
|
||
#myBtn {
|
||
display: none;
|
||
position: fixed;
|
||
bottom: 10px;
|
||
right: 10px;
|
||
z-index: 99;
|
||
font-size: 12px;
|
||
font-weight: bold;
|
||
border: none;
|
||
outline: none;
|
||
background-color: white;
|
||
color: black;
|
||
cursor: pointer;
|
||
padding: 5px;
|
||
border-radius: 4px;
|
||
}
|
||
|
||
#myBtn:hover {
|
||
background-color: #555;
|
||
}
|
||
</style>
|
||
|
||
<button onclick="topFunction()" id="myBtn" title="Haut de page">⇧</button>
|
||
|
||
<script>
|
||
//Get the button
|
||
var mybutton = document.getElementById("myBtn");
|
||
|
||
// When the user scrolls down 20px from the top of the document, show the button
|
||
window.onscroll = function() {scrollFunction()};
|
||
|
||
function scrollFunction() {
|
||
if (document.body.scrollTop > 20 || document.documentElement.scrollTop > 20) {
|
||
mybutton.style.display = "block";
|
||
} else {
|
||
mybutton.style.display = "none";
|
||
}
|
||
}
|
||
|
||
// When the user clicks on the button, scroll to the top of the document
|
||
function topFunction() {
|
||
document.body.scrollTop = 0;
|
||
document.documentElement.scrollTop = 0;
|
||
}
|
||
</script>
|
||
|
||
|
||
<!-- end custom article top snippet -->
|
||
<div class="article__content" itemprop="articleBody"><details>
|
||
<summary><b>Afficher/cacher Sommaire</b></summary>
|
||
<!-- affichage sommaire -->
|
||
<div class="toc-aside js-toc-root"></div>
|
||
</details><h1 id="openldap-debian">OpenLDAP Debian</h1>
|
||
|
||
<p><img src="/images/OpenLDAP-logo.png" alt="" /></p>
|
||
|
||
<h2 id="liens">Liens</h2>
|
||
|
||
<ul>
|
||
<li><a href="https://www.vennedey.net/resources/0-Getting-started-with-OpenLDAP-on-Debian-8">Getting started with OpenLDAP on Debian </a></li>
|
||
<li><a href="https://www.vennedey.net/resources/2-LDAP-managed-mail-server-with-Postfix-and-Dovecot-for-multiple-domains">LDAP managed mail server with Postfix and Dovecot for multiple domains</a></li>
|
||
<li><a href="https://wiki.gandi.net/fr/hosting/using-linux/tutorials/debian/mail-server-ldap">Installation d’un serveur mail avec backend OpenLDAP</a></li>
|
||
<li><a href="https://computingforgeeks.com/how-to-install-and-configure-openldap-server-on-debian/">How To Install and Configure OpenLDAP Server on Debian 10 (Buster)</a></li>
|
||
<li>
|
||
<p><a href="http://idum.fr/spip.php?article326">Mise en place de OpenLDAP</a> (<em>Le but de cet article est de vous faire découvrir OpenLDAP. En commençant par vous expliquer comment il fonctionne. Puis comment l’installer. Et enfin comment l’administrer.<br />
|
||
Pour nous aider dans cette dernière partie, j’utiliserai l’interface web phpldapadmin.</em>)<br />
|
||
<a href="/files/Mise en place de OpenLDAP.pdf">Mise en place de OpenLDAP</a> (Document au format PDF)</p>
|
||
</li>
|
||
<li><a href="https://blog.debugo.fr/openldap-serie/">OpenLDAP : La série de Tutos</a></li>
|
||
<li><a href="https://blog.debugo.fr/serveur-messagerie-complet-postfix-dovecot-ldap-rspamd/">Serveur Messagerie complet : La série de Tutos</a></li>
|
||
</ul>
|
||
|
||
<h2 id="openldap-serveur">OpenLDAP Serveur</h2>
|
||
|
||
<p><em>Les tests sont effectués sur le serveur xoyize.xyz</em></p>
|
||
|
||
<ul>
|
||
<li><a href="404.html">OVH VPS SSD 1 KVM OpenStack (1 vCore/2GoRam/20GoSSD) domaine xoyize.xyz + compilation OpenResty</a></li>
|
||
</ul>
|
||
|
||
<p>Avant de commencer l’installation, configurez le nom d’hôte FQDN de votre serveur et ajoutez un enregistrement au fichier <strong>/etc/hosts</strong><br />
|
||
Relever l’adresse ip de votre serveur <code class="language-plaintext highlighter-rouge">ip a</code> (ici notre adresse ip 192.168.0.45)</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>echo "192.168.0.45 ldap.xoyize.xyz" | sudo tee -a /etc/hosts
|
||
sudo hostnamectl set-hostname ldap.xoyize.xyz --static
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="installation-et-configuration">Installation et configuration</h3>
|
||
|
||
<blockquote>
|
||
<p>en mode su ou sudo</p>
|
||
</blockquote>
|
||
|
||
<p>L’installation d’OpenLDAP sur Debian est faite à l’aide de la gestion des paquets APT.<br />
|
||
Le premier élément précise que l’installation du paquet <strong>slapd</strong> se fait en mode non interactif et <code class="language-plaintext highlighter-rouge">-yq</code> ajoute l’installation en mode silencieux.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>DEBIAN_FRONTEND=noninteractive apt-get -yq install slapd ldap-utils net-tools
|
||
</code></pre></div></div>
|
||
|
||
<p>Pendant l’installation, vous devrez choisir un mot de passe de l’administrateur pour le compte racine LDAP. rhTJH8f97dkS65</p>
|
||
|
||
<h4 id="configuration-initiale">Configuration initiale</h4>
|
||
|
||
<p>Créer un squelette de configuration pour <strong>slapd</strong></p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dpkg-reconfigure slapd
|
||
</code></pre></div></div>
|
||
|
||
<p>Voulez-vous omettre la configuration d’OpenLDAP ? Non<br />
|
||
Nom de domaine : xoyize.xyz<br />
|
||
Nom d’entité (« organization ») : srvxo<br />
|
||
Mot de passe de l’administrateur : f43z7C9TBwxX3h<br />
|
||
Module de base de données à utiliser : MDB<br />
|
||
Faut-il supprimer la base de données lors de la purge du paquet ? Non<br />
|
||
Faut-il déplacer l’ancienne base de données ? Oui</p>
|
||
|
||
<h4 id="tests-fonctionnels">Tests fonctionnels</h4>
|
||
|
||
<p>Activer au démarrage et lancer <strong>slapd</strong> .</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>systemctl enable slapd
|
||
systemctl start slapd
|
||
</code></pre></div></div>
|
||
|
||
<p>Sur quel port du réseau écoute slapd</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>netstat -laputn | grep slapd
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 10204/slapd
|
||
tcp6 0 0 :::389 :::* LISTEN 10204/slapd
|
||
</code></pre></div></div>
|
||
|
||
<p>Comme on peut le voir, <strong>slapd</strong> attend les requêtes ldap sur le port TCP 389.<br />
|
||
Avec quels arguments s’exécute le service.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat /var/run/slapd/slapd.args
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/usr/sbin/slapd -h ldap:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d
|
||
</code></pre></div></div>
|
||
|
||
<p><strong>-h</strong> → les modalités d’accès à slapd : ldap et ldapi (ldap via TCP 389 et ldapi via socket unix)<br />
|
||
<strong>-g</strong> et <strong>-u</strong> → identité groupe et utilisateur sur lequel “tourne” le processus slapd<br />
|
||
<strong>-F</strong> → emplacement du ficher de configuration de slapd</p>
|
||
|
||
<p>Afficher les données de l’annuaire</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -x -H ldap://cinay.ldap.xoyize.xyz -b 'dc=xoyize,dc=xyz'
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code># extended LDIF
|
||
#
|
||
# LDAPv3
|
||
# base <dc=xoyize,dc=xyz> with scope subtree
|
||
# filter: (objectclass=*)
|
||
# requesting: ALL
|
||
#
|
||
|
||
# xoyize.xyz
|
||
dn: dc=xoyize,dc=xyz
|
||
objectClass: top
|
||
objectClass: dcObject
|
||
objectClass: organization
|
||
o: srvxo
|
||
dc: xoyize
|
||
|
||
# admin, xoyize.xyz
|
||
dn: cn=admin,dc=xoyize,dc=xyz
|
||
objectClass: simpleSecurityObject
|
||
objectClass: organizationalRole
|
||
cn: admin
|
||
description: LDAP administrator
|
||
|
||
# search result
|
||
search: 2
|
||
result: 0 Success
|
||
|
||
# numResponses: 3
|
||
# numEntries: 2
|
||
</code></pre></div></div>
|
||
|
||
<p><strong>-x</strong> → nous utilisons un compte défini à l’intérieur de la base pour accéder à l’annuaire<br />
|
||
<strong>-H</strong> → accès en ldap sur la machine cinay.ldap.xoyize.xyz<br />
|
||
<strong>-b</strong> → la racine à parcourir , ici ‘dc=ldap,dc=xoyize,dc=xyz’</p>
|
||
|
||
<p>ou</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -Y external -H ldapi:/// -b dc=xoyize,dc=xyz -LLL
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>SASL/EXTERNAL authentication started
|
||
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||
SASL SSF: 0
|
||
dn: dc=xoyize,dc=xyz
|
||
objectClass: top
|
||
objectClass: dcObject
|
||
objectClass: organization
|
||
o: srvxo
|
||
dc: xoyize
|
||
|
||
dn: cn=admin,dc=xoyize,dc=xyz
|
||
objectClass: simpleSecurityObject
|
||
objectClass: organizationalRole
|
||
cn: admin
|
||
description: LDAP administrator
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour avoir d’autres informations sur le serveur, vous pouvez utiliser les commandes suivantes :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>slapd -V
|
||
ldapsearch -Y external -H ldapi:/// -b cn=config "(objectClass=olcGlobal)" -LLL
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>SASL/EXTERNAL authentication started
|
||
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||
SASL SSF: 0
|
||
dn: cn=config
|
||
objectClass: olcGlobal
|
||
cn: config
|
||
olcArgsFile: /var/run/slapd/slapd.args
|
||
olcLogLevel: none
|
||
olcPidFile: /var/run/slapd/slapd.pid
|
||
olcToolThreads: 1
|
||
</code></pre></div></div>
|
||
|
||
<blockquote>
|
||
<p>-LLL : Permet de ne pas afficher certains informations superflues dans la sortie</p>
|
||
</blockquote>
|
||
|
||
<p>La configuration n’est plus dans un fichier unique, mais sous forme de DIT (cn=config). On peut en avoir un aperçu avec la commande</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code> tree /etc/ldap/slapd.d/
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/ldap/slapd.d/
|
||
├── cn=config
|
||
│ ├── cn=module{0}.ldif
|
||
│ ├── cn=schema
|
||
│ │ ├── cn={0}core.ldif
|
||
│ │ ├── cn={1}cosine.ldif
|
||
│ │ ├── cn={2}nis.ldif
|
||
│ │ └── cn={3}inetorgperson.ldif
|
||
│ ├── cn=schema.ldif
|
||
│ ├── olcBackend={0}mdb.ldif
|
||
│ ├── olcDatabase={0}config.ldif
|
||
│ ├── olcDatabase={-1}frontend.ldif
|
||
│ └── olcDatabase={1}mdb.ldif
|
||
└── cn=config.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="explications">Explications</h3>
|
||
|
||
<h4 id="les-schémas">Les Schémas</h4>
|
||
|
||
<p>Si vous regardez le résultat de la commande :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>tree /etc/ldap/slapd.d/
|
||
</code></pre></div></div>
|
||
|
||
<p>Vous voyez plusieurs entrées sous la branche cn=schema. En l’occurrence, core, cosine, nis et inetorgperson.</p>
|
||
|
||
<p>Ce sont en quelque sorte les modèles qu’utiliseront vos futurs enregistrement (quel attribut, de quel type, etc..). Ceux déjà intégrés sont les plus couramment utilisés, mais il en existe d’autres, soit déjà disponibles dans /etc/ldap/schema :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ls /etc/ldap/schema/*.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Soit disponibles sur Internet.</p>
|
||
|
||
<p>Il est aussi tout à fait possible de créer vos propres schémas, afin que votre annuaire réponde précisément à vos besoins.</p>
|
||
|
||
<h4 id="les-commandes">Les commandes</h4>
|
||
|
||
<p>Pour modifier la configuration du serveur nous utiliserons principalement les commandes ldapadd, ldapmodify, ldapdelete (installées avec le paquet ldap-utils) Ces dernières prennent en option un fichier (option -f) de format ldif (Ldap Data Interchange Format).</p>
|
||
|
||
<p>Nous allons rapidement voir de quoi il s’agit.</p>
|
||
|
||
<p>Pour effectuer des requêtes, nous utiliserons la commande ldapsearch.</p>
|
||
|
||
<p>Celle ci peut interroger le serveur LDAP de plusieurs façons.</p>
|
||
|
||
<p>Sur le socket interne :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -Q -Y external -H ldapi:/// -b cn=config
|
||
</code></pre></div></div>
|
||
|
||
<p>L’option -Q cache les infos SASL, inutile à l’affichage.</p>
|
||
|
||
<p>Ou sur un socket réseau :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -x -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -W -b cn=config
|
||
</code></pre></div></div>
|
||
|
||
<p>Sur le socket réseau, nous indiquons les options :</p>
|
||
|
||
<p>-x : authentification simple.</p>
|
||
|
||
<p>-H indique l’hôte (en l’occurrence, localhost).</p>
|
||
|
||
<p>-D est le compte qui va se connecter.</p>
|
||
|
||
<p>-W sert à demander le mot de passe.</p>
|
||
|
||
<p>-b ou basedn est l’endroit ou nous voulons faire notre recherche.</p>
|
||
|
||
<p>La commande fonctionne mais ne retourne rien. Le compte admin n’a pas accès à la configuration en passant par le socket réseau (nous allons y remédier après).</p>
|
||
|
||
<p>Au passage, pourquoi donc s’embêter alors qu’on ne pourrait qu’utiliser le socket interne ?</p>
|
||
|
||
<p>L’intérêt du socket réseau est qu’on peut lancer les commandes à distance (dans ce cas remplacer localhost par le nom de la machine distante).
|
||
C – BaseDn, Filtres, Attributs</p>
|
||
|
||
<p>Je reviens sur la commande :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -Q -LLL -Y external -H ldapi:/// -b cn=config
|
||
</code></pre></div></div>
|
||
|
||
<p>Celle ci affiche donc l’intégralité de l’arbre cn=config (le baseDN de notre requête).</p>
|
||
|
||
<p>Au passage, on peut l’écrire sous la forme :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config"
|
||
</code></pre></div></div>
|
||
|
||
<p>Si l’on veut n’afficher que les attributs dn des résultats, on fera alors :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Si par exemple, je veux afficher d’autres attributs :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "(objectClass=olcModuleList)" dn olcModuleLoad
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans la commande précédente, j’utilise un filtre. Pour les utiliser, il suffit de les indiquer après l’option -b et avant ce que l’on demande par ex :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "(&(objectClass=olcDatabaseConfig))" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Cette commande n’affichera que les attributs dn des objectClass olcDatabaseConfig. Le & est facultatif. J’aurais très bien pu mettre :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "(objectClass=olcDatabaseConfig)" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Si l’on ne veut pas que les attributs dn, mais toutes les infos :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "(&(objectClass=olcDatabaseConfig))"
|
||
</code></pre></div></div>
|
||
|
||
<table>
|
||
<tbody>
|
||
<tr>
|
||
<td>Et si je voulais les attributs dn des objectClass étant des olcDatabaseConfig ou ceux étant des olcModuleList, je vais utiliser le</td>
|
||
<td>pour indiquer un OU (le ET étant spécifié par &)</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "(|(objectClass=olcDatabaseConfig)(objectClass=olcModuleList))" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Petite explication sur l’utilisation des filtres. Ceux ci utilisent un principe qui rappelle la notation polonaise inversée, l’opérateur étant ici devant.</p>
|
||
|
||
<p>Exemple :</p>
|
||
|
||
<p>Si je veux A et B :</p>
|
||
|
||
<p>( & (A) (B) )</p>
|
||
|
||
<p>Si je veux A ou B</p>
|
||
|
||
<table>
|
||
<tbody>
|
||
<tr>
|
||
<td>(</td>
|
||
<td>(A) (B) )</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<p>Si je veux A et B ou A et C :</p>
|
||
|
||
<table>
|
||
<tbody>
|
||
<tr>
|
||
<td>(</td>
|
||
<td>( & (A) (B) ) ( & (A) (C) ) )</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<p>ou, en simplifiant :</p>
|
||
|
||
<table>
|
||
<tbody>
|
||
<tr>
|
||
<td>( & (A) (</td>
|
||
<td>(B) (C) ))</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<p>On peut aussi inverser avec le !.</p>
|
||
|
||
<p>Si l’on veut par ex ce qui est A et ce qui n’est pas B :</p>
|
||
|
||
<p>( & (A) (! B) )</p>
|
||
|
||
<p>Au niveau des filtres, nous pouvons utiliser les opérateurs suivants :</p>
|
||
|
||
<ul>
|
||
<li>< : plus petit que</li>
|
||
<li><= : plus petit ou égal</li>
|
||
<li>= : égal</li>
|
||
<li>
|
||
<blockquote>
|
||
<p>: plus grand</p>
|
||
</blockquote>
|
||
</li>
|
||
<li>
|
||
<blockquote>
|
||
<p>= : plus grand ou égal</p>
|
||
</blockquote>
|
||
</li>
|
||
<li>=* : présence de (retourne les entrées ou l’attribut est présent)</li>
|
||
<li>~= : approximation ( par ex, ~=Nocolas pourra retourner Nicolas)</li>
|
||
</ul>
|
||
|
||
<p>On peut utiliser un joker, par ex, = <em>toto</em> sortira tout ce qui contient toto comme sous chaîne.</p>
|
||
|
||
<p>Il existe également la notion de filtres étendus, utilisé ainsi : attribut:dn:=valeur.</p>
|
||
|
||
<p>Par ex :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -w password -b "dc=xoyize,dc=xyz" ou=people dn
|
||
</code></pre></div></div>
|
||
|
||
<p>me donne :</p>
|
||
|
||
<p>dn: ou=people,dc=xoyize,dc=xyz</p>
|
||
|
||
<p>Et :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -w password -b "dc=xoyize,dc=xyz" ou:dn:=people dn
|
||
</code></pre></div></div>
|
||
|
||
<p>me donne :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=people,dc=xoyize,dc=xyz
|
||
dn: ou=client,ou=people,dc=xoyize,dc=xyz
|
||
dn: ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
dn: uid=niko,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
dn: uid=ldap1,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
dn: uid=ldap2,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Ils permettent donc de considérer les éléments du DN comme faisant partie de l’entrée elle même.</p>
|
||
|
||
<p>On peut également utiliser les filtres étendus pour modifier les opérateurs.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -w password -b "dc=xoyize,dc=xyz" title:2.5.13.5:=Admin dn
|
||
</code></pre></div></div>
|
||
|
||
<p>ne me sortira que les entrées ou l’attribut title est égal à Admin (et non pas admin, ADMIN, etc…). Par défaut, l’opération n’est pas sensible à la casse.</p>
|
||
|
||
<p>Pour connaitre l’ensemble des matchingRules disponibles :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -D cn=admin,dc=xoyize,dc=xyz -w password -b "cn=subschema" -s base matchingRuleUse | grep "matchingRule" | cut -d ' ' -f3,5
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="configuration">Configuration</h3>
|
||
|
||
<p>Nous allons créer un répertoire /root/ldap qui va centraliser tous nos fichiers de configuration :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sudo -s
|
||
mkdir -p /root/ldap
|
||
cd /root/ldap
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="compte-admin">Compte admin</h4>
|
||
|
||
<p>1 – Mdp Admin dans un fichier</p>
|
||
|
||
<p>Afin d’éviter d’avoir à toujours retaper le mot de passe admin (mot de passe que nous avons créé lors de la configuration du paquet) lors des commandes, nous allons l’enregistrer dans un fichier.</p>
|
||
|
||
<p>On va créer un fichier /root/pwdldap et mettre le mot de passe dedans :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>echo -n "mdpadmin" > /root/pwdldap
|
||
chmod 600 /root/pwdldap
|
||
</code></pre></div></div>
|
||
|
||
<p>On test :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -x -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>2 – Droits d’accès à la configuration du serveur</p>
|
||
|
||
<p>Par défaut, l’accès à la configuration n’est pas possible en passant par le socket réseau avec le compte admin :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b cn=config
|
||
</code></pre></div></div>
|
||
|
||
<p>nous donne :</p>
|
||
|
||
<p>No such object (32)</p>
|
||
|
||
<p>Créez le fichier LDIF /root/ldap/acces-conf-admin.ldif, et insérez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/acces-conf-admin.ldif << EOF
|
||
dn: olcDatabase={0}config,cn=config
|
||
changeType: modify
|
||
add: olcAccess
|
||
olcAccess: to * by dn.exact=cn=admin,dc=xoyize,dc=xyz manage by * break
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Injectez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapmodify -Y external -H ldapi:/// -f acces-conf-admin.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Et restestez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -x -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="les-overlays">Les Overlays</h3>
|
||
|
||
<ul>
|
||
<li>accesslog : Enregistrement des accès. Attention, réduit drastiquement les performances.</li>
|
||
<li><strong>auditlog</strong> : Enregistrement des modifications.</li>
|
||
<li>chain : Liaison de plusieurs serveurs LDAP au niveau des recherches.</li>
|
||
<li>collect : Implémentation de la RFC 3671. Les attributs collectifs partagent des valeurs communes entre l’ensemble des membres héritant d’une entrée commune.</li>
|
||
<li>constraint : Permet de forcer des contraintes sur des attributs.</li>
|
||
<li><strong>memberof</strong> : Permet de connaître les groupes auxquels appartient un utilisateur</li>
|
||
<li><strong>ppolicy</strong> : Password Policy. Permet la mise en place de contrôles sur les mots de passe (longueur, durée de validité, etc…).</li>
|
||
<li><strong>refint</strong> :Referential Integrity. Permet de s’assurer de la cohérence de l’annuaire lors de suppression d’entrées.</li>
|
||
<li>syncprov :Syncrepl Provider. Permet la réplication syncrepl, incluant la fonctionnalité de recherche persistante. On l’installera plus tard.</li>
|
||
<li>translucent : Translucent Proxy. Cet overlay peut être utilisé avec un backend local pour créer un proxy transparent. Le contenu des entrées récupérées à partir d’un serveur LDAP distant peut être en partie réécrit/modifé/completé par la base locale.</li>
|
||
<li><strong>unique</strong> : permet de s’assurer de l’unicité d’attributs.</li>
|
||
<li>valsort : Permet de forcer l’ordre pour les valeurs d’attributs lorsqu’ils sont retournées suite à une recherche.</li>
|
||
</ul>
|
||
|
||
<blockquote>
|
||
<p>En gras, ceux dont nous nous servirons.</p>
|
||
</blockquote>
|
||
|
||
<h4 id="memberof">MemberOf</h4>
|
||
|
||
<p>L’overlay memberof permet de savoir dans quels groupes se trouve un utilisateur en une seule requête au lieu de deux.<br />
|
||
Créez un fichier memberof_act.ldif et insérez le contenu suivant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/memberof_act.ldif << EOF
|
||
dn: cn=module,cn=config
|
||
cn:module
|
||
objectclass: olcModuleList
|
||
objectclass: top
|
||
olcmoduleload: memberof.la
|
||
olcmodulepath: /usr/lib/ldap
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez un fichier memberof_conf.ldif et insérez le contenu suivant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/memberof_conf.ldif << EOF
|
||
dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
|
||
changetype: add
|
||
objectClass: olcMemberOf
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcConfig
|
||
objectClass: top
|
||
olcOverlay: memberof
|
||
olcMemberOfDangling: ignore
|
||
olcMemberOfRefInt: TRUE
|
||
olcMemberOfGroupOC: groupOfNames
|
||
olcMemberOfMemberAD: member
|
||
olcMemberOfMemberOfAD: memberOf
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Y EXTERNAL -H ldapi:/// -f memberof_act.ldif
|
||
ldapadd -Y EXTERNAL -H ldapi:/// -f memberof_conf.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour vérifier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcModuleList"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=module{0},cn=config
|
||
objectClass: olcModuleList
|
||
cn: module{0}
|
||
olcModulePath: /usr/lib/ldap
|
||
olcModuleLoad: {0}back_mdb
|
||
|
||
dn: cn=module{1},cn=config
|
||
objectClass: olcModuleList
|
||
objectClass: top
|
||
cn: module{1}
|
||
olcModulePath: /usr/lib/ldap
|
||
olcModuleLoad: {0}memberof.la
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou bien encore :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>tree /etc/ldap/slapd.d/
|
||
</code></pre></div></div>
|
||
|
||
<p>On doit trouver trace dans la liste des modules.<br />
|
||
On peut vérifier la configuration avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcmemberOf"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcMemberOf
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcConfig
|
||
objectClass: top
|
||
olcOverlay: {0}memberof
|
||
olcMemberOfDangling: ignore
|
||
olcMemberOfRefInt: TRUE
|
||
olcMemberOfGroupOC: groupOfNames
|
||
olcMemberOfMemberAD: member
|
||
olcMemberOfMemberOfAD: memberOf
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="intégrité-référentielle">Intégrité Référentielle</h4>
|
||
|
||
<p>Cet overlay permet de supprimer un utilisateur d’un groupe quand on supprime l’utilisateur. Au passage, si un groupe se retrouve vide, l’admin sera automatiquement ajouté (un groupe vide créé une erreur dans OpenLdap)</p>
|
||
|
||
<p>Créez un fichier refint_act.ldif et insérez le contenu suivant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/refint_act.ldif << EOF
|
||
dn: cn=module,cn=config
|
||
cn: module
|
||
objectclass: olcModuleList
|
||
objectclass: top
|
||
olcmoduleload: refint.la
|
||
olcmodulepath: /usr/lib/ldap
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez un fichier refint_conf.ldif et insérez le contenu suivant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/refint_conf.ldif << EOF
|
||
dn: olcOverlay=refint,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcConfig
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcRefintConfig
|
||
objectClass: top
|
||
olcOverlay: refint
|
||
olcRefintAttribute: memberof member manager owner
|
||
olcRefintNothing: cn=admin,dc=xoyize,dc=xyz
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint_act.ldif
|
||
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint_conf.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On vérifie :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcModuleList"
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut vérifier la configuration avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcRefintConfig"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcConfig
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcRefintConfig
|
||
objectClass: top
|
||
olcOverlay: {1}refint
|
||
olcRefintAttribute: memberof member manager owner
|
||
olcRefintNothing: cn=admin,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="overlay-audit-log">Overlay Audit Log</h4>
|
||
|
||
<p>Cet overlay sert à auditer chaque modification au sein de l’annuaire. Dans notre cas, cela sera inscrit dans le fichier : /var/log/openldap/audit.ldif</p>
|
||
|
||
<p>Créez le fichier auditlog_act.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/auditlog_act.ldif << EOF
|
||
dn: cn=module,cn=config
|
||
cn: module
|
||
objectclass: olcModuleList
|
||
objectclass: top
|
||
olcModuleLoad: auditlog.la
|
||
olcmodulepath: /usr/lib/ldap
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez le fichier auditlog_conf.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/auditlog_conf.ldif << EOF
|
||
dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcAuditLogConfig
|
||
olcOverlay: auditlog
|
||
olcAuditlogFile: /var/log/openldap/auditlog.ldif
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Injectez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Q -Y EXTERNAL -H ldapi:/// -f auditlog_act.ldif
|
||
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f auditlog_conf.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On vérifie :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcModuleList"
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut vérifier la configuration avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcAuditLogConfig"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: olcOverlay={2}auditlog,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcAuditlogConfig
|
||
olcOverlay: {2}auditlog
|
||
olcAuditlogFile: /var/log/openldap/auditlog.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ensuite, nous allons créer le fichier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir -p /var/log/openldap
|
||
chmod 755 /var/log/openldap
|
||
chown openldap:openldap /var/log/openldap
|
||
touch /var/log/openldap/auditlog.ldif
|
||
chmod 755 /var/log/openldap/auditlog.ldif
|
||
chown openldap:openldap /var/log/openldap/auditlog.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="overlay-unique">Overlay Unique</h4>
|
||
|
||
<p>Cet overlay permet de nous assurer l’unicité des attributs que l’on spécifie.</p>
|
||
|
||
<p>Créez un fichier unique_act.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/unique_act.ldif << EOF
|
||
dn: cn=module,cn=config
|
||
cn: module
|
||
objectclass: olcModuleList
|
||
objectclass: top
|
||
olcModuleLoad: unique.la
|
||
olcmodulepath: /usr/lib/ldap
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez un fichier unique_conf.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/unique_conf.ldif << EOF
|
||
dn: olcOverlay=unique,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcUniqueConfig
|
||
olcOverlay: unique
|
||
olcUniqueUri: ldap:///ou=people,dc=xoyize,dc=xyz?uid?sub
|
||
olcUniqueUri: ldap:///ou=people,dc=xoyize,dc=xyz?mail?sub
|
||
olcUniqueUri: ldap:///ou=people,dc=xoyize,dc=xyz?uidNumber?sub
|
||
olcUniqueUri: ldap:///ou=groups,dc=xoyize,dc=xyz?cn?sub
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Nous demandons ici à ce que les attributs ui, mail et uidNumber dans l’ou people soient uniques. Et que l’attribut cn dans l’ou groups soit lui aussi unique.</p>
|
||
|
||
<p>Injectez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Q -Y EXTERNAL -H ldapi:/// -f unique_act.ldif
|
||
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f unique_conf.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On vérifie :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcModuleList"
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut vérifier la configuration avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcUniqueConfig"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: olcOverlay={3}unique,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcUniqueConfig
|
||
olcOverlay: {3}unique
|
||
olcUniqueURI: ldap:///ou=people,dc=xoyize,dc=xyz?uid?sub
|
||
olcUniqueURI: ldap:///ou=people,dc=xoyize,dc=xyz?mail?sub
|
||
olcUniqueURI: ldap:///ou=people,dc=xoyize,dc=xyz?uidNumber?sub
|
||
olcUniqueURI: ldap:///ou=groups,dc=xoyize,dc=xyz?cn?sub
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="overlay-ppolicy">Overlay Ppolicy</h4>
|
||
|
||
<p>Cet overlay va nous permettre de spécifier une politique de mot de passe.</p>
|
||
|
||
<p>Un peu particulier, il faut ajouter son schéma dans l’annuaire :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut voir que c’est bon avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=schema,cn=config" cn
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=schema,cn=config
|
||
cn: schema
|
||
|
||
dn: cn={0}core,cn=schema,cn=config
|
||
cn: {0}core
|
||
|
||
dn: cn={1}cosine,cn=schema,cn=config
|
||
cn: {1}cosine
|
||
|
||
dn: cn={2}nis,cn=schema,cn=config
|
||
cn: {2}nis
|
||
|
||
dn: cn={3}inetorgperson,cn=schema,cn=config
|
||
cn: {3}inetorgperson
|
||
|
||
dn: cn={4}ppolicy,cn=schema,cn=config
|
||
cn: {4}ppolicy
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou bien encore :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>tree /etc/ldap/slapd.d/
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans la branche cn=schema, on doit voir le schéma ppolicy qui s’est ajouté à ceux présent par défaut (core, cosine, nis et inetorgperson).</p>
|
||
|
||
<p>Créez un fichier ppolicy_act.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/ppolicy_act.ldif << EOF
|
||
dn: cn=module,cn=config
|
||
cn: module
|
||
objectclass: olcModuleList
|
||
objectclass: top
|
||
olcModuleLoad: ppolicy.la
|
||
olcmodulepath: /usr/lib/ldap
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez un fichier ppolicy_conf.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/ppolicy_conf.ldif << EOF
|
||
dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcPpolicyConfig
|
||
olcOverlay: ppolicy
|
||
olcPPolicyDefault: cn=ppolicy,dc=xoyize,dc=xyz
|
||
olcPPolicyHashCleartext: TRUE
|
||
olcPPolicyUseLockout: FALSE
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>olcPPolicyDefault : Indique le DN de configuration utilisé par défaut (nous le définirons apres).</p>
|
||
|
||
<p>olcPPolicyHashCleartext : Indique si les mots de passe doivent être cryptés.</p>
|
||
|
||
<p>olcPPolicyUseLockout : Si TRUE, le message d’erreur retourné en cas de connexion à un compte vérouillé indiquera qu’il s’agit d’un compte vérouillé. Si FALSE, ce sera un message d’échec stantard.</p>
|
||
|
||
<p>On injecte</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ppolicy_act.ldif
|
||
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ppolicy_conf.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On vérifie :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "cn=config" "Objectclass=olcPpolicyConfig" -LLL
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: olcOverlay={4}ppolicy,olcDatabase={1}mdb,cn=config
|
||
objectClass: olcOverlayConfig
|
||
objectClass: olcPPolicyConfig
|
||
olcOverlay: {4}ppolicy
|
||
olcPPolicyDefault: cn=ppolicy,dc=xoyize,dc=xyz
|
||
olcPPolicyHashCleartext: TRUE
|
||
olcPPolicyUseLockout: FALSE
|
||
</code></pre></div></div>
|
||
|
||
<p>On va maintenant créer la politique par défaut.</p>
|
||
|
||
<p>Créez un fichier ppolicy_def.ldif pour y insérer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/ppolicy_def.ldif << EOF
|
||
dn: cn=ppolicy,dc=xoyize,dc=xyz
|
||
objectClass: top
|
||
objectClass: device
|
||
objectClass: pwdPolicy
|
||
cn: ppolicy
|
||
pwdAllowUserChange: TRUE
|
||
pwdAttribute: userPassword
|
||
pwdCheckQuality: 1
|
||
pwdExpireWarning: 0
|
||
pwdFailureCountInterval: 30
|
||
pwdGraceAuthNLimit: 5
|
||
pwdInHistory: 5
|
||
pwdLockout: TRUE
|
||
pwdLockoutDuration: 60
|
||
pwdMaxAge: 0
|
||
pwdMaxFailure: 5
|
||
pwdMinAge: 0
|
||
pwdMinLength: 5
|
||
pwdMustChange: FALSE
|
||
pwdSafeModify: FALSE
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>La signification des attributs est :</p>
|
||
|
||
<p>pwdAllowUserChange : indique si l’utilisateur peut changer son mot de passe.</p>
|
||
|
||
<p>pwdCheckQuality : indique si OpenLDAP renvoie une erreur si le mot de passe n’est pas conforme</p>
|
||
|
||
<p>pwdExpireWarning : avertissement d’expiration.</p>
|
||
|
||
<p>pwdFailureCountInterval : Intervalle de temps entre deux tentatives infructueuses pour qu’elles soient considérées comme « à la suite ».</p>
|
||
|
||
<p>pwdGraceAuthNLimit : période de grâce suite à l’expiration du mot de passe.</p>
|
||
|
||
<p>pwdInHistory : nombre de mots de passe dans l’historique.</p>
|
||
|
||
<p>pwdLockout : indique si on bloque le compte au bout de X échecs.</p>
|
||
|
||
<p>pwdLockoutDuration : durée du blocage du compte (en secondes).</p>
|
||
|
||
<p>pwdMaxAge : age maximal du mot de passe (en secondes).</p>
|
||
|
||
<p>pwdMaxFailure : nombre d’échecs de saisie du mot de passe maximal (avant blocage).</p>
|
||
|
||
<p>pwdMinAge : age minimal du mot de passe (en secondes).</p>
|
||
|
||
<p>pwdMinLength : longueur minimale du mot de passe.</p>
|
||
|
||
<p>pwdMustChange : indique si l’utilisateur doit changer son mot de passe.</p>
|
||
|
||
<p>pwdSafeModify : indique si il faut envoyer l’ancien mot de passe avec le nouveau pour modification.</p>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f ppolicy_def.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On vérifie :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b "dc=xoyize,dc=xyz" "Objectclass=pwdPolicy"
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut avoir plusieurs politique (une adapté pour des comptes clients, par exemple).</p>
|
||
|
||
<p>Par ex, fichier ppolicy-client.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/ppolicy-client.ldif << EOF
|
||
dn: cn=ppolicy-client,dc=xoyize,dc=xyz
|
||
objectClass: top
|
||
objectClass: device
|
||
objectClass: pwdPolicy
|
||
cn: ppolicy-client
|
||
pwdAllowUserChange: TRUE
|
||
pwdAttribute: userPassword
|
||
pwdCheckQuality: 1
|
||
pwdExpireWarning: 0
|
||
pwdFailureCountInterval: 30
|
||
pwdGraceAuthNLimit: 5
|
||
pwdInHistory: 10
|
||
pwdLockout: TRUE
|
||
pwdLockoutDuration: 60
|
||
pwdMaxAge: 0
|
||
pwdMaxFailure: 3
|
||
pwdMinAge: 0
|
||
pwdMinLength: 8
|
||
pwdMustChange: FALSE
|
||
pwdSafeModify: TRUE
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Qu’on injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f ppolicy-client.ldif
|
||
</code></pre></div></div>
|
||
|
||
<hr />
|
||
|
||
<p>Et qu’on affectera avec un fichier changeppolicy.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/ppolicy-client.ldif << EOF
|
||
dn: uid=toto,ou=client,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
replace: pwdPolicySubEntry
|
||
pwdPolicySubEntry: cn=ppolicy-client,dc=xoyize,dc=xyz
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Qu’on injectera avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f changeppolicy.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On pourra aussi spécifier cet attribut à la création de l’utilisateur.</p>
|
||
|
||
<h3 id="peuplement-de-lannuaire">Peuplement de l’annuaire</h3>
|
||
|
||
<h4 id="les-ous">Les OUs</h4>
|
||
|
||
<p>Nous avions créé un répertoire /root/ldap/conf pour y mettre la configuration. Créons un répertoire pour y mettre les fichiers ldif contenant les données.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir -p /root/ldap/data
|
||
cd /root/ldap/data
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour rappel, les OUs sont des conteneurs qui permettent de ranger les données dans l’annuaire, de les hiérarchiser. Il ne faut pas les confondre avec les Groupes.</p>
|
||
|
||
<p>Créez un fichier OU.ldif et remplissez le de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/OU.ldif << EOF
|
||
dn: ou=people,dc=xoyize,dc=xyz
|
||
ou: people
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=group,dc=xoyize,dc=xyz
|
||
ou: group
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=system,dc=xoyize,dc=xyz
|
||
ou: system
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
ou: xoyize
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=client,ou=people,dc=xoyize,dc=xyz
|
||
ou: client
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
ou: sysgroup
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
ou: workgroup
|
||
objectClass: organizationalUnit
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f OU.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="les-utilisateurs">Les utilisateurs</h4>
|
||
|
||
<p>On va créer notre premier utilisateur.(remplacer password par le vrai mot de passe)</p>
|
||
|
||
<p>Fichier User_yannick.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/User_yannick.ldif << EOF
|
||
dn: uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
uid: yannick
|
||
sn: yannick
|
||
givenName: Yannick
|
||
cn: Yannick
|
||
displayName: Yannick
|
||
userPassword: kfhd59erty54
|
||
mail: yannick@xoyize.xyz
|
||
title: Admin
|
||
initials: Y
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f User_yannick.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Profitons pour faire une explication sur ces lignes :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
</code></pre></div></div>
|
||
|
||
<p>Notre utilisateur héritera des attributs de ces trois classes. Mais qu’est ce donc ?</p>
|
||
|
||
<p>Voyons un peu les schémas :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=schema,cn=config"
|
||
</code></pre></div></div>
|
||
|
||
<p>Beaucoup d’infos, pour s’en sortir affichons les dn des schémas :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=schema,cn=config" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Ce qui nous affiche :</p>
|
||
|
||
<p>dn: cn=schema,cn=config
|
||
dn: cn={0}core,cn=schema,cn=config
|
||
dn: cn={1}cosine,cn=schema,cn=config
|
||
dn: cn={2}nis,cn=schema,cn=config
|
||
dn: cn={3}inetorgperson,cn=schema,cn=config
|
||
dn: cn={4}ppolicy,cn=schema,cn=config</p>
|
||
|
||
<p>Concentrons nous sur le schéma core :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=schema,cn=config" "cn={0}core"
|
||
</code></pre></div></div>
|
||
|
||
<p>La vous devez voir deux grands types de données : les <strong>olcObjectClasses</strong> et les <strong>olcAttributeTypes</strong>:</p>
|
||
|
||
<p>Les AttributeTypes sont les attributs que peuvent avoir les entrées de l’annuaire. Les ObjectClasses sont les regroupement de ces attributs.</p>
|
||
|
||
<p>Regardons les différents ObjectClasses qui composent notre schéma core :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=schema,cn=config" "cn={0}core" olcObjectClasses
|
||
</code></pre></div></div>
|
||
|
||
<p>En cherchant dedans, on va trouver nos objectclasses person et organizationalPerson :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>olcObjectClasses: {4}( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top
|
||
STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $
|
||
description ) )
|
||
olcObjectClasses: {5}( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an o
|
||
rganizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ regis
|
||
teredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $
|
||
teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ fac
|
||
simileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $
|
||
physicalDeliveryOfficeName $ ou $ st $ l ) )
|
||
</code></pre></div></div>
|
||
|
||
<p>Ce qu’il faut comprendre :</p>
|
||
|
||
<p>L’ObjectClasses person hérite de top.</p>
|
||
|
||
<p>Must spécifie les AttributeTypes obligatoires : sn et cn.</p>
|
||
|
||
<p>May définie les AttributeTypes facultatives</p>
|
||
|
||
<p>Les AttributeTypes sont définis sur un modèle similaire, par exemple :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=schema,cn=config" "cn={0}core" olcAttributeTypes
|
||
</code></pre></div></div>
|
||
|
||
<p>J’en prend un au hasard :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225
|
||
6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS
|
||
ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
|
||
</code></pre></div></div>
|
||
|
||
<p>On trouve le nom de l’attribut, une description et son type (SYNTAX suivi d’un OID, je reviendrais sur ce point dans le chapitre consacré à la création d’un schéma).</p>
|
||
|
||
<p>L’objet que l’on créé hérite des attributs des classes person, organizationalPerson et inetOrgPerson.</p>
|
||
|
||
<p>Voila donc pour les explications sur les ObjectClasses et les AttributeTypes:</p>
|
||
|
||
<p>Au passage, on va vérifier quelques points.</p>
|
||
|
||
<p>Regardons comment est stocké le mdp dans la base :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "dc=xoyize,dc=xyz" "uid=yannick"
|
||
</code></pre></div></div>
|
||
|
||
<p>On voit une ligne :</p>
|
||
|
||
<p>userPassword:: e1NTSEF9TklxSkd5YVFBdVcwMkpOVmplcjArOGYwRmNNMjNBVXg=</p>
|
||
|
||
<p>Il s’agit d’un codage en base64. Pour le décoder :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>echo e1NTSEF9TklxSkd5YVFBdVcwMkpOVmplcjArOGYwRmNNMjNBVXg= | base64 -d
|
||
</code></pre></div></div>
|
||
|
||
<p>Et la on le résultat suivant :</p>
|
||
|
||
<p>{SSHA}NIqJGyaQAuW02JNVjer0+8f0FcM23AUx</p>
|
||
|
||
<p>Le mot de passe est bien crypté comme configuré avec l’overlay ppolicy.</p>
|
||
|
||
<p>Et pour tester la connexion avec ce compte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLLH ldap://localhost -D uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz -W -b "dc=xoyize,dc=xyz" "uid=yannick"
|
||
</code></pre></div></div>
|
||
|
||
<p>Et si vous tapez le bon mot de passe, cela vous affiche votre propre fiche.</p>
|
||
|
||
<h4 id="les-groupes">Les groupes</h4>
|
||
|
||
<p>A noter, il existe deux types de groupes : les posixgroup et les groupofnames.
|
||
Les posixgroup sont similaires au groupes Unix, et les groupofnames ressemblent plus à des groupes AD.
|
||
Pour faire simple, l’avantage des groupofnames est qu’avec un filtre sur un utilisateur, on peut connaitre ses groupes (avec l’overlay memberof). Chose impossible avec les posixgroups.
|
||
Par contre, il est impératif d’avoir au moins un utilisateur dans un groupe de type groupofnames. Vous pouvez être tenté de vous mettre par défaut, mais le jour ou vous aller modifier votre schéma, vous allez devoir supprimer les utilisateurs, et un groupe sans utilisateur garde l’uid du dernier membre à l’avoir quitté et si vous refaite un compte avec le même uid, impossible de vous remettre dedans sans supprimer le groupe. Bref, perso, je met l’admin par défaut, comme ça pas de risques. De plus notre overlay refint configuré au préalable est raccord avec cela.</p>
|
||
|
||
<p>On créé un fichier Group.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/Group.ldif << EOF
|
||
dn: cn=cloud,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn: cloud
|
||
description: Cloud
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
|
||
dn: cn=xoyize ,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn: xoyize
|
||
description: xoyize
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
EOF
|
||
</code></pre></div></div>
|
||
<p>J’ai mis dedans les groupes dont j’ai besoin, à vous de faire en fonction, etc…</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f Group.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Au passage, on peut tester notre overlay memberof :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLLH ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "dc=xoyize,dc=xyz" "cn=admin" memberof
|
||
</code></pre></div></div>
|
||
|
||
<p>Doit nous retourner quelque chose qui ressemble à :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dc=xoyize,dc=xyz" "cn=admin" memberof
|
||
dn: cn=admin,dc=xoyize,dc=xyz
|
||
memberOf: cn=cloud,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
memberOf: cn=xoyize,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>A la question, si je veux rajouter un utilisateur dans un groupe, comment faire ?</p>
|
||
|
||
<p>Je vous répond qu’avec OpenLdap, tout passe par des fichiers ldif, du coup, créez un fichier addusertogroup.ldif pour y mettre :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=cloud,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
add: member
|
||
member: uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis on injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapmodify -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f addusertogroup.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Et la, si on requête cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLLH ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "dc=xoyize,dc=xyz" "uid=yannick" memberof
|
||
</code></pre></div></div>
|
||
|
||
<p>On doit avoir ceci :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
memberOf: cn=cloud,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Nous verrons plus en détail les ajouts, modifications, suppressions dans la partie suivante.</p>
|
||
|
||
<h4 id="comptes-système-et-acl">Comptes Système et ACL</h4>
|
||
|
||
<p>Par défaut, l’accès à l’annuaire est assez ouvert :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL
|
||
</code></pre></div></div>
|
||
|
||
<p>On voit ce que l’accès anonyme nous affiche…</p>
|
||
|
||
<p>On va devoir filtrer un peu.</p>
|
||
|
||
<p>Tout d’abord, nous allons créer deux compte systèmes. Un viewer (qui aura des droits de lecture uniquement, utilisé par les applications pour se connecter à l’annuaire et vérifier des droits, au lieu de passe par le bind anonyme) et un Writer (qui lui aura des droits d’écriture…)</p>
|
||
|
||
<p>Créez le fichier viewer.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/viewer.ldif << EOF
|
||
dn: cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
objectClass: simpleSecurityObject
|
||
objectClass: organizationalRole
|
||
cn: viewer
|
||
description: LDAP viewer
|
||
userPassword: passview
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez le fichier writer.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/writer.ldif << EOF
|
||
dn: cn=writer,ou=system,dc=xoyize,dc=xyz
|
||
objectClass: simpleSecurityObject
|
||
objectClass: organizationalRole
|
||
cn: writer
|
||
description: LDAP Writer
|
||
userPassword: passwrite
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Injectez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f viewer.ldif
|
||
ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f writer.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Voyons les ACLs par défaut :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -x -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -b "cn=config" "olcDatabase={1}mdb" olcaccess
|
||
</code></pre></div></div>
|
||
|
||
<p>Modifions les pour empêcher les connexions anonymes.</p>
|
||
|
||
<p>Créez un fichier acl.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > /root/ldap/data/acl.ldif << EOF
|
||
dn: olcDatabase={1}mdb,cn=config
|
||
changetype: modify
|
||
replace: olcAccess
|
||
olcAccess: to attrs=userPassword by self write by anonymous auth by dn="cn=writer,ou=system,dc=xoyize,dc=xyz" write by dn="cn=viewer,ou=system,dc=xoyize,dc=xyz" read by dn="cn=admin,dc=xoyize,dc=xyz" write by * none
|
||
olcAccess: to dn.base="dc=xoyize,dc=xyz" by users read
|
||
olcAccess: to * by self write by dn="cn=admin,dc=xoyize,dc=xyz" write by * read by anonymous none
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>J’expliquerais plus précisément le fonctionnement des ACLs dans un autre article. Nous modifions la deuxieme ACL qui par défaut donne accès en lecture à tout le monde. La, nous réduisons la lecture aux utilisateurs authentifiés.</p>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f acl.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On test de manière anonyme :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL
|
||
</code></pre></div></div>
|
||
|
||
<p>Ça ne passe plus.</p>
|
||
|
||
<p>On teste avec notre compte viewer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xLLL -H ldap://localhost -D cn=viewer,ou=system,dc=xoyize,dc=xyz -w passview -b "dc=xoyize,dc=xyz" "uid=yannick"
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="rootbashrc">/root/.bashrc</h3>
|
||
|
||
<p>Nous allons utiliser énormément les commande <strong>ldapsearch</strong> et <strong>ldapmodify</strong></p>
|
||
|
||
<p>Du coup, afin d’aller plus vite nous allons créer des alias.</p>
|
||
|
||
<p>Éditez le fichier /root/.bashrc pour y ajouter :</p>
|
||
|
||
<p>alias lmodif=’ldapmodify -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap’
|
||
alias lsearch=’ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap’
|
||
alias ladd=’ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap’
|
||
alias ldel=’ldapdelete -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap’</p>
|
||
|
||
<p>Puis pour recharger le fichier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>source ~/.bashrc
|
||
</code></pre></div></div>
|
||
|
||
<p>Dorénavant, il n’y aura plus tout à saisir…</p>
|
||
|
||
<h3 id="modification-des-données">Modification des données</h3>
|
||
|
||
<h4 id="ajout-dune-ou">Ajout d’une OU</h4>
|
||
|
||
<p>Tout d’abord, listons ce qui est présent</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "objectClass=organizationalUnit"
|
||
</code></pre></div></div>
|
||
|
||
<p>Je vais profiter de cette partie sur les OU pour expliquer les trois commandes à notre disposition pour modifier les données de l’annuaire : ldapadd, ldapmodify et ldapdelete.</p>
|
||
|
||
<p>ldapadd est un alias de ldapmodify -a, le commutateur -a indiquant un ajout. Ce commutateur peut être remplacé par la ligne changetype: add dans le fichier ldif.</p>
|
||
|
||
<p>Ainsi, pour ajouter une OU par ex avec le fichier addou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=test,ou=people,dc=xoyize,dc=xyz
|
||
ou: test
|
||
objectClass: organizationalUnit
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapadd -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f addou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>ou</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapmodify -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -a -f addou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Autre méthode avec le ficher addou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=test,ou=people,dc=xoyize,dc=xyz
|
||
changetype: add
|
||
ou: test
|
||
objectClass: organizationalUnit
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapmodify -cxWD cn=admin,dc=xoyize,dc=xyz -y /root/pwdldap -f addou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ces trois façons de faire donnent le même résultat.</p>
|
||
|
||
<p>L’avantage de tout faire par ex avec ldapmodify est que l’on peut effectuer plusieurs opérations en un fichier, le tout étant de laisser une ligne avec – entre chaque opération.</p>
|
||
|
||
<p>Exemple avec le fichier test.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=test,ou=people,dc=xoyize,dc=xyz
|
||
changetype: add
|
||
ou: test
|
||
objectClass: organizationalUnit
|
||
-
|
||
dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
changetype: delete
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans ce fichier, nous ajoutons une OU puis nous supprimons un utilisateur. Il n’y a pas de limite d’opérations que l’on peut effectuer en une fois.</p>
|
||
|
||
<h4 id="modification-dune-ou">Modification d’une OU</h4>
|
||
|
||
<p>Nous renommons l’OU test en newtest avec le fichier chgou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=test,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: ou=newtest
|
||
deleteoldrdn: 1
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f chgou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="déplacement-dune-ou">Déplacement d’une OU</h4>
|
||
|
||
<p>Nous déplaçons l’OU newtest de la branche ou=people,dc=xoyize,dc=xyz vers la branche ou=workgroup,ou=group,dc=xoyize,dc=xyz avec le fichier mvou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=newtest,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: ou=newtest
|
||
deleteoldrdn: 1
|
||
newsuperior: ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f mvou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="suppression-dune-ou">Suppression d’une OU</h4>
|
||
|
||
<p>Il est nécessaire qu’elle soit vide.</p>
|
||
|
||
<p>Supprimons l’OU newtest avec le fichier deleteou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=newtest,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: delete
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f deleteou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou bien un fichier deleteou.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ou=newtest,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldel -f deleteou.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="modification-dentrées">Modification d’entrées</h3>
|
||
|
||
<p>Dans notre cas, les entrées sont de deux types, les users et les groupes.</p>
|
||
|
||
<p>Listons les groupes :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "objectClass=groupOfNames"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=cloud,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn: cloud
|
||
description: Cloud
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
|
||
dn: cn=xoyize,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn:: eG95aXplIA==
|
||
description:: eG95aXplIA==
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Listons les users :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "objectClass=InetOrgPerson"
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
objectClass: person
|
||
objectClass: organizationalPerson
|
||
objectClass: inetOrgPerson
|
||
uid: yannick
|
||
sn: yannick
|
||
givenName: Yannick
|
||
cn: Yannick
|
||
displayName: Yannick
|
||
userPassword:: e1NTSEF9NW5UbDVjNWJXazBvdXZZYU9lTkROVU41OXZQWDdUZHM=
|
||
mail: yannick@xoyize.xyz
|
||
title: Admin
|
||
initials: Y
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="ajout-dun-utilisateur">Ajout d’un utilisateur</h4>
|
||
|
||
<p>Ajoutons un utilisateur toto avec le fichier adduser.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: top
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
uid: toto
|
||
sn: toto
|
||
givenName: toto
|
||
cn: toto
|
||
displayName: toto
|
||
userPassword: password
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f adduser.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="ajout-dun-groupe">Ajout d’un groupe</h4>
|
||
|
||
<p>Ajoutons un groupe test avec le fichier addgrp.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn: test
|
||
description: test
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f addgrp.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="déplacement-dun-utilisateur">Déplacement d’un utilisateur</h4>
|
||
|
||
<p>Déplaçons toto de ou=xoyize,ou=people,dc=xoyize,dc=xyz vers ou=client,ou=people,dc=xoyize,dc=xyz avec le fichier mvuser.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: uid=toto
|
||
deleteoldrdn: 1
|
||
newsuperior: ou=client,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f mvuser.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="déplacement-dun-groupe">Déplacement d’un groupe</h4>
|
||
|
||
<p>Déplaçons le groupe test de ou=workgroup,ou=group,dc=xoyize,dc=xyz vers ou=sysgroup,ou=group,dc=xoyize,dc=xyz avec le fichier mvgrp.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: cn=test
|
||
deleteoldrdn: 1
|
||
newsuperior: ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f mvgrp.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="renommer-un-utilisateur">Renommer un utilisateur</h4>
|
||
|
||
<p>Renommons toto en tata avec le fichier renameuser.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=client,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: uid=tata
|
||
deleteoldrdn: 1
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f renameuser.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ceci ne change que le nom de l’entrée dn: uid=tata,ou=client,ou=people,dc=xoyize,dc=xyz. Les autres attributs (cn, sn, etc..) s’ils doivent être renommés seront modifiés par une autre opération (voir plus bas).</p>
|
||
|
||
<h4 id="renommer-un-groupe">Renommer un groupe</h4>
|
||
|
||
<p>Renommons le groupe test en newtest avec le fichier renamegrp.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modrdn
|
||
newrdn: cn=newtest
|
||
deleteoldrdn: 1
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f renamegrp.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="supprimer-un-utilisateur">Supprimer un utilisateur</h4>
|
||
|
||
<p>Supprimons l’utilisateur tata à l’aide d’un fichier deluser.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=tata,ou=client,ou=people,dc=xoyize,dc=xyz
|
||
changetype: delete
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f deluser.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On aurait pu aussi directement faire :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldel uid=tata,ou=client,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="supprimer-un-groupe">Supprimer un groupe</h4>
|
||
|
||
<p>Supprimons le groupe newtest à l’aide d’un fichier delgrp.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=newtest,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: delete
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f delgrp.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou bien :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldel cn=newtest,ou=sysgroup,ou=group,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="modification-dattributs">Modification d’attributs</h3>
|
||
|
||
<p>Nous allons réinsérer un utilisateur test et un groupe test avant tout :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: top
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
uid: toto
|
||
sn: toto
|
||
givenName: toto
|
||
cn: toto
|
||
displayName: toto
|
||
userPassword: password
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f adduser.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
cn: test
|
||
description: test
|
||
objectClass: groupOfNames
|
||
member: cn=admin,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f addgrp.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="ajouter-un-attribut-à-un-utilisateur">Ajouter un attribut à un utilisateur</h4>
|
||
|
||
<p>Listons les attributs à notre disposition :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "cn=schema,cn=config" olcAttributeTypes
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou plus précises ment du schéma core :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "cn={0}core,cn=schema,cn=config" olcAttributeTypes
|
||
</code></pre></div></div>
|
||
|
||
<p>Ajoutons un attribut description à notre utilisateur toto avec un fichier addattribute.ldif :</p>
|
||
|
||
<p>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
add: description
|
||
description: Sa tete est egale a zero plus zero !</p>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f addattribute.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Et on peut vérifier l’ajout :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" uid=toto
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="ajouter-un-utilisateur-à-un-groupe">Ajouter un utilisateur à un groupe</h4>
|
||
|
||
<p>Regardons ce que propose la classe groupOfNames (dans le schéma core)</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "cn={0}core,cn=schema,cn=config" olcObjectClasses
|
||
</code></pre></div></div>
|
||
|
||
<p>On va trouver :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of n
|
||
ames (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $
|
||
seeAlso $ owner $ ou $ o $ description ) )
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour un groupe, ce qui est le plus fréquent d’ajouter comme attribut, c’est un utilisateur (ajout d’un membre dans un groupe…)</p>
|
||
|
||
<p>Bref, ajoutons donc notre utilisateur test dans le groupe test avec un fichier addusertogroup.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
add: member
|
||
member: uid=toto,ou=client,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f addusertogroup.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut vérifier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "(&(objectclass=inetOrgPerson)(memberof=cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz))" dn
|
||
</code></pre></div></div>
|
||
|
||
<p>Si on regarde la fiche de toto :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "uid=toto"
|
||
</code></pre></div></div>
|
||
|
||
<p>On constater qu’on ne voit pas l’attribut memberof (overlay que nous avons pourtant configuré. En effet, il faut le demander spécifiquement :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "uid=toto" memberof
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou alors, nous pouvons le voir avec cette commande :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "uid=toto" +
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="modifier-un-attribut-utilisateur">Modifier un attribut utilisateur</h4>
|
||
|
||
<p>Un attribut qui peut etre modifié fréquement sur un utilisateur, c’est le mot de passe. Modifions donc le mot de passe de toto avec un fichier chgpwd.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
replace: UserPassword
|
||
UserPassword: newpass
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f chgpwd.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Ceci dit, pour modifier un mot de passe, nous avons la commande ldappassword consacré à cet usage :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldappasswd -H ldap://localhost -D "uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz" -W -S
|
||
</code></pre></div></div>
|
||
|
||
<p>-W pour la demande de l’ancien mot de passe.</p>
|
||
|
||
<p>-S pour la demande d’un nouveau mot de passe (sinon, le nouveau mot de passe est généré aléatoirement)</p>
|
||
|
||
<p>Cette commande peut également servir à changer le mot de passe d’un autre utilisateur, par exemple, le compte admin demande à changer le mot de passe de l’utilisateur yannick :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldappasswd -D "cn=admin,dc=xoyize,dc=xyz" -w passsadmin -x "uid=yannick,ou=xoyize,ou=people,dc=xoyize,dc=xyz" -S
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="modifier-un-attribut-groupe">Modifier un attribut groupe</h4>
|
||
|
||
<p>Modifions la description de notre groupe test avec un fichier chgattr.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
replace: description
|
||
description: Nouvelle description
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f chgattr.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="supprimer-un-attribut-à-un-utilisateur">Supprimer un attribut à un utilisateur</h4>
|
||
|
||
<p>Supprimons l’attribut description de toto avec un fichier delattr.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
delete: description
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f delattr.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="supprimer-un-attribut-à-un-groupe">Supprimer un attribut à un groupe</h4>
|
||
|
||
<p>Pour un groupe, vous vous en doutez, un attribut qui peut etre amené à etre supprimé, c’est un membre. Supprimons donc toto du groupe test avec un ficher</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=test,ou=workgroup,ou=group,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
delete: member
|
||
member: uid=toto,ou=xoyize,ou=people,dc=xoyize,dc=xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Injection</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lmodif -f deluserfromgroup.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Vérification :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "dc=xoyize,dc=xyz" "(&(objectclass=groupOfNames)(cn=test))" member
|
||
</code></pre></div></div>
|
||
|
||
<h2 id="phpldapadmin">PhpLdapAdmin</h2>
|
||
|
||
<h3 id="pré-requis">Pré-requis</h3>
|
||
|
||
<p>Pour pouvoir utiliser phpLDAPadmin, vous aurez besoin des éléments suivants :</p>
|
||
|
||
<ul>
|
||
<li>Un serveur LDAP en cours d’exécution de votre choix, quelque part dans votre réseau.
|
||
phpLDAPadmin a été développé pour gérer un serveur OpenLDAP, mais il devrait également fonctionner avec d’autres serveurs LDAP. Si vous rencontrez des problèmes avec PLA et votre serveur LDAP, contactez les développeurs et ils se feront un plaisir d’apporter les modifications nécessaires pour que cela fonctionne.</li>
|
||
</ul>
|
||
|
||
<p>Votre serveur LDAP doit également fournir l’accès au schéma en utilisant un lien anonyme. Veuillez vous assurer que vous pouvez voir votre schéma sans avoir à vous lier au serveur LDAP. Un moyen de tester cela pourrait être aussi simple que :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ldapsearch -xh HOST -b ''' -s base subschemaSubentry
|
||
</code></pre></div></div>
|
||
|
||
<ul>
|
||
<li>Un serveur web (Nginx, Apache, IIS, etc.).</li>
|
||
<li>Votre serveur web configuré pour utiliser PHP v5 ou + . PHP doit être configuré avec :
|
||
<ul>
|
||
<li>Support PCRE</li>
|
||
<li>Prise en charge des SESSION</li>
|
||
<li>Support GETTEXT</li>
|
||
<li>Support LDAP</li>
|
||
<li>Support XML</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
|
||
<h3 id="installation">Installation</h3>
|
||
|
||
<ol>
|
||
<li>Installez et configurez votre serveur LDAP favori quelque part sur votre réseau. (Ou, obtenez vos détails LDAP auprès de votre administrateur LDAP.)</li>
|
||
<li>Assurez-vous d’avoir toutes les conditions préalables requises</li>
|
||
<li>git phpldapadmin version 1.25</li>
|
||
<li>Décompressez l’archive à un endroit pratique.</li>
|
||
<li>Placez le répertoire’phpldapadmin’ résultant quelque part dans votre webroot.</li>
|
||
<li>Copiez’config.php.example’ dans’config.php’ et éditez selon votre goût. <br />
|
||
<code class="language-plaintext highlighter-rouge">sudo cp /var/www/phpldapadmin/config/config.php.example /var/www/phpldapadmin/config/config.php</code></li>
|
||
<li>Ensuite, pointez votre navigateur vers le répertoire phpldapadmin → https://lm.xoyize.xyz</li>
|
||
</ol>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>git clone https://github.com/leenooks/phpLDAPadmin.git
|
||
sudo mv phpLDAPadmin /var/www/phpldapadmin
|
||
sudo chown www-data:www-data -R /var/www/phpldapadmin/
|
||
sudo cp /var/www/phpldapadmin/config/config.php.example /var/www/phpldapadmin/config/config.php
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="configuration-nginx">configuration nginx</h3>
|
||
|
||
<p>Fichier de configuration nginx <strong>/etc/nginx/conf.d/lm.xoyize.xyz.conf</strong></p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sudo nano /etc/nginx/conf.d/lm.xoyize.xyz.conf
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
|
||
## redirect http to https ##
|
||
server_name lm.xoyize.xyz;
|
||
return 301 https://$server_name$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name lm.xoyize.xyz;
|
||
|
||
include ssl_params;
|
||
include header_params;
|
||
# Diffie-Hellmann
|
||
# Uncomment the following directive after DH generation
|
||
# > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
|
||
# ssl_dhparam /etc/ssl/private/dh2048.pem;
|
||
|
||
root /var/www/phpldapadmin;
|
||
index index.php;
|
||
|
||
location ~ \.php$ {
|
||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||
fastcgi_pass unix:/run/php/php7.3-fpm.sock; # PHP7.3
|
||
fastcgi_index index.php;
|
||
include fastcgi_params;
|
||
fastcgi_param SCRIPT_FILENAME $request_filename;
|
||
}
|
||
|
||
|
||
access_log /var/log/nginx/lm.xoyize.xyz-access.log;
|
||
error_log /var/log/nginx/lm.xoyize.xyz-error.log;
|
||
}
|
||
|
||
</code></pre></div></div>
|
||
|
||
<p>Vérification et rechargement nginx</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sudo nginx -t
|
||
sudo systemctl reload nginx
|
||
</code></pre></div></div>
|
||
|
||
<p>Accès https://lm.xoyize.xyz</p>
|
||
|
||
<p><img src="/images/phpldapadmin01.png" alt="" width="400" /></p>
|
||
|
||
<p>Accès par le lien https://lm.xoyize.xyz</p>
|
||
|
||
<h1 id="xoyizexyz---serveur-messagerie-complet-ldap">xoyize.xyz - Serveur Messagerie complet (LDAP)</h1>
|
||
|
||
<ul>
|
||
<li>Gestion des adresses mails.</li>
|
||
<li>Gestion de plusieurs domaines.</li>
|
||
<li>Gestion des mails</li>
|
||
<li>Traitement Spam.</li>
|
||
<li>Utilisation du référentiel utilisateur du serveur LDAP.</li>
|
||
<li>Filtrage Sieve (sur le serveur directement).</li>
|
||
</ul>
|
||
|
||
<p>Les briques qui vont constituer l’architecture</p>
|
||
|
||
<ul>
|
||
<li>Postfix : Le point central de l’architecture, il assure la réception des mails des serveurs smtps extérieurs, l’envoi de mails vers eux et la soumission de message depuis les clients connectés.</li>
|
||
<li>Dovecot :
|
||
<ul>
|
||
<li>Première fonction : range les mails reçus depuis Postfix via lmtp dans les bals physiques des utilisateurs. Peut les trier dans des sous-répertoires en fonction de règles Sieve.</li>
|
||
<li>Deuxième fonction : permet aux utilisateurs de consulter leur boites aux lettres en IMAP à l’aide du client de leur choix (ou d’un webmail). Ici, je ne gère pas le pop car c’est le mal (plus sérieusement, tellement d’avantages avec l’Imap que je ne vois pas l’utilité de proposer du pop.</li>
|
||
<li>Troisième fonction : fournit le support AUTH à Postfix (pour l’envoi de message).</li>
|
||
</ul>
|
||
</li>
|
||
<li>Rspamd : Autre changement par rapport à ce que j’utilisais jusque la (Spamassassin). Ce dernier s’assure donc de traiter le spam pour les mails venant de l’extérieur, et de la signature DKIM pour les mails sortants.</li>
|
||
<li>Le serveur Openldap</li>
|
||
</ul>
|
||
|
||
<p>Pas de traitement antivirus, c’est lourd en terme de ressource, à voir ?</p>
|
||
|
||
<h2 id="ldap-_-messagerie">Ldap _ messagerie</h2>
|
||
|
||
<h3 id="création-utilisateurs">Création utilisateurs</h3>
|
||
|
||
<p>Premier utilisateur dans un fichier userym.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=ym,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
uid: ym
|
||
sn: ym
|
||
givenName: ym
|
||
cn: ym
|
||
displayName: ym
|
||
userPassword: mot-de-passe-ym
|
||
mail: ym@xoyize.xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Second dans un fichier usercm.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=cm,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
uid: cm
|
||
sn: cm
|
||
givenName: cm
|
||
cn: cm
|
||
displayName: cm
|
||
userPassword: mot-de-passe-cm
|
||
mail: cm@xoyize.xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour terminer en injectant les deux :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f userym.ldif
|
||
ladd -f usercm.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="explication-de-lorganisation-ldap">Explication de l’organisation LDAP</h3>
|
||
|
||
<p>Jusque la, je stocke mes comptes utilisateur. Ceci dit, il me manque des attributs, que je rajouterais via un schéma personnel.</p>
|
||
|
||
<p>Au niveau domaine, j’en ai deux : xoyize.fr, ouestline.net et je gère deux compte mails toto@xoyize.fr et tata@xoyize.fr. Toutes les autres adresses de xoyize et ouestline (par ex ccc@xoyize.fr, aaa@ouestline.net, bbb@ouestline.net, etc.. seront renvoyés soit vers toto@xoyize.fr soit vers tata@xoyize.fr</p>
|
||
|
||
<p>Pour la gestion domaines et alias, j’ai donc choisi de faire de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dc=xoyize,dc=xyz
|
||
ou=people,dc=xoyize,dc=xyz
|
||
"Stockage de mes utilisateurs"
|
||
ou=mail,dc=xoyize,dc=xyz
|
||
ou=xoyize.fr,
|
||
cn=alias1@xoyize.fr,ou=xoyize.fr,ou=mail,dc=xoyize,dc=xyz
|
||
attr: mailfrom: alias@xoyize.fr
|
||
attr: mailto: toto@xoyize.fr
|
||
etc...
|
||
ou=ouestline.net,
|
||
etc...
|
||
</code></pre></div></div>
|
||
|
||
<p>Chaque domaine sera une OU dans une nouvelle OU créée pour l’occasion.</p>
|
||
|
||
<p>Et dans chaque OU, je crée des entrées correspondants aux alias, la aussi avec l’aide de schéma supplémentaire</p>
|
||
|
||
<p>Mes domaines auraient très bien pu être non pas des OU mais des entrées, au niveau de l’OU mail et les alias définies par des attributs soit dans ces entrées soit dans les entrées des users. Je vous le disais, on peut vraiment faire comme on veut.</p>
|
||
|
||
<h3 id="mise-en-place">Mise en place</h3>
|
||
|
||
<h4 id="le-schéma">Le Schéma</h4>
|
||
|
||
<p>On va créer un fichier <strong>schema.ldif</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=mailxoyize,cn=schema,cn=config
|
||
objectClass: olcSchemaConfig
|
||
cn: mailxoyize
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.20 NAME 'mailaccountquota' DESC 'Quota Mail' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.21 NAME 'mailaccountactif' DESC 'Mail Actif' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.40 NAME 'mailaliasfrom' DESC 'Mail From' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.41 NAME 'mailaliasto' DESC 'Mail To' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.42 NAME 'mailaliasactif' DESC 'Alias Actif' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.60 NAME 'maildomain' DESC 'Domaine' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcAttributeTypes: ( 1.3.6.1.4.1.99999.2.2.61 NAME 'maildomainactif' DESC 'Domaine Actif' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||
olcObjectClasses: ( 1.3.6.1.4.1.99999.2.1.20 NAME 'mailaccountxoyize' SUP TOP AUXILIARY MUST ( mailaccountquota $ mailaccountactif))
|
||
olcObjectClasses: ( 1.3.6.1.4.1.99999.2.1.40 NAME 'mailaliasxoyize' SUP TOP STRUCTURAL MUST ( cn $ mailaliasfrom $ mailaliasto $ mailaliasactif))
|
||
olcObjectClasses: ( 1.3.6.1.4.1.99999.2.1.60 NAME 'maildomainxoyize' SUP TOP AUXILIARY MUST ( maildomain $ maildomainactif))
|
||
</code></pre></div></div>
|
||
|
||
<p>Vous voyez trois séries de chiffres dans le fichier.<br />
|
||
L’OID 1.3.6.1.4.1.99999.2.2.x correspond à la hiérarchie de mes attributs (la branche 1.3.6.1.4.1 est la branche dédiée aux OID privés : voir ici).<br />
|
||
Le 99999 devrait être dans l’idéal remplacé par le PEN que vous pouvez obtenir sur cette page. Si vous ne destinez pas votre schéma a être public, ça n’a pas trop d’importance, mais attention à ne pas prendre un numéro déjà existant si un jour vous importez un schéma avec ce numéro, bref, vous voyez le topo. J’ai fais la demande, j’ai eu mon PEN en 72h je crois…<br />
|
||
L’OID 1.3.6.1.4.1.99999.2.1.x est sur le même modèle mais définit un objet.<br />
|
||
L’OID 1.3.6.1.4.1.1466.115.121.1.15 correspond à la définition d’une directory string (chaîne de caractère), je fais simple et prend ce type de donnée pour mes nouveau attributs.</p>
|
||
|
||
<p>Ce schéma est au final assez simple, je rajoute trois nouvelles classe d’objets : mailaccountxoyize, maildomainxoyize et mailaliasxoyize (qui à la particularité d’être structural, c’est à dire que ce pourra être une entrée sans ajout d’autre classe (par ex, inetogperson, etc…).<br />
|
||
Chaque classe possède des attributs obligatoire (MUST).</p>
|
||
|
||
<p>L’attribut mailaliasto est le seule à ne pas avoir SINGLE-VALUE, en effet, un alias peut renvoyer vers plusieurs bals.</p>
|
||
|
||
<p>On va ajouter notre schéma :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f schema.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="les-ous-pour-nos-domaines">Les OUs pour nos domaines</h4>
|
||
|
||
<p>Ensuite, on va créer nos nouvelles OUs dans un fichier <strong>oumail.ldif</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: ou=mail,dc=xoyize,dc=xyz
|
||
ou: people
|
||
objectClass: organizationalUnit
|
||
|
||
dn: ou=xoyize.fr,ou=mail,dc=xoyize,dc=xyz
|
||
ou: xoyize.fr
|
||
objectClass: organizationalUnit
|
||
objectClass: maildomainxoyize
|
||
description: Domaine mail primaire
|
||
maildomain: xoyize.fr
|
||
maildomainactif: YES
|
||
|
||
dn: ou=ouestline.net,ou=mail,dc=xoyize,dc=xyz
|
||
ou: ouestline.net
|
||
objectClass: organizationalUnit
|
||
objectClass: maildomainxoyize
|
||
description: Domaine mail secondaire
|
||
maildomain: ouestline.net
|
||
maildomainactif: YES
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f oumail.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="les-alias">Les Alias</h4>
|
||
|
||
<p>Puis on passe à la création des entrées pour les alias dans un fichier alias.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: cn=postmaster@xoyize.fr,ou=xoyize.fr,ou=mail,dc=xoyize,dc=xyz
|
||
objectclass: mailaliasxoyize
|
||
cn: postmaster@xoyize.fr
|
||
mailaliasfrom: postmaster@xoyize.fr
|
||
mailaliasto: ym@xoyize.fr
|
||
mailaliasactif: YES
|
||
|
||
dn: cn=postmaster@ouestline.net,ou=ouestline.net,ou=mail,dc=xoyize,dc=xyz
|
||
objectclass: mailaliasxoyize
|
||
cn: postmaster@ouestline.net
|
||
mailaliasfrom: postmaster@ouestline.net
|
||
mailaliasto: ym@xoyize.fr
|
||
mailaliasactif: YES
|
||
|
||
dn: cn=testalias@xoyize.fr,ou=xoyize.fr,ou=mail,dc=xoyize,dc=xyz
|
||
objectclass: mailaliasxoyize
|
||
cn: testalias@xoyize.fr
|
||
mailaliasfrom: testalias@xoyize.fr
|
||
mailaliasto: ym@xoyize.fr
|
||
mailaliasto: cm@xoyize.fr
|
||
mailaliasactif: YES
|
||
</code></pre></div></div>
|
||
|
||
<p>A vous bien sur de faire vos propres alias en fonction de vos besoins.</p>
|
||
|
||
<p>On injecte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f alias.ldif
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="les-nouveaux-attributs-des-utilisateurs">Les nouveaux attributs des utilisateurs</h4>
|
||
|
||
<p>Et pour finir, on va rajouter les attributs de la classe mailaccountxoyize à nos utilisateurs.</p>
|
||
|
||
<p>Fichier attrym.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=ym,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
add: objectclass
|
||
objectclass: mailaccountxoyize
|
||
-
|
||
add: mailaccountquota
|
||
mailaccountquota: 0
|
||
-
|
||
add: mailaccountactif
|
||
mailaccountactif: YES
|
||
</code></pre></div></div>
|
||
|
||
<p>Fichier attrcm.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=cm,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
add: objectclass
|
||
objectclass: mailaccountxoyize
|
||
-
|
||
add: mailaccountquota
|
||
mailaccountquota: 0
|
||
-
|
||
add: mailaccountactif
|
||
mailaccountactif: YES
|
||
</code></pre></div></div>
|
||
|
||
<p>On injecte ces deux fichiers :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f attrym.ldif
|
||
ladd -f attrcm.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>Par la suite, pour ajouter un nouvel utilisateur, on pourra bien évidemment tout faire en un bloc :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=new,ou=people,dc=xoyize,dc=xyz
|
||
objectclass: person
|
||
objectclass: organizationalPerson
|
||
objectclass: inetOrgPerson
|
||
objectclass: mailaccountxoyize
|
||
uid: new
|
||
sn: new
|
||
givenName: new
|
||
cn: new
|
||
displayName: new
|
||
userPassword: {SSHA}.....
|
||
mail: new@xoyize.fr
|
||
mailaccountquota: 0
|
||
mailaccountactif: YES
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="tests">Tests</h4>
|
||
|
||
<p>On peut déjà tester en listant par exemple les domaines gérés :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "ou=mail,dc=xoyize,dc=xyz" "(&(objectClass=maildomainxoyize))" ou
|
||
</code></pre></div></div>
|
||
|
||
<p>Ou encore, pour savoir par exemple vers quelle bal renvoie l’alias postmaster@xoyize.fr :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>lsearch -b "ou=mail,dc=xoyize,dc=xyz" "(&(objectClass=mailaliasxoyize)(mailaliasfrom=postmaster@xoyize.fr))" mailaliasto
|
||
</code></pre></div></div>
|
||
|
||
<p>Voila qui termine la partie LDAP pour l’utilisation avec un serveur de messagerie.</p>
|
||
|
||
<h3 id="postfix">Postfix</h3>
|
||
|
||
<h4 id="reverse-dns">Reverse DNS</h4>
|
||
|
||
<p>Il est nécessaire que son reverse dns soit correctement configuré : si on demande l’adresse de mail.domaine1.fr et qu’on a XXX.XXX.XXX.XXX, il faut qu’en demandant le reverse de XXX.XXX.XX.XXX on obtienne mail.domaine1.fr</p>
|
||
|
||
<p>dig xoyize.xyz</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>;; ANSWER SECTION:
|
||
xoyize.xyz. 3356 IN A 78.235.240.223
|
||
</code></pre></div></div>
|
||
|
||
<p>dig -x 78.235.240.223</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>;; ANSWER SECTION:
|
||
223.240.235.78.in-addr.arpa. 86400 IN PTR xoyize.xyz.
|
||
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="dns">DNS</h3>
|
||
|
||
<p>OVH</p>
|
||
|
||
<p>Test</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dig xoyize.xyz MX +short
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>10 xoyize.xyz.
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="routeur---iptables">Routeur - iptables</h3>
|
||
|
||
<p>Modifier le fichier <strong>/sbin/iptables-firewall.sh</strong></p>
|
||
|
||
<p>Ajouter les lignes</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code># Postfix SMTP,SMTPS, SUBMISSION
|
||
#iptables -A INPUT -p tcp --dport 25 -j ACCEPT
|
||
#iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 465 -j ACCEPT
|
||
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 587 -j ACCEPT
|
||
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT
|
||
# Imap and ImapS
|
||
#iptables -A INPUT -p tcp --dport 143 -j ACCEPT
|
||
#iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 993 -j ACCEPT
|
||
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT
|
||
# Managesieve
|
||
iptables -A INPUT -p tcp --dport 4190 -j ACCEPT
|
||
iptables -A OUTPUT -p tcp --dport 4190 -j ACCEPT
|
||
</code></pre></div></div>
|
||
|
||
<p>Redémarrer le parefeu</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sudo systemctl restart iptables-firewall
|
||
</code></pre></div></div>
|
||
|
||
<p>Les définitions des ports dans le domaine du mail</p>
|
||
|
||
<ul>
|
||
<li>25 -> SMTP utilisé pour l’envoi de mail vers le serveur depuis d’autres serveurs.</li>
|
||
<li>465 -> SMTPS (chiffrement SSL/TLS), utilisé par les logiciels clients pour envoyer des mails vers le serveur.</li>
|
||
<li>587 -> SUBMISSION (chiffrement STARTLS), lui aussi utilisé par les logiciels clients pour envoyer des mails vers le serveur.</li>
|
||
<li>143 -> IMAP permet de consulter sa messagerie, depuis un logiciel client, un webmail, un smartphone, etc…</li>
|
||
<li>993 -> IMAPS (chiffrement SSL/TLS)</li>
|
||
<li>4190 -> Managesieve</li>
|
||
</ul>
|
||
|
||
<h3 id="installation-postfix--dovecot">Installation postfix + dovecot</h3>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install postfix postfix-ldap ca-certificates
|
||
</code></pre></div></div>
|
||
|
||
<p>Lors de l’installation de Postfix, répondez :</p>
|
||
|
||
<p>Site Internet<br />
|
||
xoyize.fr</p>
|
||
|
||
<p>Pour ca-certificates, il est toujours bon de l’avoir, et il nous sera utile pour l’installation de Rspamd plus tard.</p>
|
||
|
||
<p>on installe Dovecot</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install dovecot-core dovecot-imapd dovecot-ldap dovecot-managesieved dovecot-sieve dovecot-lmtpd
|
||
</code></pre></div></div>
|
||
|
||
<blockquote>
|
||
<p>le script de mise à jour du certificat redémarre les services postfix et dovecot , donc autant éviter des erreurs dès le début…</p>
|
||
</blockquote>
|
||
|
||
<h3 id="certificats">Certificats</h3>
|
||
|
||
<p>gérer le certificat avec acme.sh (client pour Let’s Encrypt, plus d’informations dans mon article) :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install git socat
|
||
</code></pre></div></div>
|
||
|
||
<p>Installons maintenant acme.sh :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cd
|
||
mkdir sources
|
||
cd sources/
|
||
git clone https://github.com/Neilpang/acme.sh.git
|
||
cd ./acme.sh
|
||
./acme.sh --install
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge le bash :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>source /root/.bashrc
|
||
</code></pre></div></div>
|
||
|
||
<p>Et on lance la création du certificat :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>acme.sh --issue -k 4096 --standalone -d xoyize.fr --log
|
||
</code></pre></div></div>
|
||
|
||
<p>On installe le certificat :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /etc/ssl/private/xoyize.fr
|
||
acme.sh --installcert -d xoyize.fr --cert-file /etc/ssl/private/xoyize.fr/cert.pem --key-file /etc/ssl/private/xoyize.fr/key.pem --ca-file /etc/ssl/private/xoyize.fr/ca.pem --fullchain-file /etc/ssl/private/xoyize.fr/fullcert.pem --reloadCmd 'service postfix reload && service dovecot reload'
|
||
</code></pre></div></div>
|
||
|
||
<p>On génère nos clés DH :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>openssl dhparam -out /etc/ssl/private/dh512.pem 512
|
||
openssl dhparam -out /etc/ssl/private/dh2048.pem 2048
|
||
chmod 644 /etc/ssl/private/dh{512,2048}.pem
|
||
</code></pre></div></div>
|
||
|
||
<p>La commande installcert met également en place une tache cron pour le renouvellement automatique de votre certificat qui du coup, renouvelle, copie ou il faut et relance, parfait !</p>
|
||
|
||
<p>Les certificatts sous xoyize.xyz</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code> ls /etc/ssl/private/
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dh2048.pem ouestline.net-chain.pem ssl-cert-snakeoil.key xoyize.xyz-fullchain.pem
|
||
dh512.pem ouestline.net-fullchain.pem xoyize.xyz-ca.pem xoyize.xyz-key.pem
|
||
ouestline.net-ca.pem ouestline.net-key.pem xoyize.xyz-chain.pem
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="postfix---la-base">Postfix - La base</h3>
|
||
|
||
<p>On va recréer le fichier <strong>/etc/postfix/main.cf</strong></p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
||
biff = no
|
||
|
||
# appending .domain is the MUA's job.
|
||
append_dot_mydomain = yes
|
||
|
||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
||
#mynetworks = 10.0.0.0/8
|
||
inet_interfaces = all
|
||
inet_protocols = ipv4
|
||
|
||
readme_directory = no
|
||
compatibility_level = 2
|
||
|
||
notify_classes = bounce, delay, policy, protocol, resource, software
|
||
myhostname = xoyize.xyz
|
||
mydestination = $myhostname, mail, localhost.localdomain, localhost
|
||
myorigin = $myhostname
|
||
disable_vrfy_command = yes
|
||
strict_rfc821_envelopes = yes
|
||
show_user_unknown_table_name = no
|
||
message_size_limit = 0
|
||
mailbox_size_limit = 0
|
||
allow_percent_hack = no
|
||
swap_bangpath = no
|
||
recipient_delimiter = +
|
||
alias_maps = hash:/etc/aliases
|
||
alias_database = hash:/etc/aliases
|
||
|
||
broken_sasl_auth_clients=yes
|
||
|
||
smtp_tls_security_level = may
|
||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_tlscache
|
||
|
||
smtpd_tls_loglevel = 1
|
||
smtpd_tls_security_level = may
|
||
smtpd_tls_auth_only = yes
|
||
smtpd_tls_key_file = /etc/ssl/private/xoyize.xyz-key.pem
|
||
smtpd_tls_cert_file = /etc/ssl/private/xoyize.xyz-ca.pem
|
||
smtpd_tls_CAfile = /etc/ssl/private/xoyize.xyz-fullchain.pem
|
||
smtpd_tls_protocols = !SSLv2 !SSLv3
|
||
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
|
||
smtpd_tls_mandatory_ciphers = high
|
||
smtpd_tls_eecdh_grade = strong
|
||
smtpd_tls_dh512_param_file = /etc/ssl/private/dh512.pem
|
||
smtpd_tls_dh1024_param_file = /etc/ssl/private/dh2048.pem
|
||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_tlscache
|
||
smtpd_tls_session_cache_timeout = 3600s
|
||
smtpd_tls_received_header = yes
|
||
|
||
smtpd_sasl_auth_enable = yes
|
||
smtpd_sasl_path = private/auth
|
||
smtpd_sasl_type = dovecot
|
||
smtpd_sasl_security_options = noanonymous, noplaintext
|
||
smtpd_sasl_tls_security_options = noanonymous
|
||
|
||
tls_preempt_cipherlist = yes
|
||
tls_high_cipherlist = ALL EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !MEDIUM !3DES !MD5 !EXP !PSK !SRP !DSS !RC4
|
||
tls_ssl_options = no_ticket, no_compression
|
||
smtpd_helo_required = yes
|
||
|
||
smtpd_client_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_unknown_reverse_client_hostname,
|
||
reject_unauth_pipelining
|
||
|
||
smtpd_helo_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_invalid_helo_hostname,
|
||
reject_non_fqdn_helo_hostname,
|
||
reject_unauth_pipelining
|
||
|
||
smtpd_sender_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_non_fqdn_sender,
|
||
reject_unknown_sender_domain,
|
||
reject_unauth_pipelining
|
||
|
||
smtpd_relay_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_unauth_destination
|
||
|
||
smtpd_recipient_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_non_fqdn_recipient,
|
||
reject_unknown_recipient_domain,
|
||
reject_unauth_pipelining
|
||
|
||
smtpd_data_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_multi_recipient_bounce,
|
||
reject_unauth_pipelining
|
||
|
||
virtual_transport = lmtp:unix:private/dovecot-lmtp
|
||
virtual_mailbox_domains = ldap:/etc/postfix/ldap/virtual_domains.cf
|
||
virtual_mailbox_maps = ldap:/etc/postfix/ldap/virtual_mailbox.cf
|
||
virtual_alias_maps = ldap:/etc/postfix/ldap/virtual_alias.cf
|
||
</code></pre></div></div>
|
||
|
||
<p>Quelques explications :</p>
|
||
|
||
<p>append_dot_mydomain = yes</p>
|
||
|
||
<p>ajoute le domaine au mail locaux qui sont envoyés (si un mail local est envoyé depuis un service sur le serveur, genre cron, etc… il sera de la forme root@xoyize.xyz au lieu de root@mail).</p>
|
||
|
||
<p>Centralisant tous mes mails, éventuellement d’autres serveur, c’est une info dont j’ai besoin (on peut aussi réécrire l’expéditeur, etc..).</p>
|
||
|
||
<p>notify_classes = bounce, delay, policy, protocol, resource, software</p>
|
||
|
||
<p>Définit les messages d’erreurs que recoit le postmaster. A affiner selon ce que vous voulez. Voir la doc de Postfix pour plus de détails.</p>
|
||
|
||
<p>myhostname = xoyize.xyz
|
||
mydestination = $myhostname, mail, localhost.localdomain, localhost</p>
|
||
|
||
<p>Le nom de votre serveur de mail. Peut être différent, mais dans mon cas, vu ma config Dns, de l’extérieur ou de l’interieur, ca reste le meme nom.
|
||
Ensuite, les destinations qu’il accepte. On ne liste ici aucun domaine qu’on gère, ceux ci sont déclarés dans les alias virtuels.</p>
|
||
|
||
<p>Pour la partie SSL/TLS/SALS on remarque deux groupes d’options : smtp_* et smtpd_*</p>
|
||
|
||
<p>Smtp concerne la patie client de postfix, c’est à dire celle qui envoie les mails aux autres serveurs SMTP (aussi appelés MX).
|
||
Smtpd concerne la partie serveur, celle qui recoit les mails, soit des clients, soit des autres MX.</p>
|
||
|
||
<p>smtp_tls_security_level = may</p>
|
||
|
||
<p>indique que le client SMTP de postfix, quand il se connecte à un autre MX, supporte le TLS.</p>
|
||
|
||
<p>smtpd_tls_security_level = may</p>
|
||
|
||
<p>indique que le serveur SMTP de Postfix, quand il reçoit une connexion d’un client (mx ou soumis), supporte le TLS.</p>
|
||
|
||
<p>On le laisse à may pour indiquer que c’est possible sans être obligatoire. On le surchargera dans le fichier master.cf</p>
|
||
|
||
<p>Ne pas confondre aussi <em>sasl</em> et <em>tls</em> ! <em>sasl</em> concerne l’authentification de nos utilisateusr (via Dovecot) et <em>tls</em> le chiffrement des communications.</p>
|
||
|
||
<p>smtpd_tls_auth_only = yes</p>
|
||
|
||
<p>indique que si l’authentification est utilisé, on doit forcement être en SSL (ou TLS, ca revient au meme.)</p>
|
||
|
||
<p>On va ensuite modifier le fichier <strong>/etc/postfix/master.cf</strong> au début</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>submission inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
</code></pre></div></div>
|
||
|
||
<p>On active submission, et on surchage (-o le parametre smtpd_tls_security_level à encrypt pour forcer le tls.</p>
|
||
|
||
<p>Un peu plus bas, on va activer le smtps :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtps inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_tls_wrappermode=yes
|
||
</code></pre></div></div>
|
||
|
||
<p>Le reste ne change pas.</p>
|
||
|
||
<p>Pourquoi Postfix utilise deux fichiers de configuration ?</p>
|
||
|
||
<p>Le fichier main.cf définit les options générales de Postfix. Le fichier master.cf, lui sert à gérer les sous process de Postfix et permet de modifier certains paramètres du fichier main.cf en les surchargeant (option -o).</p>
|
||
|
||
<h3 id="postfix---ldap">Postfix - Ldap</h3>
|
||
|
||
<p>On va créer nos fichiers chargé de faire la liaison avec le serveur ldap et les ranger :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /etc/postfix/ldap
|
||
cd /etc/postfix/ldap
|
||
</code></pre></div></div>
|
||
|
||
<p>Fichier virtual_domains.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = ou=mail,dc=xoyize,dc=xyz
|
||
scope = sub
|
||
query_filter = (&(maildomain=%s)(objectClass=maildomainxoyize)(maildomainactif=YES))
|
||
result_attribute = maildomain
|
||
</code></pre></div></div>
|
||
|
||
<p>Fichier virtual_mailbox.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = ou=people,dc=xoyize,dc=xyz
|
||
scope = sub
|
||
query_filter = (&(mail=%s)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
result_attribute = mail
|
||
</code></pre></div></div>
|
||
|
||
<p>Et le fichier virtual_alias.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = ou=mail,dc=xoyize,dc=xyz
|
||
scope = sub
|
||
query_filter = (&(mailaliasfrom=%s)(objectClass=mailaliasxoyize)(mailaliasactif=YES))
|
||
result_attribute = mailaliasto
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour des explications sur les filtres, vous en aurez dans la partie suivante, consacrée à Dovecot.</p>
|
||
|
||
<p>On sécurise :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chmod 640 /etc/postfix/ldap/
|
||
chown :postfix /etc/postfix/ldap/*
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis on recharge Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Et on peut tester les liens avec le ldap :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap -q xoyize.xyz ldap:/etc/postfix/ldap/virtual_domains.cf
|
||
</code></pre></div></div>
|
||
|
||
<p>nous retourne le domaine s’il existe.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap -q postmaster@xoyize.xyz ldap:/etc/postfix/ldap/virtual_alias.cf
|
||
</code></pre></div></div>
|
||
|
||
<p>donne le compte vers le lequel est envoyé l’alias.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap -q ym@xoyize.xyz ldap:/etc/postfix/ldap/virtual_mailbox.cf
|
||
</code></pre></div></div>
|
||
|
||
<p>nous retourne le mail s’il existe.</p>
|
||
|
||
<h4 id="alias-locaux">Alias locaux</h4>
|
||
|
||
<p>Il reste un dernier petit point, les alias locaux de la machine.</p>
|
||
|
||
<p>Comme je l’ai dis avant, je veux qu’à terme, ce serveur mail gère également les mails de mes autres vm pour tout centraliser.</p>
|
||
|
||
<p>Et je veux tout rapatrier sur mon adresse mail ym@xoyize.xyz.</p>
|
||
|
||
<p>On édite le fichier /etc/aliases pour y mettre :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmaster: postmaster@xoyize.xyz
|
||
root: ym@xoyize.xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour mémoire, postmaster@xoyize.xyz est défini comme un alias de ym@xoyize.xyz dans le ldap.</p>
|
||
|
||
<p>On exécute la commande :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>newaliases
|
||
</code></pre></div></div>
|
||
|
||
<p>pour convertir cela en fichier un fichier compréhensible de postfix et on le recharge :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="postfix---conclusion">Postfix - Conclusion</h4>
|
||
|
||
<p>Postfix est opérationnel. Vous voyez, ce n’est pas si terrible ! On ne fait qu’effleurer la configuration, la documentation de Postfix est très complète et on peut configurer plein de scénarios…</p>
|
||
|
||
<p>Maintenant pour le tester, comme nous n’avons pas encore Dovecot derriere, on va se contenter de juste tester la communication d’un MX vers le nôtre :</p>
|
||
|
||
<p>Le site https://www.checktls.com/TestReceiver permet de faire cette vérification, et l’on voit de suite si le TLS est bon. On peut aussi classiquement en telnet, mais c’est… long…</p>
|
||
|
||
<p>Le site https://mxtoolbox.com/ est très pratique également.</p>
|
||
|
||
<p>Ha oui, au passage, le fichier clé pour debug, c’est bien évidement le fidèle :</p>
|
||
|
||
<p>/var/log/mail.log</p>
|
||
|
||
<h2 id="dovecot">Dovecot</h2>
|
||
|
||
<h3 id="dovecot---la-base">Dovecot - La base</h3>
|
||
|
||
<h4 id="utilisateur-vmail">Utilisateur Vmail</h4>
|
||
|
||
<p>Nous allons créer l’utilisateur virtuel vmail ainsi que le répertoire qui stockera les mails :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>groupadd -g 11000 vmail
|
||
useradd -g vmail -u 11000 vmail -d /var/vmail -m
|
||
chown vmail: /var/vmail -R
|
||
chmod 770 /var/vmail
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="du-ménage">Du ménage</h4>
|
||
|
||
<p>Concernant la configuration de Dovecot, celui ci à la mauvaise idée de tout éclater dans une foultitude de fichiers.
|
||
Avant tout, faisons donc du tri…</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cd /etc/dovecot/conf.d
|
||
rm 10-director* 10-tcpwrapper* 90-acl* auth-*
|
||
</code></pre></div></div>
|
||
|
||
<p>et dans le répertoire /etc/dovecot :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cd /etc/dovecot
|
||
rm dovecot-dict-* dovecot-sql.conf.ext dovecot-ldap.conf.ext
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="de-la-config">De la config</h4>
|
||
|
||
<p>On passe maintenant à la configuration. On va éditer le fichier /etc/dovecot/dovecot.conf et tout remplacer par :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>protocols = imap lmtp
|
||
|
||
!include conf.d/*.conf
|
||
</code></pre></div></div>
|
||
|
||
<p>Oui, c’est concis, le reste sera dans le sous répertoire conf.d :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cd /etc/dovecot/conf.d
|
||
</code></pre></div></div>
|
||
|
||
<p>Et la pour chaque fichier, remplacez tout son contenu par ce que je vous donne.</p>
|
||
|
||
<p>1 – Fichier 10-auth.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 10-auth.conf << EOF
|
||
auth_cache_size = 0
|
||
auth_cache_ttl = 1 hour
|
||
auth_cache_negative_ttl = 1 hour
|
||
auth_mechanisms = plain
|
||
passdb {
|
||
driver = ldap
|
||
args = /etc/dovecot/dovecot-ldap-pass.conf.ext
|
||
}
|
||
userdb {
|
||
driver = prefetch
|
||
}
|
||
userdb {
|
||
driver = ldap
|
||
args = /etc/dovecot/dovecot-ldap-user.conf.ext
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans ce fichier, on déclare la façon dont Dovecot récupère les infos. On reviendra plus en détail dessus après…</p>
|
||
|
||
<p>2 – Fichier 10-logging.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 10-logging.conf << EOF
|
||
#log_path = syslog
|
||
#debug_log_path =
|
||
#syslog_facility = mail
|
||
#auth_verbose = no
|
||
#auth_verbose_passwords = no
|
||
#auth_debug = no
|
||
#auth_debug_passwords = no
|
||
#mail_debug = no
|
||
#verbose_ssl = no
|
||
|
||
plugin {
|
||
#mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
|
||
# Available fields: uid, box, msgid, from, subject, size, vsize, flags
|
||
# size and vsize are available only for expunge and copy events.
|
||
#mail_log_fields = uid box msgid size
|
||
}
|
||
|
||
#log_timestamp = "%b %d %H:%M:%S "
|
||
#login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c
|
||
#login_log_format = %$: %s
|
||
#mail_log_prefix = "%s(%u): "
|
||
|
||
# %$ - Delivery status message (e.g. "saved to INBOX")
|
||
# %m - Message-ID
|
||
# %s - Subject
|
||
# %f - From address
|
||
# %p - Physical size
|
||
# %w - Virtual size
|
||
#deliver_log_format = msgid=%m: %$
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Ici, auth_verbose et auth_debug sont bien pratiques en cas de soucis avec les connexions au LDAP, mail_debug pour les filtres Sieves (et autres, quota, etc…).</p>
|
||
|
||
<p>3 – Fichier 10-mail.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 10-mail.conf << EOF
|
||
mail_home = /var/vmail/%d/%n
|
||
mail_location = maildir:~/mailbox
|
||
|
||
namespace inbox {
|
||
separator = /
|
||
inbox = yes
|
||
}
|
||
|
||
mail_uid = 11000
|
||
mail_gid = 11000
|
||
mail_privileged_group = vmail
|
||
first_valid_uid = 11000
|
||
last_valid_uid = 11000
|
||
first_valid_gid = 11000
|
||
last_valid_gid = 11000
|
||
|
||
mail_plugins = $mail_plugins
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Emplacement des mails que je range en fonction du domaine et du nom. Ensuite,uig/gid de vmail… Rien de sorcier.</p>
|
||
|
||
<p>4 – Fichier 10-master.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 10-master.conf << EOF
|
||
mail_fsync = never
|
||
|
||
service imap-login {
|
||
# inet_listener imap {
|
||
# port = 143
|
||
# }
|
||
inet_listener imaps {
|
||
port = 993
|
||
ssl = yes
|
||
}
|
||
}
|
||
|
||
service imap {
|
||
service_count = 64
|
||
process_min_avail = 1
|
||
}
|
||
|
||
service lmtp {
|
||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||
group = postfix
|
||
mode = 0600
|
||
user = postfix
|
||
}
|
||
}
|
||
|
||
service auth {
|
||
unix_listener /var/spool/postfix/private/auth {
|
||
mode = 0660
|
||
user = postfix
|
||
group = postfix
|
||
}
|
||
}
|
||
|
||
service auth-worker {
|
||
user = vmail
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans ce fichier, on déclare nos services : imap-login, imap, lmtp (utilisé pour le transfert de mails entre Postfix et Dovecot) et le service auth, qui service à Postfix pour authentifier les utilisateurs en SMTPS.</p>
|
||
|
||
<p>5 – Fichier 10-ssl.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 10-ssl.conf << EOF
|
||
ssl = required
|
||
ssl_cert = </etc/ssl/private/xoyize.xyz-chain.pem
|
||
ssl_key = </etc/ssl/private/xoyize.xyz-key.pem
|
||
ssl_dh = </etc/ssl/private/dh2048.pem
|
||
ssl_min_protocol = !TLSv1.2
|
||
ssl_cipher_list = EECDH+AES:EDH+AES+aRSA
|
||
ssl_prefer_server_ciphers = yes
|
||
verbose_ssl = yes
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Le SSL, classique…</p>
|
||
|
||
<p>6 – Fichier 15-mailboxes.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 15-mailboxes.conf << EOF
|
||
namespace inbox {
|
||
separator = /
|
||
mailbox Drafts {
|
||
auto = subscribe
|
||
special_use = \Drafts
|
||
}
|
||
mailbox Junk {
|
||
auto = subscribe
|
||
special_use = \Junk
|
||
}
|
||
mailbox Trash {
|
||
auto = subscribe
|
||
special_use = \Trash
|
||
}
|
||
mailbox Sent {
|
||
auto = subscribe
|
||
special_use = \Sent
|
||
}
|
||
mailbox Archive {
|
||
auto = subscribe
|
||
special_use = \Archive
|
||
}
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>La, on définit l’architecture de base de nos boites aux lettres. Création des répertoires spéciaux et auto souscription pour que l’utilisateur les voit de suite.</p>
|
||
|
||
<p>7 – Fichier 20-imap.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 20-imap.conf << EOF
|
||
imap_idle_notify_interval = 30 mins
|
||
|
||
protocol imap {
|
||
mail_max_userip_connections = 50
|
||
mail_plugins = $mail_plugins imap_sieve
|
||
postmaster_address = postmaster@xoyize.xyz
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Configuration du protocole IMAP.</p>
|
||
|
||
<p>8 – Fichier 20-lmtp.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 20-lmtp.conf << EOF
|
||
protocol lmtp {
|
||
mail_fsync = optimized
|
||
mail_plugins = $mail_plugins sieve
|
||
postmaster_address = postmaster@xoyize.xyz
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Configuration du protocole LMTP.</p>
|
||
|
||
<p>9 – Fichier 20-managesieve.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 20-managesieve.conf << EOF
|
||
protocols = $protocols sieve
|
||
|
||
service managesieve-login {
|
||
inet_listener sieve {
|
||
port = 4190
|
||
}
|
||
service_count = 1
|
||
#process_min_avail = 0
|
||
#vsz_limit = 64M
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Configuration de ManageSieve.
|
||
10 – Fichier 90-sieve.conf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cat > 90-sieve.conf << EOF
|
||
plugin {
|
||
sieve = file:~/sieve;active=~/.dovecot.sieve
|
||
sieve_before = /etc/dovecot/sieve-global
|
||
|
||
recipient_delimiter = +
|
||
sieve_quota_max_storage = 50M
|
||
}
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Configuration de Sieve.</p>
|
||
|
||
<h3 id="fichiers-de-mapping-ldap">Fichiers de mapping Ldap</h3>
|
||
|
||
<p>A – Selon la Doc de Dovecot</p>
|
||
|
||
<p>Avant de faire nos fichiers pour le Ldap, on va regarder à quoi devrait ressembler un dovecot-ldap.conf.ext qu’on peut rencontrer sur le grand internet, un exemple souvent cité (bon, les filtres sont les miens, mais c’est l’idée) :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>uris = ldap://ip.interne
|
||
dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
dnpass = passview
|
||
debug_level = 0
|
||
auth_bind = no
|
||
ldap_version = 3
|
||
base = ou=people,dc=xoyize,dc=xyz
|
||
scope = subtree
|
||
|
||
user_attrs = mailaccountquota=quota_rule=*:bytes=%$
|
||
user_filter = (&(uid=%u)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
|
||
pass_attrs = mail=user,userPassword=password
|
||
pass_filter = (&(uid=%u)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
</code></pre></div></div>
|
||
|
||
<p>C’est la que le <code class="language-plaintext highlighter-rouge">auth_debug</code> et <code class="language-plaintext highlighter-rouge">mail_debug</code> sont utiles</p>
|
||
|
||
<p>B – Passdb et Userdb</p>
|
||
|
||
<p>Dovecot utilise deux bases : passdb et userdb, déclarées dans cond.f/10-auth.conf ou j’utilise une petite astuce, le prefetch, pour éviter les doubles requêtes…</p>
|
||
|
||
<ul>
|
||
<li>Lorsqu’un utilisateur se connecte en IMAP, passdb est utilisé pour vérifier l’utilisateur (login et mdp), puis userdb est appelé pour connaitre des infos supplémentaires sur l’user (d’où le prefetch).</li>
|
||
<li>Lorsqu’un mail arrive de Postfix à Dovecot via le protocole LMTP, c’est userdb qui est appelé pour connaitre l’utilisateur à qui remettre le mail d’où le second userdb car le premier, prefetch, ne contient rien pour le coup.</li>
|
||
</ul>
|
||
|
||
<p>Il faut aussi savoir que Dovecot utilise des variables. Celles qui nous intéressent sont :</p>
|
||
|
||
<ul>
|
||
<li>%u qui est le nom utilisateur complet fourni. Par exemple ym@xoyize.xyz via un appel en Imtp (mail entrant) ou ym via l’Imap (client qui se connecte)</li>
|
||
<li>%n qui correspond à la partie utilisateur, ici : ym</li>
|
||
<li>%d qui correspond au domaine, ici : xoyize.xyz</li>
|
||
</ul>
|
||
|
||
<p>Ici, nous n’utiliserons que %u.</p>
|
||
|
||
<p>Au niveau du résultat ldap, l’ordre est :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>attribut_ldap:attribut_dovecot
|
||
</code></pre></div></div>
|
||
|
||
<p>Et donc :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>pass_attrs = mail=user,userPassword=password
|
||
</code></pre></div></div>
|
||
|
||
<p>indique que le champ mail de mon ldap correspond à l’utilisateur, du coup j’ai la bonne association.</p>
|
||
|
||
<p>C – Bind Ldap</p>
|
||
|
||
<p>Ensuite, au niveau du bind avec Ldap (la connexion avec Ldap), celui ci peut se faire de deux façons.</p>
|
||
|
||
<p>1 – auth_bind = yes</p>
|
||
|
||
<p>Cela permet de faire en sorte que le test du mot de passe se fasse directement avec le compte de l’utilisateur. Dovecot dans ce cas n’a pas besoin de lire le pass avec le compte viewer.</p>
|
||
|
||
<p>En contre partie, c’est plus lent, Dovecot attendant que la connexion avec le Ldap soit terminée avant de passer à la suivante.</p>
|
||
|
||
<p>2 – auth_bind = no</p>
|
||
|
||
<p>La, il y a besoin que le compte viewer puisse lire le mot de passe (d’où les acls mises en place dans la partie LDAP). Ayant de toute façon besoin de ce compte pour d’autres applications, ça ne me dérange pas.</p>
|
||
|
||
<p>De plus, c’est asynchrone, Dovecot peut lancer plusieurs requêtes concomitantes sans attendre apres.</p>
|
||
|
||
<p>Bref, on part sur le second choix.</p>
|
||
|
||
<p>D – Paf</p>
|
||
|
||
<p>Cependant, cette config me pose encore un problème… Lorsque l’on se connecte en IMAP on se présente donc avec un simple ym par contre, lors du LMTP, le %u présenté par Postfix est le mail complet, ym@xoyize.xyz et la, bah ça foire au niveau du filtre ldap, qui est pour mémoire :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>(&(uid=%u)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
</code></pre></div></div>
|
||
|
||
<p>Que faire ? Refaire nos utilisateurs pour que leur uid soit leur mail ? Heu, c’est pas l’idée à la base…</p>
|
||
|
||
<p>Donc, pour ça, j’avais trouvé une première solution :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>user_filter = (&(|(mail=%u)(uid=%u))(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
</code></pre></div></div>
|
||
|
||
<table>
|
||
<tbody>
|
||
<tr>
|
||
<td>Ha, les filtres LDAP et leur notation préfixée. Si vous avez eu une calculette Sharp dans les 90’s, vous devez connaître (et être vieux 😉 ). Bon, elles utilisaient la notaion polonaise inverse où l’opérateur est à la fin, mais c’est la même idée… Si vous avez fait de l’algèbre booléenne ou bien joué avec les AND, OR, XOR, et NAND (du genre, comment faire un OR avec que des NAND, tables de vérités, etc..), et bien le + (ou) est remplacé par</td>
|
||
<td>et le . (et) par &.</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<p>On peut résumer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>(&(Bloc1)(Bloc2)(Bloc3)) -> On veut Bloc1 ET Bloc2 ET Bloc3
|
||
Bloc1=(|(A)(B)) -> A OU B
|
||
</code></pre></div></div>
|
||
|
||
<p>C’est beau hein ! Bah c’est balo car on en va pas l’utiliser. En effet, cela amène un effet de bord : je peux désormais me connecter à ma bal avec comme login mon mail….
|
||
Après, on aime ou on n’aime pas. Perso, je ne préfère pas laisser cette possibilité, pour éviter les vilains qui tenteraient de se connecter en connaissant déjà le login…</p>
|
||
|
||
<p>Apres tout, j’aurais pu en rester la et me dire tant pis, mais au final c’était ne pas vraiment comprendre Dovecot…</p>
|
||
|
||
<p>E – Solution</p>
|
||
|
||
<p>Il faut faire en sorte que les appels userdb et passdb soient distincts…</p>
|
||
|
||
<p>Pour la configuration, on aura donc deux fichiers :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/dovecot/dovecot-ldap-pass.conf.ext
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>uris = ldap://127.0.0.1
|
||
dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
dnpass = passview
|
||
debug_level = 0
|
||
auth_bind = no
|
||
ldap_version = 3
|
||
base = ou=people,dc=xoyize,dc=xyz
|
||
scope = subtree
|
||
|
||
pass_attrs = mail=user,userPassword=password,mailaccountquota=userdb_quota_rule=*:bytes=%$
|
||
pass_filter = (&(uid=%u)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
</code></pre></div></div>
|
||
|
||
<p>La, on demande aussi au passage un attribut quota avec userdb <code class="language-plaintext highlighter-rouge">userdb_quota_rule=*:bytes=%$</code> et qui sera utilisé dans le prefetch pour éviter de refaire une requête LDAP.</p>
|
||
|
||
<p>Et le fichier</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/dovecot/dovecot-ldap-user.conf.ext
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>uris = ldap://127.0.0.1
|
||
dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
dnpass = passview
|
||
debug_level = 0
|
||
auth_bind = no
|
||
ldap_version = 3
|
||
base = ou=people,dc=xoyize,dc=xyz
|
||
scope = subtree
|
||
|
||
user_attrs = mailaccountquota=quota_rule=*:bytes=%$
|
||
user_filter = (&(mail=%u)(objectClass=mailaccountxoyize)(mailaccountactif=YES))
|
||
</code></pre></div></div>
|
||
|
||
<p>La, on filtre sur le champ mail pour retrouver le compte correspondant.</p>
|
||
|
||
<p>On sécurise :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chmod 600 /etc/dovecot/dovecot-ldap*
|
||
</code></pre></div></div>
|
||
|
||
<p>On va recharger Dovecot et regarder les logs voir si tout démarre bien :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>service dovecot restart
|
||
tail /var/log/mail.log -n 100
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="sieve">Sieve</h3>
|
||
|
||
<h4 id="la-base">La base</h4>
|
||
|
||
<p>Dovecot permet donc de filtrer les messages en utilisant le protocole Sieve. Il les range à leur arrivée selon les règles, global et utilisateur.
|
||
Pour le global, on aura besoin que d’une seule règle : les messages marqués comme Spam sont dirigés dans le répertoire Spam.
|
||
Par la suite, chaque utilisateur pourra ajouter ses règles afin de filtrer comme il l’entend.</p>
|
||
|
||
<p>On a déjà activé Sieve au préalable. Il ne reste plus qu’à faire quelques opérations.</p>
|
||
|
||
<p>Pour le global :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /etc/dovecot/sieve-global
|
||
chown vmail /etc/dovecot/sieve-global
|
||
</code></pre></div></div>
|
||
|
||
<p>Nous rangerons nos scripts globaux dans ce répertoire, qui s’exécutera avant les filtres utilisateurs.</p>
|
||
|
||
<p>Si vous voulez faire les vérifications global apres, dans le fichier 90-sieve.conf, il faudra indiquer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sieve_after = /etc/dovecot/sieve-global
|
||
</code></pre></div></div>
|
||
|
||
<p>Et on peut bien sûr combiner.</p>
|
||
|
||
<p>Nous rangerons nos scripts globaux dans ce répertoire, qui s’exécutera avant les filtres utilisateurs.</p>
|
||
|
||
<p>Si vous voulez faire les vérifications global apres, dans le fichier 90-sieve.conf, il faudra indiquer :</p>
|
||
|
||
<p>sieve_after = /etc/dovecot/sieve-global</p>
|
||
|
||
<p>Et on peut bien sûr combiner.</p>
|
||
|
||
<p>Créez ensuite le fichier /etc/dovecot/sieve-global/global.sieve avec le contenu qui suit :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>require ["variables", "envelope", "fileinto", "mailbox", "regex", "subaddress", "body"];
|
||
|
||
if header :contains "X-Spam" "Yes" {
|
||
fileinto "Junk";
|
||
stop;
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>Tout bête, si le header contient X-spam à Yes, on le déplace dans les indésirables ( Le X-spam sera rajouté par Rspamd).</p>
|
||
|
||
<p>Le stop indique d’arrêter le traitement. En effet, si d’autres filtres (users ou globaux) matchent également, le message sera dupliqué.</p>
|
||
|
||
<p>Puis on change l’user et les droits :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chown vmail: /etc/dovecot/sieve-global/global.sieve
|
||
chmod 750 /etc/dovecot/sieve-global/global.sieve
|
||
</code></pre></div></div>
|
||
|
||
<p>On peut le compiler :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sievec /etc/dovecot/sieve-global/global.sieve
|
||
</code></pre></div></div>
|
||
|
||
<p>qui donnera un fichier /etc/dovecot/sieve-global/global.svbin, version compilée de nos règles.</p>
|
||
|
||
<p>Cette opération est cependant facultative et elle sera de toute façon exécutée par Dovecot à la première occasion si vous le n’avez pas fait.</p>
|
||
|
||
<p>Si on le fait, on pense à modifier les droits :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chown vmail /etc/dovecot/sieve-globa/global.svbin
|
||
</code></pre></div></div>
|
||
|
||
<p>Je serais même tenté de dire que la première fois, c’est mieux de laisser Dovecot le faire, en regardant les logs et avec l’option mail_debug = yes on voit très rapidement où se trouve le problème s’il y en a un (et généralement, ça chouine pour des histoires de permissions). Pour les filtres utilisateurs, c’est la même tambouille, Dovecot les compilant au moment ou il les charge, s’il n’existent pas ou sont obsolètes.</p>
|
||
|
||
<h4 id="niveau-utilisateur">Niveau Utilisateur</h4>
|
||
|
||
<p>Pour modifier les filtres d’un utilisateur, on peut utiliser un webmail préalablement configuré. Pour le moment, je ne couvre pas cette partie (ce sera pour plus tard), donc pour le moment, on va plutôt passer par un client tel que Thunderbird.</p>
|
||
|
||
<p>Par défaut, Thunderbird ne les gère pas, mais il suffit de rajouter ce module complémentaire.
|
||
Ensuite menu Outils/Paramètres Sieve et activez la gestion de Sieve. Les paramètres sont identiques à l’IMAP, mais sur le port 4190.</p>
|
||
|
||
<p>Et ensuite dans le menu Outils/Filtres Sieve (M). Faites nouveau pour créer un nouveau fichier de règles.</p>
|
||
|
||
<p>Voila un exemple de règles :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>require ["variables", "envelope", "fileinto", "mailbox", "regex", "subaddress", "body"];
|
||
|
||
if header :contains "subject" "Postfix SMTP server" {
|
||
fileinto "Serveur";
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>En cas de fautes, le plugin vous le signale. Il ne reste qu’a enregistrer. A noter : Sieve permet d’avoir plusieurs fichiers de filtrage, mais un seul peut être actif à la fois.</p>
|
||
|
||
<p>Bien sur, Sieve permet de faire beaucoup de choses, avec gestion de conditions, variables, etc… Ce sera l’occasion de faire un article complet (ou presque) sur Sieve un peu plus tard.</p>
|
||
|
||
<h4 id="tests-1">Tests</h4>
|
||
|
||
<p>Comme je l’ai dis, l’option <code class="language-plaintext highlighter-rouge">mail_debug = yes</code> permet de voir de suite dans le fichier de log /var/log/mail.log c e qui ne va pas.</p>
|
||
|
||
<h3 id="quota">Quota</h3>
|
||
|
||
<h4 id="configuration-1">Configuration</h4>
|
||
|
||
<p>Pour rajouter la gestion du quota, il suffit de quelques manipulations. Pour rappel, si le champ dans le ldap est égal à zéro, cela veut dire pas de quota. Notez également que le champ est exprimé en bytes.</p>
|
||
|
||
<p>Dans le fichier /etc/dovecot/conf.d/10-mail.conf on va modifier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[...]
|
||
mail_plugins = $mail_plugins quota
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Dans le fichier /etc/dovecot/conf.d/20-imap.conf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[...]
|
||
mail_plugins = $mail_plugins imap_sieve imap_quota
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis dans le fichier 20-lmtp.conf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[...]
|
||
mail_plugins = $mail_plugins sieve quota
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Et pour terminer on remplace le contenu du fichier /etc/dovecot/conf.d/90-quota.conf par ce qui suit :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>plugin {
|
||
quota = maildir:User quota
|
||
quota_warning = storage=90%% quota-warning 90 %u
|
||
}
|
||
|
||
service quota-warning {
|
||
executable = script /etc/dovecot/quota.sh
|
||
user = vmail
|
||
unix_listener quota-warning {
|
||
user = vmail
|
||
}
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>Voila, c’est en place.</p>
|
||
|
||
<h4 id="avertissement-automatique">Avertissement automatique</h4>
|
||
|
||
<p>On va rajouter le petit script qui va envoyer le mail d’alerte.</p>
|
||
|
||
<p>Dans un fichier /etc/dovecot/quota.sh mettez cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>#!/usr/bin/env bash
|
||
|
||
PERCENT=${1}
|
||
USER=${2}
|
||
|
||
cat << EOF | /usr/lib/dovecot/dovecot-lda -d $USER -o "plugin/quota=maildir:User quota:noenforcing"
|
||
From: no-reply@xoyize.xyz
|
||
Subject: HOHOHO: Votre BAL est pleine a ${PERCENT}
|
||
Content-Type: text/plain; charset="utf-8"
|
||
|
||
HOHOHO
|
||
Votre BAL est pleine a ${PERCENT}. Faut faire du menage mon coco !
|
||
EOF
|
||
</code></pre></div></div>
|
||
|
||
<p>Rien de bien compliqué.</p>
|
||
|
||
<p>On s’occupe des permissions :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chmod +x /etc/dovecot/quota.sh
|
||
chown vmail /etc/dovecot/quota.sh
|
||
</code></pre></div></div>
|
||
|
||
<p>L’œil attentif remarquera que l’on fait appel à dovecot-lda pour ce mail. J’ai tenté avec le lmtp, où pourtant -d a la même utilité, mais je me mange une erreur. Tant pis, au final, lda est toujours dispo, et n’est invoqué qu’au besoin. Autant dire que ça ne va pas beaucoup tourner</p>
|
||
|
||
<p>On édite le fichier /etc/dovecot/conf.d/15-lda.conf pour tout remplacer par :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>protocol lda {
|
||
info_log_path =
|
||
log_path =
|
||
mail_plugins = sieve quota
|
||
postmaster_address = postmaster@xoyize.xyz
|
||
quota_full_tempfail = yes
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge Dovecot :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dovecot reload
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="tests-2">Tests</h4>
|
||
|
||
<p>Si vous voulez ajouter un quota à un utilisateur pour tester, sur le ldap, un fichier mod_quota.ldif :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dn: uid=cm,ou=people,dc=xoyize,dc=xyz
|
||
changetype: modify
|
||
replace: mailaccountquota
|
||
mailaccountquota: 2147483648
|
||
</code></pre></div></div>
|
||
|
||
<p>Que vous injectez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>ladd -f mod_quota.ldif
|
||
</code></pre></div></div>
|
||
|
||
<p>La, il est réglé à 2Go.</p>
|
||
|
||
<p>Ensuite, de retour sur le serveur mail, on va déja regarder si le quota est fonctionnel :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>doveadm quota get -u cm@xoyize.xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>doit retourner quelque chose qui ressemble à ca :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Quota name Type Value Limit %
|
||
User quota STORAGE 0 2097152 0
|
||
User quota MESSAGE 0 - 0
|
||
</code></pre></div></div>
|
||
|
||
<p>On va aussi tester le script :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>./quota.sh 90 cm@xoyize.xyz
|
||
</code></pre></div></div>
|
||
|
||
<p>Et pour tester en conditions réelles, attention, il faut savoir que le mail n’est envoyé qu’une seule fois, au moment où le quota est dépassé.</p>
|
||
|
||
<p>Par exemple, si vous activez le quota avec une bal deja hors quota vous n’aurez jamais le mail. Du coup, pour tester, c’est pas évident… faut jouer avec une toute petite bal. Mais si les deux commandes au préalable fonctionnent sans problemes, ca doit marcher en production.</p>
|
||
|
||
<p>Pour voir le quota avec Thunderbird, je conseille <a href="https://addons.thunderbird.net/fr/thunderbird/addon/display-quota/">Display Quota</a>.</p>
|
||
|
||
<h4 id="conclusion">Conclusion</h4>
|
||
|
||
<p>Voila pour cette troisième partie où nous avons fait connaissance avec Dovecot. Je pourrais vous parler en profondeur de la commande doveadm qui permet de faire pas mal de choses mais ce sera pour un tuto annexe… En attendant, rien ne vous empêche de vous documenter.</p>
|
||
|
||
<p>Vous voulez la bonne nouvelle ? Notre serveur de messagerie est opérationnel.</p>
|
||
|
||
<p>Pour tester, rien de tel qu’un client lourd. Thunderbird pour Windows, Evolution ou autres pour Linux.</p>
|
||
|
||
<p>Vous devez pouvoir recevoir et envoyer des mails.</p>
|
||
|
||
<p>Attention cependant, aucune protection contre le spam n’est encore en place à ce niveau. De la meme façon, vos mails envoyés vers certains domaines (gmail, hotmail) risquent fort de se retrouver classés comme spams (DKIM, SPF et DMARC pas encore en place).</p>
|
||
|
||
<p>Et oui, j’ai dis opérationnel, pas terminé ! Mais ne ne perdez pas espoir, on a fait le plus dur.</p>
|
||
|
||
<h2 id="optimisation-de-postfix">Optimisation de Postfix</h2>
|
||
|
||
<h3 id="sécurisation-smtps-et-submission">Sécurisation SMTPS et Submission</h3>
|
||
|
||
<p>La partie consacrée à Postfix laisse dans notre configuration une potentielle future faille.</p>
|
||
|
||
<p>Vous le savez, un SMTP externe communiquera avec le votre via le port 25, mais imaginons qu’un instant, un serveur se connecte à vos ports 465 ou bien 587…
|
||
Et bien, il ne sera pas embêté. Au final, pour le moment, ce n’est pas bien méchant car il suivra les restrictions qu’il aurait rencontré via le port 25, mais si nous mettons en place des restrictions différentes selon les services (et c’est ce que nous ferons plus tard), et bien, on risque d’avoir des surprises.</p>
|
||
|
||
<p>Autant y remédier de suite en bloquant la possibilité à un serveur SMTP de se connecter la ou il ne doit pas.</p>
|
||
|
||
<p>On édite le fichier /etc/postfix/master.cf :</p>
|
||
|
||
<p>[…]
|
||
submission inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
||
smtps inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_tls_wrappermode=yes
|
||
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
||
[…]</p>
|
||
|
||
<p>Pour ces deux services, la directive <code class="language-plaintext highlighter-rouge">smtpd_client_restriction</code> du <strong>main.cf</strong> est remplacée :<br />
|
||
on permet les utilisateurs connectés et on rejette le reste.</p>
|
||
|
||
<h3 id="antiforge">Antiforge</h3>
|
||
|
||
<h4 id="explication">Explication</h4>
|
||
|
||
<p>Derrière ce terme, se cache quelque de tout simple : le fait de pouvoir modifier (forger) sans vergogne l’adresse de l’expéditeur. Je m’explique :</p>
|
||
|
||
<ul>
|
||
<li>Depuis votre logiciel de messagerie, si vous modifiez l’adresse d’expéditeur par nimportequoi@xoyize.xyz, le mail est expédié sans aucun soucis.</li>
|
||
<li>De la même façon, un MX distant peut tout à fait présenter un mail auprès de notre serveur avec un FROM TO : ym@xoyize.xyz , sans que cela ne gène le moins du monde.</li>
|
||
</ul>
|
||
|
||
<p>On va donc rajouter une restriction au moment de la vérification du sender afin de limiter tout cela.</p>
|
||
|
||
<p>On édite le fichier <strong>/etc/postfix/main.cf</strong> et on ajoute dans la directive <code class="language-plaintext highlighter-rouge">smtpd_sender_resctriction</code> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_sender_restrictions =
|
||
reject_sender_login_mismatch,
|
||
permit_mynetworks,
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Cette nouvelle directive s’appuie sur une <code class="language-plaintext highlighter-rouge">sender_login_maps</code>, qu’on va déclarer plus bas :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_sender_login_maps = ldap:/etc/postfix/ldap/virtual_senders.cf
|
||
</code></pre></div></div>
|
||
|
||
<p>On va créer le fichier qui va faire le lien avec le ldap :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/postfix/ldap/virtual_senders.cf
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = dc=xoyize,dc=xyz
|
||
scope = sub
|
||
query_filter = (|(&(mailaliasfrom=%s)(objectClass=mailaliasxoyize)(mailaliasactif=YES))(&(mail=%s)(objectClass=mailaccountxoyize)(mailaccountactif=YES)))
|
||
result_attribute = mail mailaliasto
|
||
</code></pre></div></div>
|
||
|
||
<p>Simple, cela retourne le propriétaire de la boite demandée si il y en a un.</p>
|
||
|
||
<p>Ensuite, deux cas de figures :</p>
|
||
|
||
<ul>
|
||
<li>Si le client est SASL, il faut qu’il soit le propriétaire du mail pour que le mail soit accepté.</li>
|
||
<li>Si le client n’es pas en SASL et que la boite a un propriétaire, le mail ne sera pas accepté.</li>
|
||
</ul>
|
||
|
||
<p>Vite fait, je reviens bien sur la distinction TLS et SASL :</p>
|
||
|
||
<ul>
|
||
<li>Client SASL veut dire que le client est authentifié : un utilisateur.</li>
|
||
<li>Client Non SASL veut dire que c’est un client non authentifié, un serveur MX.</li>
|
||
</ul>
|
||
|
||
<p>A ne pas confondre avec TLS (ou SSL) qui est la sécurité appliquée à la connexion.</p>
|
||
|
||
<p>On recharge Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p><strong>Pour le fun</strong><br />
|
||
Imaginons que dans notre schéma LDAP, nous ayons un attribut mailaliassend qui stipule si un alias a le droit ou non d’envoyer des mails. Après tout, pourquoi pas…</p>
|
||
|
||
<p>Notre fichier /etc/postfix/ldap/virtual_senders.cf pourrait ressembler à cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = dc=xoyize,dc=xyz
|
||
scope = sub
|
||
query_filter = (|(&(mailaliasfrom=%s)(objectClass=mailaliasxoyize)(mailaliasactif=YES)(mailaliassend=YES))(&(mail=%s)(objectClass=mailaccountxoyize)(mailaccountactif=YES)))
|
||
result_attribute = mail mailaliasto
|
||
</code></pre></div></div>
|
||
|
||
<p>La puissance du LDAP, tout simplement…</p>
|
||
|
||
<h3 id="contrôle-daccès-facultatif">Contrôle d’accès (Facultatif)</h3>
|
||
|
||
<p>Dans sa grande générosité au niveau de ses possibilités, Postfix permet également d’effectuer des vérifications d’accès à l’aide de quatre contrôles :</p>
|
||
|
||
<ul>
|
||
<li>check_client_access</li>
|
||
<li>check_helo_access</li>
|
||
<li>check_sender_access</li>
|
||
<li>check_recipient_access</li>
|
||
</ul>
|
||
|
||
<p>Dans le cadre du renforcement de notre serveur Postfix, seul check_sender_access sera vraiment obligatoire, les autres, c’est au cas pas cas.</p>
|
||
|
||
<p>Ces vérification s’appuient sur des données formatées de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>111.111.111.111 REJECT
|
||
// ou bien
|
||
ym@xoyize.xyz OK
|
||
</code></pre></div></div>
|
||
|
||
<p>Bien que le OK soit implicite (si pas d’entrée, c’est OK par défaut), il peut être nécessaire dans certains cas de l’expliciter.</p>
|
||
|
||
<p>Au niveau des actions possible, nous trouvons entre autres :</p>
|
||
|
||
<ul>
|
||
<li>DUNNO: On ne fait rien (sort du contrôle en cours et permet d’éviter un éventuel match avec une règle plus bas…)</li>
|
||
<li>HOLD: le mail reste dans la queue de Postfix.</li>
|
||
<li>REDIRECT: redirection du mail vers une autre adresse.</li>
|
||
<li>etc…</li>
|
||
</ul>
|
||
|
||
<p>Plus de détails ici : http://www.postfix.org/access.5.html</p>
|
||
|
||
<p>Si vous utilisez des fichiers statiques, après chaque modification, il faudra invoquer :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap /etc/postfix/nomdufichier
|
||
</code></pre></div></div>
|
||
|
||
<p>Et pour rappel, vu notre configuration actuelle, ces quatre contrôles se font dans un sens (mail entrant) et dans l’autre (mail sortant).</p>
|
||
|
||
<p>Chacun de ces contrôles prendra place ensuite dans son bloc smtpd_*_restrictions correspondant.</p>
|
||
|
||
<h4 id="check_client_access">check_client_access</h4>
|
||
|
||
<p>Ici, on peut autoriser ou interdire des IPs ou des domaines spécifiques.</p>
|
||
|
||
<p>Exemple :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>111.222.111.222 REJECT
|
||
domaineabloquer.com REJECT
|
||
</code></pre></div></div>
|
||
|
||
<p>Et cela se place de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_client_restrictions =
|
||
check_client_access hash:/etc/postfix/acces_client,
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour filtrer des lourds (spammeurs, bots, etc…), ce n’est pas forcement la meilleure solution. D’une, il faut que la la liste d’accès soit maintenue à jour, et c’est alors un travail quotidien, ou presque…</p>
|
||
|
||
<p>Seconde « limitation », même en cas de Reject, la session SMTP ira jusqu’au RCPT ou bien sur, elle sera terminée, mais on a gaspillé de la ressource à aller si loin.</p>
|
||
|
||
<p>On peut demander à Postfix d’arrêter la communication dès qu’une restriction s’applique (en mettant l’option smtpd_delay_reject = no) mais pour trouver un éventuel soucis par la suite, ce peut être gênant. Autre problématique, certains clients gèrent mal une connexion coupée de la sorte…</p>
|
||
|
||
<p>Je conseille donc de laisser comme c’est par défaut.</p>
|
||
|
||
<p>Et donc pour bloquer des IPS spécifiques, je passe soit par mon firewall, soit par Postscreen (qu’on verra plus tard).</p>
|
||
|
||
<h4 id="check_helo_access">check_helo_access</h4>
|
||
|
||
<p>Ici est effectué un contrôle sur le helo. Comme pour le client, c’est vite compliqué de maintenir quelque chose à jour.</p>
|
||
|
||
<p>Cependant, on peut quand même effectuer un petit contrôle de routine pour éviter le helo qui serait le notre, ça ne mange pas de pain…</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_helo_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
check_helo_access ldap:/etc/postfix/ldap/check_helo_domains_reject.cf,
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Et le fichier <strong>/etc/postfix/ldap/check_helo_domains_reject.cf</strong> correspondant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = ou=mail,dc=xoyize,dc=xyz
|
||
scope = sub
|
||
|
||
query_filter = (&(maildomain=%s)(objectClass=maildomainxoyize)(maildomainactif=YES))
|
||
result_attribute = maildomain
|
||
result_filter = REJECT Menteur
|
||
</code></pre></div></div>
|
||
|
||
<p>Rien de sorcier…</p>
|
||
|
||
<p>On pense à recharger Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="check_recipient_access">check_recipient_access</h4>
|
||
|
||
<p>La, on peut contrôler le destinataire :</p>
|
||
|
||
<p>Par exemple :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>spam@domaine.xyz REJECT
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour bloquer les mails destiné a mon utilisateur ym. Oui, c’est pas franchement utile…</p>
|
||
|
||
<p>Ou bien encore :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adresseextene@gmail.com REJECT
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour bloquer les mails à destination de cette adresse. L’intérêt la aussi, dans notre cas de figure, est faible, mais ça existe et ça peut servir.</p>
|
||
|
||
<h4 id="check_sender_access">check_sender_access</h4>
|
||
|
||
<p>Ici, on va effectuer un contrôle au niveau de l’expéditeur et on va revenir sur l’antiforge dont je parlais avant pour s’intéresser à un cas que je n’ai pas traité :</p>
|
||
|
||
<p>Imaginons un serveur SMTP qui nous envoie un mail avec comme FROM TO un mail du genre userbidon@xoyize.xyz, la bal n’appartenant à personne, le <code class="language-plaintext highlighter-rouge">reject_sender_login_mismatch</code> qu’on a vu plus haut ne bloquera rien, le mail passera.</p>
|
||
|
||
<p>On va donc y remédier. L’idée étant d’autoriser en FROM TO nos mails qui existent et de rejeter le reste.</p>
|
||
|
||
<p>Dans le bloc smtpd_sender_resctrictions, nos usagers sont déjà autorisés via permit_sasl_authenticated, on va donc ajouter juste après la restriction pour nos domaines.</p>
|
||
|
||
<p>On aurait alors besoin d’un fichier ressemblant à ça :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>@xoyize.xyz REJECT
|
||
@ouestline.net REJECT
|
||
</code></pre></div></div>
|
||
|
||
<p>Et comme on a le Ldap pour alimenter cela, on va donc passer par un fichier nommé</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/postfix/ldap/check_sender_domains_reject.cf
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>server_host = ldap://127.0.0.1
|
||
version = 3
|
||
bind = yes
|
||
bind_dn = cn=viewer,ou=system,dc=xoyize,dc=xyz
|
||
bind_pw = passview
|
||
search_base = ou=mail,dc=xoyize,dc=xyz
|
||
scope = sub
|
||
|
||
query_filter = (&(maildomain=%s)(objectClass=maildomainxoyize)(maildomainactif=YES))
|
||
result_attribute = maildomain
|
||
result_filter = REJECT Ho le vilain....
|
||
</code></pre></div></div>
|
||
|
||
<p>Et cela se place de la sorte dans le fichier</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/postfix/main.cf
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_sender_restrictions =
|
||
reject_sender_login_mismatch,
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
check_sender_access ldap://etc/postfix/ldap/check_sender_domains_reject.cf,
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>L’ordre est important. Si le check_sender_access est positionné avant le permit_sasl_authenticated, nos propres utilisateurs ne pourraient pas envoyer de mails.</p>
|
||
|
||
<p>On recharge :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Et voila l’antiforge amélioré.</p>
|
||
|
||
<h3 id="les--header-checks-">Les « Header Checks »</h3>
|
||
|
||
<p>Dernière série de contrôle que l’on peut effectuer ou l’on va regarder un peu plus profondément dans le mail.</p>
|
||
|
||
<p>Postfix nous propose plusieurs types de contrôles sur les headers :</p>
|
||
|
||
<ul>
|
||
<li>header_check : contrôle dans le header (format ASCII)</li>
|
||
<li>mime_header_check : contrôle dans le header (format MIME)</li>
|
||
<li>body_header_check : contrôle dans corps.</li>
|
||
<li>etc…</li>
|
||
</ul>
|
||
|
||
<p>Plus de détails ici : http://www.postfix.org/header_checks.5.html</p>
|
||
|
||
<p>Pour les utiliser, il faut tout d’abord installer le module pcre de Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install postfix-pcre
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p>A partir de maintenant, on va pouvoir inspecter, via des REGEX, ce qu’il y a dans les mails.</p>
|
||
|
||
<p>La syntaxe est la suivante :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/^Subject:.*viagra*/ REJECT Pas besoin, merci
|
||
/^From: *ym*/ REJECT On connait la blague
|
||
</code></pre></div></div>
|
||
|
||
<p>De mon avis et expérience, pour filtrer le spam, ce n’est plus vraiment la meilleure solution sauf cas particulier. Compliqué de maintenir un truc à jour, risque d’un regex un peu foireux qui pourrait être trop restrictif…</p>
|
||
|
||
<p>Pour information, il est possible de tester vos regex de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap -q "Subject: viagra" pcre:/etc/postfix/header_checks
|
||
</code></pre></div></div>
|
||
|
||
<p>Cela doit vous renvoyer la règle qui s’applique.</p>
|
||
|
||
<p>Si vous voulez tester avec un mail sauvegardé dans un fichier :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postmap -q - pcre:/etc/postfix/header_checks < mail.txt
|
||
</code></pre></div></div>
|
||
|
||
<p>Le second – après le -q est important.</p>
|
||
|
||
<p>Donc pour le traitement du spam, on fait mieux, cependant, je me sers du <strong>header_check</strong> pour deux choses.</p>
|
||
|
||
<p>Créons d’abord le répertoire qui va accueillir nos fichiers :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /etc/postfix/check/
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="filtrage-des-fichiers-à-risque">Filtrage des fichiers à risque</h4>
|
||
|
||
<p>Au niveau filtrage en entrée, pour la démonstration, je ne montre qu’un exemple simple. A vous après de faire vos propres règles.</p>
|
||
|
||
<p>Créons un fichier <strong>/etc/postfix/check/header_checks_in</strong> avec ce qui suit :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/^s*Content.(Disposition|Type).*names*=s*"?(.+.(bat|exe|com|scr|vbs))"?s*$/ PREPEND X-xoyize:WARN
|
||
</code></pre></div></div>
|
||
|
||
<p>Ici, un header perso X-xoyize: WARN est ajouté si le mail contient un fichier avec les extensions bat, exe, com, etc… Celui ci pourra me servir à effectuer un filtre avec Sieve.</p>
|
||
|
||
<p>Au niveau des actions, on retrouve peu ou prou ce qu’on avait pour les contrôles d’accès. On peut donc aussi utiliser REJECT pour le rejeter, REDIRECT xxx@xoyize.xyz , etc…</p>
|
||
|
||
<p>Voila pour les contrôles en entrée.</p>
|
||
|
||
<h4 id="supprimer-les-informations-sensibles">Supprimer les informations sensibles</h4>
|
||
|
||
<p>L’autre utilité est de pouvoir masquer certaines informations de vos mails sortants, tel que votre IP d’envoi, votre client mail… Par défaut, les headers ajoutés par votre client de messagerie sont un peu trop causant…</p>
|
||
|
||
<p>Si on regarde ces fameux headers d’un mail qui partirait de chez vous vers un destinataire externe, le premier Received ressemblerait à cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Received: from [monip] (monreverse[monip])
|
||
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
|
||
(No client certificate requested)
|
||
by mail.xoyize.xyz (Postfix) with ESMTPSA id 3AB4D22938
|
||
for <destinataire@destination.com>; Mon, 21 Jul 1969 02:56:20 +0000 (UTC)
|
||
</code></pre></div></div>
|
||
|
||
<p>Au passage, pour lire les headers d’un mail, il faut commencer par le bas. Le premier Received que l’on voit en haut est en fait le dernier SMTP rencontré, celui du destinataire.</p>
|
||
|
||
<p>Et donc notre destinataire, s’il est un peu curieux, peut connaitre notre IP. Puis s’il descend un peu, il en apprendra davantage sur votre OS, etc…</p>
|
||
|
||
<p>Hum, ce n’est pas terrible…</p>
|
||
|
||
<p>Allez, nettoyons tout cela !</p>
|
||
|
||
<p>Dans un fichier <strong>/etc/postfix/check/header_checks_out</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/^\s*Received: from \S+ \(\S+ \[\S+\]\)(.*)/ REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1])$1
|
||
/^X-Originating-IP:/ IGNORE
|
||
/^X-Mailer:/ IGNORE
|
||
/^Mime-Version:/ IGNORE
|
||
/^User-Agent:/ IGNORE
|
||
</code></pre></div></div>
|
||
|
||
<p>Au passage, on rencontre souvent sur internet ce regex :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/^Received:.*with ESMTPSA/ IGNORE
|
||
</code></pre></div></div>
|
||
|
||
<p>En lieu et place de celui que je vous ai indiqué. Celui ci est un peu trop violent à mon gout, vu qu’il supprime complétement le Received from vous concernant. Il peut toujours être utile d’indiquer que vous étiez en tls, le serveur qui a reçu le mail, etc… Je préfère donc juste masquer l’ip d’origine.</p>
|
||
|
||
<h4 id="oui-mais">Oui mais…</h4>
|
||
|
||
<p>Si on indique ces checks dans le main.cf avec :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>header_checks = pcre:/etc/postfix/check/header_checks_in,pcre:/etc/postfix/check/header_checks_out
|
||
mime_header_checks = pcre:/etc/postfix/check/header_checks_in,pcre:/etc/postfix/check/header_checks_out
|
||
</code></pre></div></div>
|
||
|
||
<p>Ils vont se faire sur les mails qui entrent et qui sortent. Et on ne veut pas effacer les headers des mails qui nous arrivent… ni ajouter un éventuel header au mail que l’on envoie.</p>
|
||
|
||
<p>Que faire…</p>
|
||
|
||
<p>La solution élégante est de faire appel au process cleanup et d’en faire deux « sous process ». Chacun en charge d’un traitement, et affecté comme il faut.</p>
|
||
|
||
<p>Pour se faire, c’est assez simple :</p>
|
||
|
||
<p>On édite le fichier <strong>/etc/postfix/master.cf</strong> pour y ajouter pour chaque service un nouveau service cleanup :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtp pass - - y - - smtpd
|
||
-o cleanup_service_name=subcleanin
|
||
[...]
|
||
submission inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
||
-o cleanup_service_name=subcleanout
|
||
smtps inet n - y - - smtpd
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_tls_wrappermode=yes
|
||
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
||
-o cleanup_service_name=subcleanout
|
||
</code></pre></div></div>
|
||
|
||
<p>Et plus bas, en dessous du cleanup existant, on ajoute :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>cleanup unix n - y - 0 cleanup
|
||
subcleanout unix n - - - 0 cleanup
|
||
-o header_checks=pcre:/etc/postfix/check/header_checks_out
|
||
-o mime_header_checks=pcre:/etc/postfix/check/header_checks_out
|
||
subcleanin unix n - - - 0 cleanup
|
||
-o header_checks=pcre:/etc/postfix/check/header_checks_in
|
||
-o mime_header_checks=pcre:/etc/postfix/check/header_checks_in
|
||
</code></pre></div></div>
|
||
|
||
<p>Précisez bien <strong>header_checks</strong> et <strong>mime_header_checks</strong> : les headers pouvant être dans le format MIME ou ASCII, il est important de bien traiter les deux cas.</p>
|
||
|
||
<p>On recharge Postfix :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Je vous invite bien évidement à consulter la <a href="http://www.postfix.org/documentation.html">doc officielle</a> qui vous permettra de trouver réponses à vos cas particuliers.</p>
|
||
|
||
<h2 id="policyd-spf">Policyd SPF</h2>
|
||
|
||
<p>SPF (Sender Policy Framework) est un mécanisme simple qui permet de savoir si un SMTP à l’origine d’un mail est bien légitime .</p>
|
||
|
||
<p>Cela s’appuie sur un enregistrement TXT dans le DNS qui ressemble à ça :</p>
|
||
|
||
<p>“v=spf1 ip4:ip.legitime mx -all”</p>
|
||
|
||
<p>Cet enregistrement stipule quel MX est autorisé à envoyer depuis le domaine.</p>
|
||
|
||
<p>Ici, on va mettre en place la vérification pour les mails entrants, la création dans notre DNS de notre propre SPF se fera dans la partie VII.</p>
|
||
|
||
<p>On commence en installant le module SPF python (il existe aussi une version perl, mais celle en python est mieux maintenue et nécessite moins de dépendances, puis le python, c’est la vie !)</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install postfix-policyd-spf-python
|
||
</code></pre></div></div>
|
||
|
||
<p>Il se configure dans le fichier <strong>/etc/postfix-policyd-spf-python/policyd-spf.conf</strong> ou vous indiquez ceci :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>debugLevel = 1
|
||
|
||
HELO_reject = Fail
|
||
Mail_From_reject = Fail
|
||
|
||
PermError_reject = False
|
||
TempError_Defer = False
|
||
|
||
skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1
|
||
</code></pre></div></div>
|
||
|
||
<p>Les mails qui ne respectent pas les SPF seront rejetés. Par contre, s’il n’y a pas de SPF définis, on accepte (les refuser ici est une mauvaise idée, nombre de domaines légitimes n’ont pas de SPF en place…)</p>
|
||
|
||
<p>Ensuite, dans le fichier <strong>/etc/postfix/master.cf</strong> on va ajouter en bas :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>policyd-spf unix - n n - - spawn
|
||
user=nobody argv=/usr/bin/policyd-spf
|
||
</code></pre></div></div>
|
||
|
||
<p>Et dans le <strong>/etc/postfix/main.cf</strong>, on ajoute tout d’abord une ligne :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>policyd-spf_time_limit = 3600s
|
||
</code></pre></div></div>
|
||
|
||
<p>puis en dessous, dans le bloc <code class="language-plaintext highlighter-rouge">smtpd_sender_restrictions</code>, on ajoute :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtpd_sender_restrictions =
|
||
permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
check_sender_access ldap://etc/postfix/ldap/check_sender_domains_reject.cf,
|
||
check_policy_service unix:private/policyd-spf,
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Dorénavant, chaque mail entrant subira une vérification SPF. On pourra l’observer en regardant les headers d’un mail qu’on reçoit :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Received: from mail.xoyize.xyz
|
||
by mail (Dovecot) with LMTP id N59BECWohFzNVwAAZU03Dg
|
||
for <ym@xoyize.xyz>; Mon, 21 Jul 1969 02:56:20 +0000
|
||
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=blablabla...
|
||
</code></pre></div></div>
|
||
|
||
<p>Voila pour le contrôle SPF qui va permettre d’écrémer un peu plus.</p>
|
||
|
||
<h2 id="postcreen-a-voir">Postcreen (A voir)</h2>
|
||
|
||
<p>On arrive à la chose la plus efficace pour lutter contre le spam bête et méchant. S’il ne devait en rester qu’un, ce serait lui je pense. Pourtant il ne réinvente rien et utilise des principes déjà connus, mais il le fait bien et simplement.</p>
|
||
|
||
<p>Il est le bouclier contre les zombies/bots, etc… que je résume en « les lourds »…</p>
|
||
|
||
<p>Il est… Postscreen !</p>
|
||
|
||
<h3 id="activation">Activation</h3>
|
||
|
||
<p>Postscreen étant intégré dans Postfix, rien à installer, il suffit de l’activer.</p>
|
||
|
||
<p>Dans le fichier /etc/postfix/master.cf, commentez la ligne :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtp inet n - y - - smtpd
|
||
</code></pre></div></div>
|
||
|
||
<p>et décommentez juste en dessous :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>smtp inet n - y - 1 postscreen
|
||
smtpd pass - - y - - smtpd
|
||
dnsblog unix - - y - 0 dnsblog
|
||
tlsproxy unix - - y - 0 tlsproxy
|
||
</code></pre></div></div>
|
||
|
||
<p>Le reste de la configuration se passera dans le fichier /etc/postfix/main.cf</p>
|
||
|
||
<h3 id="configuration-2">Configuration</h3>
|
||
|
||
<p>Postcreen peut faire deux types de contrôles :</p>
|
||
|
||
<ul>
|
||
<li>des contrôles simples</li>
|
||
<li>des contrôles profonds</li>
|
||
</ul>
|
||
|
||
<p>Les contrôles simples se fond avant de passer la main à Postfix. Si tout est Ok, le mail suit son chemin.</p>
|
||
|
||
<p>Au contraire, les contrôles profonds prennent la main sur l’ensemble du dialogue et introduisent de par ce fait, un greylisting. J’y reviens plus bas.</p>
|
||
|
||
<p>Pour chaque contrôle, on peut définir une action :</p>
|
||
|
||
<ul>
|
||
<li>ignore : on ne fait rien. Peut servir en cas de debug.</li>
|
||
<li>enforced : le blocage est actif, mais la coupure se fera au moment du RCPT TO: avec une réponse 550 5.3.2 Service currently unavailable</li>
|
||
<li>drop : efficace, on coupe court avec une réponse 521 5.3.2 Service currently unavailable</li>
|
||
</ul>
|
||
|
||
<p>Un serveur qui sera accepté sera mis en liste blanche pour les prochaines fois afin de ne pas mobiliser de la ressource pour rien.</p>
|
||
|
||
<h4 id="contrôles-simples">Contrôles simples</h4>
|
||
|
||
<p>Simples ne veut pas dire inefficaces. Personnellement, je n’utilise qu’eux, n’aimant pas le principe du greylisting.</p>
|
||
|
||
<p>a – Access list</p>
|
||
|
||
<p>Simplissime, ce contrôle va permettre de bloquer des IPs et contrairement au blocage dans Postfix, ici avec l’action sur drop, c’est immédiat. Ciao !</p>
|
||
|
||
<p>Pour l’activer, ajoutez ces lignes dans le fichier /etc/postfix/main.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr
|
||
postscreen_blacklist_action = drop
|
||
</code></pre></div></div>
|
||
|
||
<p>Le fichier /etc/postfix/postscreen_access.cidr doit ressembler à cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>xxx.xxx.xxx.xxx reject
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>b – Greet banner</p>
|
||
|
||
<p>Ce contrôle joue sur une subtilité du protocole SMTP. En effet, si le serveur répond avec « 250-On attend un pneu…« , le tiret après le 250 indique qu’il y a plusieurs lignes.</p>
|
||
|
||
<p>Et il attend le temps indiqué avant d’envoyer le « 250 mail.xoyize.xyz ESMTP mail (Debian/GNU)« .</p>
|
||
|
||
<p>Du coup, un zombie trop rapide se fera avoir, et hop, dehors !</p>
|
||
|
||
<p>Pour l’activer, ajoutez ces lignes dans le fichier /etc/postfix/main.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_greet_wait = 3s
|
||
postscreen_greet_banner = On attend un pneu...
|
||
postscreen_greet_action = drop
|
||
</code></pre></div></div>
|
||
|
||
<p>Le temps d’attente sert également à Postscreen pour consulter les Dnsbl qu’on voit juste en dessous.</p>
|
||
|
||
<p>c – Dnsbl</p>
|
||
|
||
<p>Ici, on va interroger des RBL.</p>
|
||
|
||
<p>Le principe est simple. On passe par une interrogation DNS pour savoir si un MX distant est légitime ou non.</p>
|
||
|
||
<p>Une réponse du genre 127.0.0.X indique qu’il ne faut pas accepter le mail (le type de réponse dépend de la liste dans la quelle se trouve l’IP). On peut éventuellement ne prendre que certaines réponses.</p>
|
||
|
||
<p>Pour l’activer, ajoutez ces lignes dans le fichier /etc/postfix/main.cf :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_dnsbl_sites =
|
||
zen.spamhaus.org*2,
|
||
bl.spamcop.net,
|
||
b.barracudacentral.org*2
|
||
postscreen_dnsbl_threshold = 3
|
||
postscreen_dnsbl_action = drop
|
||
</code></pre></div></div>
|
||
|
||
<p>J’utilise trois listes. En mettre de trop n’est pas forcement une bonne idée, temps d’interrogation plus long, trouver comment bien pondérer chacune…</p>
|
||
|
||
<p>Sachez cependant qu’il en existe plein. Vous en trouverez ici par exemple : https://www.dnsbl.info/dnsbl-list.php</p>
|
||
|
||
<p>Pour faire une interrogation à la main, si votre IP est AAA.BBB.CCC.DDD :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dig +short DDD.CCC.BBB.AAA.b.barracudacentral.org
|
||
</code></pre></div></div>
|
||
|
||
<p>On passe par un PTR record, ce qui fait qu’on peut connaitre « l’état » d’une IP en interrogeant n’importe quel DNS, ce dernier ira faire la requête au bon endroit.</p>
|
||
|
||
<p>Si pas de retour, l’IP n’est pas blacklisté, si retour, IP blacklisté donc.</p>
|
||
|
||
<h4 id="contrôle-profond">Contrôle profond</h4>
|
||
|
||
<p>Très efficace contre les « lourds » qui ne respecte pas le protocole SMTP, ces vérifications ont cependant un inconvénient comme je l’expliquais :</p>
|
||
|
||
<p>Ils introduisent un Greylisting. Pour effectuer ces vérifications, Postscreen prend en charge tout la communication SMTP, mais le bougre à la fin n’est pas capable de repasser la main à Postfix.</p>
|
||
|
||
<p>Postscreen règle le problème très « simplement » en répondant à la fin : 450 4.3.2 Service currently unavailable et en mettant au passage le serveur en liste blanche.</p>
|
||
|
||
<p>Le voila le Greylisting … Un serveur SMTP bien configuré se doit de retenter l’envoi et comme il sera reconnu par Postscreen, ce dernier passera la main à Postfix.</p>
|
||
|
||
<p>Ça, c’est la théorie… Les trucs configurés avec les pieds, on en voit partout et il est tout a fait possible que le SMTP distant, bien que légitime, ne retente jamais. C’est pourquoi je n’aime pas le principe du Greylisting.</p>
|
||
|
||
<p>A vous de voir comme vous le sentez …</p>
|
||
|
||
<p>a – Pipelining</p>
|
||
|
||
<p>Postscreen ne gérant pas le pipelining (du full duplex en quelque sorte), il l’indique durant la communication. Un client « correct » le prendra alors en compte. Un « lourd », certainement que non, et bam !</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_pipelining_enable = yes
|
||
postscreen_pipelining_action = enforce
|
||
</code></pre></div></div>
|
||
|
||
<p>b – Non SMTP Command</p>
|
||
|
||
<p>Contrôle sur d’éventuelles commandes CONNECT, GET et POST utilisées par les « lourds » passant par des proxys.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_non_smtp_command_enable = yes
|
||
postscreen_non_smtp_command_action = enforce
|
||
</code></pre></div></div>
|
||
|
||
<p>c – Bare Newline</p>
|
||
|
||
<p>La norme SMTP impose que chaque ligne se terminer par <CR><LF>. Les « lourds », souvent, n’utilisent que <LF>.</LF></LF></CR></p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postscreen_bare_newline_enable = yes
|
||
postscreen_bare_newline_action = enforce
|
||
</code></pre></div></div>
|
||
|
||
<hr />
|
||
|
||
<h2 id="rspamd">Rspamd</h2>
|
||
|
||
<p>Sixième partie de ma série d’articles sur la mise en place d’un serveur mail complet. Courage, on arrive au bout ! Nous allons installer et configurer le digne remplaçant du vénérable Spamassassin, j’ai nommé Rspamd.</p>
|
||
|
||
<h3 id="installation-1">Installation</h3>
|
||
|
||
<p>Le paquet Rspamd disponible dans les dépôts de Debian n’étant plus maintenu, on va passer par les dépôts de Rspamd</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
|
||
</code></pre></div></div>
|
||
|
||
<p>La, si un message évoque un problème de certificats, c’est que le paquet ca-certificates n’est pas présent.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>echo "deb [arch=amd64] http://rspamd.com/apt-stable/ stretch main" > /etc/apt/sources.list.d/rspamd.list
|
||
apt-get update
|
||
apt-get install rspamd
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour fonctionner, Rspamd a besoin d’un serveur redis. Perso, j’ai une VM dédiée à cela, mais ici, on va l’installer sur le serveur mail.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>apt-get install redis-server
|
||
</code></pre></div></div>
|
||
|
||
<p>Nous verrons dans un article plus tard l’installation d’un serveur redis « général ».</p>
|
||
|
||
<h3 id="configuration-3">Configuration</h3>
|
||
|
||
<h4 id="assistant">Assistant</h4>
|
||
|
||
<p>Pour la configuration initiale, un assistant est disponible, ne nous en privons pas :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>rspamadm configwizard
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis répondez :</p>
|
||
|
||
<p>Do you wish to continue?[Y/n]: -> Yes
|
||
Controller password is not set, do you want to set one?[Y/n]: -> Yes (et vous le renseignez)
|
||
Do you wish to set Redis servers?[Y/n]: -> Yes
|
||
Input read only servers separated by <code class="language-plaintext highlighter-rouge">,</code> [default: localhost]: (si server Redis sur un autre serveur, vous indiquez son ip.)
|
||
Input write only servers separated by <code class="language-plaintext highlighter-rouge">,</code> [default: localhost]: (idem)
|
||
Do you have any password set for your Redis?[y/N]: si y’a un pass, vous l’indiquez
|
||
Do you have any specific database for your Redis?[y/N]: s’il faut spécifier une base (dans le cas d’un redis central), vous la spécifiez aussi
|
||
Do you want to setup dkim signing feature?[y/N]: -> No (on le fera après)
|
||
Expire time for new tokens [100d]: on laisse par défaut.
|
||
Reset previous data?[y/N]: -> No, vu qu’il n’y en a pas
|
||
Do you wish to convert them to Redis?[Y/n]: -> Yes</p>
|
||
|
||
<p>Et on termine en rechargeant :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>service rspamd reload
|
||
</code></pre></div></div>
|
||
|
||
<h4 id="quelques-ajustements">Quelques ajustements</h4>
|
||
|
||
<p>Au niveau de la configuration, tout se passe dans /etc/rspamd/, cependant, modifier ces fichiers n’est pas une bonne idée car comme indiqué dedans, ils se retrouveraient écrasés en cas d’update. On va donc utiliser le répertoire <strong>/etc/rspamd/local.d</strong> pour y indiquer nos modifications.</p>
|
||
|
||
<p>1 – classifier-bayes.conf</p>
|
||
|
||
<p>Ce fichier est créé par l’assistant, il suffit de rajouter la première ligne</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>autolearn = true;
|
||
backend = "redis";
|
||
new_schema = true;
|
||
expire = 8640000;
|
||
</code></pre></div></div>
|
||
|
||
<p>2 – worker-controller.inc</p>
|
||
|
||
<p>Fichier également créé par l’assistant. Ici, on rajoute les deux lignes pour les sockets. Le socket sur le port 11334 sera pour l’interface Web (c’est pour cela qu’on le bind sur l’ip interne de la machine et non sur localhost). Le second socket servira pour l’apprentissage des spams.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>password = "$2$b51na53x357bjrz5khmewri4o7um4s8i$mzegmbea3osb4yuzx93o4qzjonft8h87i9pxu9gwgyx9wkqqizab"
|
||
bind_socket = "127.0.0.1:11334";
|
||
bind_socket = "/var/run/rspamd/rspamd.sock mode=0666 owner=nobody";
|
||
</code></pre></div></div>
|
||
|
||
<p>3 – metrics.conf</p>
|
||
|
||
<p>Fichier à créer. Il permet d’indiquer vos valeurs pour les différentes actions.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>actions {
|
||
add_header = 5;
|
||
greylist = 25;
|
||
reject = 50;
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>A vous de bien régler ces paramètres. Ici, le reject est volontairement haut, dans un but de test et pour pouvoir le baisser au fur et à mesure.</p>
|
||
|
||
<p>4 – milter_headers.conf</p>
|
||
|
||
<p>Ce fichier est à créer. Il indique d’ajouter des entêtes dans les mails. Grace à eux, vous pourrez voir directement dans votre logiciel ce qui a provoqué ou non le marquage en spam. Mettez simplement :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>extended_spam_headers = true;
|
||
</code></pre></div></div>
|
||
|
||
<p>5 – rspamd_update.conf</p>
|
||
|
||
<p>Dernier fichier à créer. Permet à Rspamd de se mettre à jour automatiquement au niveau des règles. On l’active, tout simplement :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>enabled = true;
|
||
</code></pre></div></div>
|
||
|
||
<p>Et voila pour la configuration de Rspamd. Il existe d’autres modules, mais nous en parlerons dans un futur article ou nous approfondirons le sujet sur Rspamd.</p>
|
||
|
||
<h3 id="liaison-avec-postfix">Liaison avec Postfix</h3>
|
||
|
||
<p>Pour dire à Postfix de passer le mail à Rspamd, c’est le protocole milter que l’on va utiliser en indiquant en bas de notre fichier <strong>/etc/postfix/main.cf</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>milter_protocol = 6
|
||
milter_default_action = accept
|
||
smtpd_milters = inet:localhost:11332
|
||
non_smtpd_milters=inet:localhost:11332
|
||
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
||
</code></pre></div></div>
|
||
|
||
<p>Le milter_default_action spécifie l’action par défaut au cas ou Rspamd ne serait pas disponible. On recharge :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>postfix reload
|
||
service rspamd restart
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="apprentissage">Apprentissage</h3>
|
||
|
||
<p>Pour l’utilisation de Rspamd au quotidien, pas grand chose à faire. C’est automatique, même pour les mises à jour. Cependant, si vous avez déjà un corpus de spam et de ham à lui apprendre, ce n’est pas une mauvaise chose de commencer par la, le filtre bayésien ne fonctionnant pas à moins de 200 mails appris par catégorie. Pour se faire, j’ai toujours deux dossiers récents de spams et de hams que je garde sous le coude. Je les déplace dans ma bal dans deux répertoires. Puis pour le spam :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>rspamc -h /var/run/rspamd/rspamd.sock learn_spam /var/vmail/xoyize.xyz/ym/mailbox/.Spamtolearn/
|
||
</code></pre></div></div>
|
||
|
||
<p>et pour le ham :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>rspamc -h /var/run/rspamd/rspamd.sock learn_ham /var/vmail/xoyize.xyz/ym/mailbox/.Hamtolearn/
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour regarder ensuite les statistiques et voir à combien on en est :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>rspamc -h /var/run/rspamd/rspamd.sock stat
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour un bon apprentissage, il faut lui apprendre des spams certes, mais également des hams, c’est important.</p>
|
||
|
||
<h3 id="apprentissage-par-déplacement">Apprentissage par déplacement.</h3>
|
||
|
||
<p>Couplé avec Dovecot, Rspamd nous propose de pouvoir apprendre également en fonction des actions des utilisateurs. Si un mail est déplacé vers le répertoire spam, il sera appris comme tel et au contraire, s’il est sorti du répertoire Spam vers autre chose que la corbeille, il sera appris comme Ham. Dans le fichier <strong>/etc/dovecot/conf.d/90-sieve-extprograms.conf</strong>, mettez cela :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>plugin {
|
||
sieve_plugins = sieve_imapsieve sieve_extprograms
|
||
|
||
imapsieve_mailbox1_name = Junk
|
||
imapsieve_mailbox1_causes = COPY
|
||
imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve
|
||
|
||
imapsieve_mailbox2_name = *
|
||
imapsieve_mailbox2_from = Junk
|
||
imapsieve_mailbox2_causes = COPY
|
||
imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-ham.sieve
|
||
|
||
sieve_pipe_bin_dir = /etc/dovecot/sieve
|
||
|
||
sieve_global_extensions = +vnd.dovecot.pipe
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge Dovecot :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dovecot reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Quand un mail sera déplacé dans le répertoire Junk (Spam), le filtre report-spam.sieve sera appelé. Quand un mail sera déplacé depuis le répertoire Junk vers un autre répertoire (autre que la Corbeille), le filtre report-ham.sieve sera appelé. On va créer les filtre sieves. On créer un répertoire :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /etc/dovecot/sieve/
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis un fichier <strong>/etc/dovecot/sieve/report-ham.sieve</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
|
||
|
||
if environment :matches "imap.email" "*" {
|
||
set "email" "${1}";
|
||
}
|
||
|
||
pipe :copy "train-spam.sh" [ "${email}" ];
|
||
</code></pre></div></div>
|
||
|
||
<p>puis, <strong>/etc/dovecot/sieve/report-spam.sieve</strong> :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
|
||
|
||
if environment :matches "imap.mailbox" "*" {
|
||
set "mailbox" "${1}";
|
||
}
|
||
|
||
if string "${mailbox}" "Trash" {
|
||
stop;
|
||
}
|
||
|
||
if environment :matches "imap.email" "*" {
|
||
set "email" "${1}";
|
||
}
|
||
|
||
pipe :copy "train-ham.sh" [ "${email}" ];
|
||
</code></pre></div></div>
|
||
|
||
<p>On les compile :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>sievec /etc/dovecot/sieve/report-ham.sieve
|
||
sievec /etc/dovecot/sieve/report-spam.sieve
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis on change l’user :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chown vmail:vmail /etc/dovecot/sieve/report-*
|
||
</code></pre></div></div>
|
||
|
||
<p>On va passer à la création de nos deux petits scripts : <br />
|
||
Tout d’abord</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/dovecot/sieve/train-ham.sh
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>exec /usr/bin/rspamc -h /var/run/rspamd/rspamd.sock learn_ham
|
||
</code></pre></div></div>
|
||
|
||
<p>et</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>/etc/dovecot/sieve/train-spam.sh
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>exec /usr/bin/rspamc -h /var/run/rspamd/rspamd.sock learn_spam
|
||
</code></pre></div></div>
|
||
|
||
<p>Et on leur donne les droits :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chown vmail:vmail /etc/dovecot/sieve/train-*
|
||
chmod +x /etc/dovecot/sieve/train-*
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge Dovecot :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dovecot reload
|
||
</code></pre></div></div>
|
||
|
||
<p>Et voila, vous pouvez vérifier en déplaçant un spam ou un ham et voir dans les fichiers de logs Fichier /var/log/mail.log :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mail dovecot: imap(ym@xoyize.xyz): sieve: pipe action: piped message to program `train-spam.sh'
|
||
</code></pre></div></div>
|
||
|
||
<p>Fichier /var/log/rspamd/rspamd.log :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>#9159(controller) <e6896a>; csession; rspamd_controller_check_password: allow unauthorized connection from a unix socket
|
||
#9159(controller) <e6896a>; csession; rspamd_message_parse: loaded message; id: <004801d4dc01$02b7a725$5d7532ac$@lourd.com>; queue-id: <undef>; size: 1732; checksum: <b32bcf8d811d92610d2808ce822930dc>
|
||
#9159(controller) <e6896a>; csession; rspamd_mime_text_part_utf8_convert: converted from IBM852 to UTF-8 inlen: 104, outlen: 104 (104 UTF16 chars)
|
||
#9159(controller) <e6896a>; csession; rspamd_controller_learn_fin_task: </var/run/rspamd/rspamd.sock> learned message as spam: 004801d4dc01$02b7a725$5d7532ac$@lourd.com
|
||
</code></pre></div></div>
|
||
|
||
<h2 id="signature-dkim">Signature DKIM</h2>
|
||
|
||
<h3 id="configuration-4">Configuration</h3>
|
||
|
||
<p>On va tout d’abord créer le répertoire qui va accueillir nos clés :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>mkdir /var/lib/rspamd/dkim
|
||
</code></pre></div></div>
|
||
|
||
<p>Créez un fichier <strong>/etc/rspamd/local.d/dkim_signing.conf</strong> et ajoutez :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>path = "/var/lib/rspamd/dkim/dkim.$domain.key";
|
||
allow_username_mismatch = true;
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="signature-dun-domaine">Signature d’un domaine</h3>
|
||
|
||
<p>Pour signer un nouveau domaine :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>rspamadm dkim_keygen -b 2048 -s dkim -d xoyize.xyz -k /var/lib/rspamd/dkim/dkim.xoyize.xyz.key | tee -a /var/lib/rspamd/dkim/dkim.xoyize.xyz.pub
|
||
</code></pre></div></div>
|
||
|
||
<ul>
|
||
<li>-b indique que l’on veut une clé de 2048 bits.</li>
|
||
<li>-s est le sélecteur.</li>
|
||
<li>-d indique le domaine.</li>
|
||
<li>-k pour dire ou l’on veut stocker la clé privée.</li>
|
||
<li>et pour terminer, on enregistre la clé publique, qui par défaut est simplement affichée, dans un fichier.</li>
|
||
</ul>
|
||
|
||
<p>Gardez la clé publique sous le coude, on la rajoutera dans le DNS.</p>
|
||
|
||
<p>Pour info, il est tout a fait possible d’avoir des sélecteurs différents, soit en fonction des domaines, soit pour versionner, etc… Dans ce cas, il faudrait renseigner le fichier /etc/rspamd/local.d/dkim_signing.conf de la sorte :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>path = "/var/lib/rspamd/dkim/$selector.$domain.key";
|
||
selector_map = "/etc/rspamd/dkim_selectors.map";
|
||
</code></pre></div></div>
|
||
|
||
<p>Et le fichier /etc/rspamd/dkim_selectors.map devra contenir :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>domaine.fr selecteur
|
||
ouestline.net autre_selecteur
|
||
[...]
|
||
</code></pre></div></div>
|
||
|
||
<p>Puis changeons les droits :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>chmod u=rw,g=r,o= /var/lib/rspamd/dkim/*
|
||
chown _rspamd /var/lib/rspamd/dkim/*
|
||
</code></pre></div></div>
|
||
|
||
<p>On recharge :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>service rspamd reload
|
||
</code></pre></div></div>
|
||
|
||
<h3 id="interface-web">Interface Web</h3>
|
||
|
||
<p>Rspamd propose une interface Web. Avant de la tester, je pensais que c’était un gadget, mais après avoir vu la chose, force est de constater qu’elle est plutôt bien fichue et permet de voir l’historique des messages, ce qui a provoqué ou non leur tag, rejet… On peut aussi y modifier les valeurs de metrics, les symboles (ce qui sert à détecter un spam par rapport à un critère donné). Bref, très pratique, je vous conseille de vous en servir. C’est déjà en écoute sur le port 11334, mais on ne va pas faire le goret et ouvrir cela sur le routeur. Servez vous d’un reverse proxy (Nginx est juste parfait) et indiquez dans la configuration de votre serveur.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>location /rspamd/ {
|
||
proxy_pass http://ip.interne.mail:11334/;
|
||
proxy_http_version 1.1;
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p>Pour s’y connecter ensuite : https://www.xoyize.xyz/rspamd (par exemple) et le mot de passe est celui qu’on a renseigné grâce à l’assistant.</p>
|
||
|
||
<p>Configurer Nginx pour l’interface web de Rspamd</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>nano /etc/nginx/conf.d/spam.xoyize.xyz.conf
|
||
</code></pre></div></div>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code> ##
|
||
# Virtual Host spam.xoyize.xyz (Rspamd)
|
||
##
|
||
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
|
||
## redirect http to https ##
|
||
server_name spam.xoyize.xyz;
|
||
return 301 https://$server_name$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name spam.xoyize.xyz;
|
||
|
||
include ssl_dh_headers_ocsp;
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:11334/;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
}
|
||
|
||
}
|
||
</code></pre></div></div>
|
||
|
||
<p><strong>Conclusion</strong><br />
|
||
Voila, Rspamd est installé et opérationnel. La configuration reste simple, mais comme déjà dit, il existe d’autres modules que l’on peut utiliser. Ce sera pour un autre article, hors de la série sur le serveur de messagerie. La configuration présentée ici est bien suffisante dans un premier temps. En attendant, si vous voulez en savoir plus, la documentation officielle est ici : https://rspamd.com/doc/ On va passer à la finalisation de notre architecture mail avec, dans la partie VII, la mise en place des enregistrements SPF, DKIM et DMARC dans notre DNS.</p>
|
||
|
||
<h2 id="dkim-spf-et-dmarc">DKIM, SPF et DMARC</h2>
|
||
|
||
<p>Dans cette avant dernière partie de ma série d’articles sur la mise en place d’un serveur mail, (la dernière sera la conclusion), nous allons mettre le coup final à notre configuration en mettant à jour nos enregistrements DNS.</p>
|
||
|
||
<p>Dans l’idéal, vous gérez vous même votre DNS, sinon, faites les modifications indiquées dans l’interface de votre registar.</p>
|
||
|
||
<p>Ces trois enregistrements s’appuient sur de simples champss TXT, afin que tous les resolvers les comprennent.</p>
|
||
|
||
<p>Il fut un temps ou on trouvait un champ SPF mais celui ci a été abandonné car pas vraiment de RFC pour cela. Il est conseillé maintenant de ne faire qu’un enregistrement TXT.</p>
|
||
|
||
<p>Bref, c’est tout simple, mais c’est vital, du moins, pour votre système de messagerie !</p>
|
||
|
||
<h3 id="spf">SPF</h3>
|
||
|
||
<p>Cet enregistrement va stipuler une ou plusieurs IP(s) que l’ont autorise à envoyer des mails en notre nom.</p>
|
||
|
||
<p>Dans votre fichier de zone, indiquez :</p>
|
||
|
||
<p>xoyize.xyz. IN TXT “v=spf1 a mx ip4:78.235.240.223 ip6:2a01:e34:eebf:df3::1 -all”</p>
|
||
|
||
<p>On indique d’accepter les mails venant de notre IP et de refuser strictement les autres.</p>
|
||
|
||
<h3 id="dkim">DKIM</h3>
|
||
|
||
<p>Cet enregistrement indique la clé publique correspondant à la clé privée utilisée par Rspamd pour signer les mails.</p>
|
||
|
||
<p>Un serveur distant pourra alors vérifier l’authenticité du mail en vérifiant si la clé privée utilisée pour la signature correspond à la clé publique publiée dans le DNS.</p>
|
||
|
||
<p>Reprenez la clé publique que vous aviez gardé sous le coude dans la partie VI :</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dkim._domainkey IN TXT ( "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCY7hcaoWyU0i7ydFiJFjnOG+Hk8UWMA+7y+RTL1BicoHm5KLwNhqO72VHW5wirk0WqEoTcNjnAIhvI1Ur07VfWh/CdACavzt2+DGKB3eiXPAbLhqI5Y72DiW1gaYUMVR2xmPtDA6aptrA/vCX5LGpyDPNP+YpTqch9eLBv/Gn9ciO3L+kgKLsDV6VyV5O" "6e5+n3PTsrXvjKJgHEDYp3QD1clLS9X9tw9Tb+BPV+qxc286niKcz5qgBhihN8GIKXSIQmf4SuBlffgAfX4Mgu9MaXbmyxryF4BGKP1ktLKuJOynla6QrkATNJmMy78ECUrUTZ8i0PVVgyeTQCkPmhAwIDAQAB;" )
|
||
</code></pre></div></div>
|
||
|
||
<p>Insérez tout cela dans votre fichier de zone, tout simplement.</p>
|
||
|
||
<h3 id="dmarc">DMARC</h3>
|
||
|
||
<p>Ce n’est pas à proprement parlé un système de protection, mais plus une façon de dire ce qu’il faut faire avec des mails qui ne passe pas votre politique SPF et/ou DKIM.<br />
|
||
Une consigne pour le SMTP qui reçoit en quelque sorte. A ne pas négliger, car l’absence de ce champ peut compromettre la livraison de vos mails.</p>
|
||
|
||
<p>Insérez une ligne semblable à la suivante :</p>
|
||
|
||
<p>_dmarc.xoyize.xyz. IN TXT “v=DMARC1; p=none; rua=mailto:postmaster@xoyize.xyz;ruf=mailto:postmaster@xoyize.xyz”</p>
|
||
|
||
<p>le p indique la politique à appliquer chez le SMTP si un mail reçu en votre nom (de domaine) ne passe ni SPF, ni DKIM.</p>
|
||
|
||
<p>Il est possible de spécifier :</p>
|
||
|
||
<ul>
|
||
<li>none, ne rien faire, mais juste le consigner dans les rapports envoyés à postmaster@xoyize.xyz</li>
|
||
<li>quarantine : mettre le mail en spam.</li>
|
||
<li>reject : le rejeter</li>
|
||
<li>rua indique à quelle adresse recevoir les reports agrégés</li>
|
||
<li>ruf indique où recevoir les reports détaillés (envoyés à chaque fois qu’un mail en votre nom est refusé)</li>
|
||
</ul>
|
||
|
||
<p>Pour plus d’informations : https://dmarc.org/wiki</p>
|
||
|
||
<p>Au début, disons le premier mois, utilisez un p=none et une fois qu’on voit que tout est OK (les mails refusés le sont à juste titre et non pas du à une boulette de votre côté), vous pouvez passer sur p=quarantine, ou p=reject.</p>
|
||
|
||
<h2 id="tests-avec-dig">Tests avec dig</h2>
|
||
|
||
<p>Pour tester, on va utiliser dig et au passage, l’interrogation se fera auprès du DNS de Google pour être sur que la propagation DNS est bonne.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dig xoyize.xyz TXT @8.8.4.4 +short
|
||
</code></pre></div></div>
|
||
|
||
<p>Va vous renvoyer les enregistrements TXT, dont le SPF.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dig dkim._domainkey.xoyize.xyz TXT @8.8.4.4 +short
|
||
</code></pre></div></div>
|
||
|
||
<p>Va vous renvoyer votre DKIM.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>dig _dmarc.xoyize.xyz TXT @8.8.4.4 +short
|
||
</code></pre></div></div>
|
||
|
||
<p>Bah, le Dmarc hein…</p>
|
||
|
||
<p>On peut aussi utiliser des outils en ligne : http://www.appmaildev.com, https://mxtoolbox.com, etc…</p>
|
||
|
||
<h2 id="dnsbl---liste-noire">DNSBL - liste noire</h2>
|
||
|
||
<p>Ensuite, il peut être utile de vérifier de temps à autres si vous n’êtes pas en liste noire sur une des nombreuses DNSBL.</p>
|
||
|
||
<p>Il existe de nombreux sites ou script qui permettent de faire cette vérification.</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>https://mxtoolbox.com/blacklists.aspx
|
||
http://multirbl.valli.org
|
||
http://www.anti-abuse.org/multi-rbl-check/
|
||
etc…
|
||
</code></pre></div></div>
|
||
|
||
<p>Si vous vous retrouvez listé, chaque liste gérant la chose à sa façon, à vous d’aller voir sur leur site pour vous faire délister.</p>
|
||
|
||
<h2 id="liens-1">Liens</h2>
|
||
|
||
<p>Voila quelques liens pour tester un peu votre serveur :</p>
|
||
|
||
<p>https://www.mail-tester.com : très pratique, permet de voir si vous n’auriez pas louper une étape en vous donnant une note.</p>
|
||
|
||
<p>https://www.emailsecuritycheck.net : teste la protection de votre système en envoyant 7 mails douteux. Le 3 ne doit même pas arriver, les autres doivent se retrouver en spam.</p>
|
||
|
||
<p>Plus généralement, le site https://mxtoolbox.com est très complet car il couvre de nombreuses vérifications (et pas qu’au sujet de la messagerie).</p>
|
||
|
||
<h2 id="erreurs">ERREURS</h2>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Oct 22 10:55:10 xoyize postfix/lmtp[15186]: E7AFA63841: to=<ym@xoyize.fr>, orig_to=<root@xoyize.xyz>, relay=none, delay=583, delays=583/0.03/0/0, dsn=4.4.1, status=deferred (connect to xoyize.xyz[private/dovecot-lmtp]: No such file or directory)
|
||
</code></pre></div></div>
|
||
|
||
<p>mv /var/spool/postfix/private/lmtp /var/spool/postfix/private/dovecot-lmtp</p>
|
||
|
||
<p>main.cf</p>
|
||
|
||
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code># Configure Root CA certificates
|
||
# (for example, avoids getting "Untrusted TLS connection established to" messages in logs)
|
||
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
||
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
||
|
||
mydomain = cinay.xyz
|
||
mydestination = localhost
|
||
relayhost =
|
||
|
||
</code></pre></div></div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<div class="d-print-none"><footer class="article__footer"><meta itemprop="dateModified" content="2019-10-21T00:00:00+02:00"><!-- start custom article footer snippet -->
|
||
|
||
<!-- end custom article footer snippet -->
|
||
<!--
|
||
<div align="right"><a type="application/rss+xml" href="/feed.xml" title="S'abonner"><i class="fa fa-rss fa-2x"></i></a>
|
||
|
||
 </div>
|
||
-->
|
||
</footer>
|
||
<div class="article__section-navigator clearfix"><div class="previous"><span>PRÉCÉDENT</span><a href="/2019/10/17/Linux-gestion-des-utilisateurs-et-permissions-serveur-web.html">Linux, gestion des utilisateurs ,permissions des fichiers et répertoires d’un serveur web</a></div><div class="next"><span>SUIVANT</span><a href="/2019/12/11/Trousseau-de-Cles-Gnome-Keyring.html">XFCE/GNOME Porte-clés ou trousseau (gnome-keyring)</a></div></div></div>
|
||
|
||
</div>
|
||
|
||
<script>(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
$(function() {
|
||
var $this ,$scroll;
|
||
var $articleContent = $('.js-article-content');
|
||
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
|
||
var scroll = hasSidebar ? '.js-page-main' : 'html, body';
|
||
$scroll = $(scroll);
|
||
|
||
$articleContent.find('.highlight').each(function() {
|
||
$this = $(this);
|
||
$this.attr('data-lang', $this.find('code').attr('data-lang'));
|
||
});
|
||
$articleContent.find('h1[id], h2[id], h3[id], h4[id], h5[id], h6[id]').each(function() {
|
||
$this = $(this);
|
||
$this.append($('<a class="anchor d-print-none" aria-hidden="true"></a>').html('<i class="fas fa-anchor"></i>'));
|
||
});
|
||
$articleContent.on('click', '.anchor', function() {
|
||
$scroll.scrollToAnchor('#' + $(this).parent().attr('id'), 400);
|
||
});
|
||
});
|
||
});
|
||
})();
|
||
</script>
|
||
|
||
</div><section class="page__comments d-print-none"></section></article><!-- start custom main bottom snippet -->
|
||
<!-- end custom main bottom snippet -->
|
||
</div>
|
||
</div></div></div></div>
|
||
</div><script>(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
var $body = $('body'), $window = $(window);
|
||
var $pageRoot = $('.js-page-root'), $pageMain = $('.js-page-main');
|
||
var activeCount = 0;
|
||
function modal(options) {
|
||
var $root = this, visible, onChange, hideWhenWindowScroll = false;
|
||
var scrollTop;
|
||
function setOptions(options) {
|
||
var _options = options || {};
|
||
visible = _options.initialVisible === undefined ? false : show;
|
||
onChange = _options.onChange;
|
||
hideWhenWindowScroll = _options.hideWhenWindowScroll;
|
||
}
|
||
function init() {
|
||
setState(visible);
|
||
}
|
||
function setState(isShow) {
|
||
if (isShow === visible) {
|
||
return;
|
||
}
|
||
visible = isShow;
|
||
if (visible) {
|
||
activeCount++;
|
||
scrollTop = $(window).scrollTop() || $pageMain.scrollTop();
|
||
$root.addClass('modal--show');
|
||
$pageMain.scrollTop(scrollTop);
|
||
activeCount === 1 && ($pageRoot.addClass('show-modal'), $body.addClass('of-hidden'));
|
||
hideWhenWindowScroll && window.hasEvent('touchstart') && $window.on('scroll', hide);
|
||
$window.on('keyup', handleKeyup);
|
||
} else {
|
||
activeCount > 0 && activeCount--;
|
||
$root.removeClass('modal--show');
|
||
$window.scrollTop(scrollTop);
|
||
activeCount === 0 && ($pageRoot.removeClass('show-modal'), $body.removeClass('of-hidden'));
|
||
hideWhenWindowScroll && window.hasEvent('touchstart') && $window.off('scroll', hide);
|
||
$window.off('keyup', handleKeyup);
|
||
}
|
||
onChange && onChange(visible);
|
||
}
|
||
function show() {
|
||
setState(true);
|
||
}
|
||
function hide() {
|
||
setState(false);
|
||
}
|
||
function handleKeyup(e) {
|
||
// Char Code: 27 ESC
|
||
if (e.which === 27) {
|
||
hide();
|
||
}
|
||
}
|
||
setOptions(options);
|
||
init();
|
||
return {
|
||
show: show,
|
||
hide: hide,
|
||
$el: $root
|
||
};
|
||
}
|
||
$.fn.modal = modal;
|
||
});
|
||
})();
|
||
</script><div class="modal modal--overflow page__search-modal d-print-none js-page-search-modal"><script>
|
||
(function () {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
// search panel
|
||
var search = (window.search || (window.search = {}));
|
||
var useDefaultSearchBox = window.useDefaultSearchBox === undefined ?
|
||
true : window.useDefaultSearchBox ;
|
||
|
||
var $searchModal = $('.js-page-search-modal');
|
||
var $searchToggle = $('.js-search-toggle');
|
||
var searchModal = $searchModal.modal({ onChange: handleModalChange, hideWhenWindowScroll: true });
|
||
var modalVisible = false;
|
||
search.searchModal = searchModal;
|
||
|
||
var $searchBox = null;
|
||
var $searchInput = null;
|
||
var $searchClear = null;
|
||
|
||
function getModalVisible() {
|
||
return modalVisible;
|
||
}
|
||
search.getModalVisible = getModalVisible;
|
||
|
||
function handleModalChange(visible) {
|
||
modalVisible = visible;
|
||
if (visible) {
|
||
search.onShow && search.onShow();
|
||
useDefaultSearchBox && $searchInput[0] && $searchInput[0].focus();
|
||
} else {
|
||
search.onShow && search.onHide();
|
||
useDefaultSearchBox && $searchInput[0] && $searchInput[0].blur();
|
||
setTimeout(function() {
|
||
useDefaultSearchBox && ($searchInput.val(''), $searchBox.removeClass('not-empty'));
|
||
search.clear && search.clear();
|
||
window.pageAsideAffix && window.pageAsideAffix.refresh();
|
||
}, 400);
|
||
}
|
||
}
|
||
|
||
$searchToggle.on('click', function() {
|
||
modalVisible ? searchModal.hide() : searchModal.show();
|
||
});
|
||
// Char Code: 83 S, 191 /
|
||
$(window).on('keyup', function(e) {
|
||
if (!modalVisible && !window.isFormElement(e.target || e.srcElement) && (e.which === 83 || e.which === 191)) {
|
||
modalVisible || searchModal.show();
|
||
}
|
||
});
|
||
|
||
if (useDefaultSearchBox) {
|
||
$searchBox = $('.js-search-box');
|
||
$searchInput = $searchBox.children('input');
|
||
$searchClear = $searchBox.children('.js-icon-clear');
|
||
search.getSearchInput = function() {
|
||
return $searchInput.get(0);
|
||
};
|
||
search.getVal = function() {
|
||
return $searchInput.val();
|
||
};
|
||
search.setVal = function(val) {
|
||
$searchInput.val(val);
|
||
};
|
||
|
||
$searchInput.on('focus', function() {
|
||
$(this).addClass('focus');
|
||
});
|
||
$searchInput.on('blur', function() {
|
||
$(this).removeClass('focus');
|
||
});
|
||
$searchInput.on('input', window.throttle(function() {
|
||
var val = $(this).val();
|
||
if (val === '' || typeof val !== 'string') {
|
||
search.clear && search.clear();
|
||
} else {
|
||
$searchBox.addClass('not-empty');
|
||
search.onInputNotEmpty && search.onInputNotEmpty(val);
|
||
}
|
||
}, 400));
|
||
$searchClear.on('click', function() {
|
||
$searchInput.val(''); $searchBox.removeClass('not-empty');
|
||
search.clear && search.clear();
|
||
});
|
||
}
|
||
});
|
||
})();
|
||
</script><div class="search search--dark">
|
||
<div class="main">
|
||
<div class="search__header">Recherche</div>
|
||
<div class="search-bar">
|
||
<div class="search-box js-search-box">
|
||
<div class="search-box__icon-search"><i class="fas fa-search"></i></div>
|
||
<input id="search-input" type="text" />
|
||
<div class="search-box__icon-clear js-icon-clear">
|
||
<a><i class="fas fa-times"></i></a>
|
||
</div>
|
||
</div>
|
||
<button class="button button--theme-dark button--pill search__cancel js-search-toggle">
|
||
Annuler</button>
|
||
</div>
|
||
<div id="results-container" class="search-result js-search-result"></div>
|
||
</div>
|
||
</div>
|
||
<!-- Script pointing to search-script.js -->
|
||
<script>/*!
|
||
* Simple-Jekyll-Search
|
||
* Copyright 2015-2020, Christian Fei
|
||
* Licensed under the MIT License.
|
||
*/
|
||
|
||
(function(){
|
||
'use strict'
|
||
|
||
var _$Templater_7 = {
|
||
compile: compile,
|
||
setOptions: setOptions
|
||
}
|
||
|
||
const options = {}
|
||
options.pattern = /\{(.*?)\}/g
|
||
options.template = ''
|
||
options.middleware = function () {}
|
||
|
||
function setOptions (_options) {
|
||
options.pattern = _options.pattern || options.pattern
|
||
options.template = _options.template || options.template
|
||
if (typeof _options.middleware === 'function') {
|
||
options.middleware = _options.middleware
|
||
}
|
||
}
|
||
|
||
function compile (data) {
|
||
return options.template.replace(options.pattern, function (match, prop) {
|
||
const value = options.middleware(prop, data[prop], options.template)
|
||
if (typeof value !== 'undefined') {
|
||
return value
|
||
}
|
||
return data[prop] || match
|
||
})
|
||
}
|
||
|
||
'use strict';
|
||
|
||
function fuzzysearch (needle, haystack) {
|
||
var tlen = haystack.length;
|
||
var qlen = needle.length;
|
||
if (qlen > tlen) {
|
||
return false;
|
||
}
|
||
if (qlen === tlen) {
|
||
return needle === haystack;
|
||
}
|
||
outer: for (var i = 0, j = 0; i < qlen; i++) {
|
||
var nch = needle.charCodeAt(i);
|
||
while (j < tlen) {
|
||
if (haystack.charCodeAt(j++) === nch) {
|
||
continue outer;
|
||
}
|
||
}
|
||
return false;
|
||
}
|
||
return true;
|
||
}
|
||
|
||
var _$fuzzysearch_1 = fuzzysearch;
|
||
|
||
'use strict'
|
||
|
||
/* removed: const _$fuzzysearch_1 = require('fuzzysearch') */;
|
||
|
||
var _$FuzzySearchStrategy_5 = new FuzzySearchStrategy()
|
||
|
||
function FuzzySearchStrategy () {
|
||
this.matches = function (string, crit) {
|
||
return _$fuzzysearch_1(crit.toLowerCase(), string.toLowerCase())
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$LiteralSearchStrategy_6 = new LiteralSearchStrategy()
|
||
|
||
function LiteralSearchStrategy () {
|
||
this.matches = function (str, crit) {
|
||
if (!str) return false
|
||
|
||
str = str.trim().toLowerCase()
|
||
crit = crit.trim().toLowerCase()
|
||
|
||
return crit.split(' ').filter(function (word) {
|
||
return str.indexOf(word) >= 0
|
||
}).length === crit.split(' ').length
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$Repository_4 = {
|
||
put: put,
|
||
clear: clear,
|
||
search: search,
|
||
setOptions: __setOptions_4
|
||
}
|
||
|
||
/* removed: const _$FuzzySearchStrategy_5 = require('./SearchStrategies/FuzzySearchStrategy') */;
|
||
/* removed: const _$LiteralSearchStrategy_6 = require('./SearchStrategies/LiteralSearchStrategy') */;
|
||
|
||
function NoSort () {
|
||
return 0
|
||
}
|
||
|
||
const data = []
|
||
let opt = {}
|
||
|
||
opt.fuzzy = false
|
||
opt.limit = 10
|
||
opt.searchStrategy = opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
|
||
opt.sort = NoSort
|
||
opt.exclude = []
|
||
|
||
function put (data) {
|
||
if (isObject(data)) {
|
||
return addObject(data)
|
||
}
|
||
if (isArray(data)) {
|
||
return addArray(data)
|
||
}
|
||
return undefined
|
||
}
|
||
function clear () {
|
||
data.length = 0
|
||
return data
|
||
}
|
||
|
||
function isObject (obj) {
|
||
return Boolean(obj) && Object.prototype.toString.call(obj) === '[object Object]'
|
||
}
|
||
|
||
function isArray (obj) {
|
||
return Boolean(obj) && Object.prototype.toString.call(obj) === '[object Array]'
|
||
}
|
||
|
||
function addObject (_data) {
|
||
data.push(_data)
|
||
return data
|
||
}
|
||
|
||
function addArray (_data) {
|
||
const added = []
|
||
clear()
|
||
for (let i = 0, len = _data.length; i < len; i++) {
|
||
if (isObject(_data[i])) {
|
||
added.push(addObject(_data[i]))
|
||
}
|
||
}
|
||
return added
|
||
}
|
||
|
||
function search (crit) {
|
||
if (!crit) {
|
||
return []
|
||
}
|
||
return findMatches(data, crit, opt.searchStrategy, opt).sort(opt.sort)
|
||
}
|
||
|
||
function __setOptions_4 (_opt) {
|
||
opt = _opt || {}
|
||
|
||
opt.fuzzy = _opt.fuzzy || false
|
||
opt.limit = _opt.limit || 10
|
||
opt.searchStrategy = _opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
|
||
opt.sort = _opt.sort || NoSort
|
||
opt.exclude = _opt.exclude || []
|
||
}
|
||
|
||
function findMatches (data, crit, strategy, opt) {
|
||
const matches = []
|
||
for (let i = 0; i < data.length && matches.length < opt.limit; i++) {
|
||
const match = findMatchesInObject(data[i], crit, strategy, opt)
|
||
if (match) {
|
||
matches.push(match)
|
||
}
|
||
}
|
||
return matches
|
||
}
|
||
|
||
function findMatchesInObject (obj, crit, strategy, opt) {
|
||
for (const key in obj) {
|
||
if (!isExcluded(obj[key], opt.exclude) && strategy.matches(obj[key], crit)) {
|
||
return obj
|
||
}
|
||
}
|
||
}
|
||
|
||
function isExcluded (term, excludedTerms) {
|
||
for (let i = 0, len = excludedTerms.length; i < len; i++) {
|
||
const excludedTerm = excludedTerms[i]
|
||
if (new RegExp(excludedTerm).test(term)) {
|
||
return true
|
||
}
|
||
}
|
||
return false
|
||
}
|
||
|
||
/* globals ActiveXObject:false */
|
||
|
||
'use strict'
|
||
|
||
var _$JSONLoader_2 = {
|
||
load: load
|
||
}
|
||
|
||
function load (location, callback) {
|
||
const xhr = getXHR()
|
||
xhr.open('GET', location, true)
|
||
xhr.onreadystatechange = createStateChangeListener(xhr, callback)
|
||
xhr.send()
|
||
}
|
||
|
||
function createStateChangeListener (xhr, callback) {
|
||
return function () {
|
||
if (xhr.readyState === 4 && xhr.status === 200) {
|
||
try {
|
||
callback(null, JSON.parse(xhr.responseText))
|
||
} catch (err) {
|
||
callback(err, null)
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
function getXHR () {
|
||
return window.XMLHttpRequest ? new window.XMLHttpRequest() : new ActiveXObject('Microsoft.XMLHTTP')
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$OptionsValidator_3 = function OptionsValidator (params) {
|
||
if (!validateParams(params)) {
|
||
throw new Error('-- OptionsValidator: required options missing')
|
||
}
|
||
|
||
if (!(this instanceof OptionsValidator)) {
|
||
return new OptionsValidator(params)
|
||
}
|
||
|
||
const requiredOptions = params.required
|
||
|
||
this.getRequiredOptions = function () {
|
||
return requiredOptions
|
||
}
|
||
|
||
this.validate = function (parameters) {
|
||
const errors = []
|
||
requiredOptions.forEach(function (requiredOptionName) {
|
||
if (typeof parameters[requiredOptionName] === 'undefined') {
|
||
errors.push(requiredOptionName)
|
||
}
|
||
})
|
||
return errors
|
||
}
|
||
|
||
function validateParams (params) {
|
||
if (!params) {
|
||
return false
|
||
}
|
||
return typeof params.required !== 'undefined' && params.required instanceof Array
|
||
}
|
||
}
|
||
|
||
'use strict'
|
||
|
||
var _$utils_9 = {
|
||
merge: merge,
|
||
isJSON: isJSON
|
||
}
|
||
|
||
function merge (defaultParams, mergeParams) {
|
||
const mergedOptions = {}
|
||
for (const option in defaultParams) {
|
||
mergedOptions[option] = defaultParams[option]
|
||
if (typeof mergeParams[option] !== 'undefined') {
|
||
mergedOptions[option] = mergeParams[option]
|
||
}
|
||
}
|
||
return mergedOptions
|
||
}
|
||
|
||
function isJSON (json) {
|
||
try {
|
||
if (json instanceof Object && JSON.parse(JSON.stringify(json))) {
|
||
return true
|
||
}
|
||
return false
|
||
} catch (err) {
|
||
return false
|
||
}
|
||
}
|
||
|
||
var _$src_8 = {};
|
||
(function (window) {
|
||
'use strict'
|
||
|
||
let options = {
|
||
searchInput: null,
|
||
resultsContainer: null,
|
||
json: [],
|
||
success: Function.prototype,
|
||
searchResultTemplate: '<li><a href="{url}" title="{desc}">{title}</a></li>',
|
||
templateMiddleware: Function.prototype,
|
||
sortMiddleware: function () {
|
||
return 0
|
||
},
|
||
noResultsText: 'No results found',
|
||
limit: 10,
|
||
fuzzy: false,
|
||
debounceTime: null,
|
||
exclude: []
|
||
}
|
||
|
||
let debounceTimerHandle
|
||
const debounce = function (func, delayMillis) {
|
||
if (delayMillis) {
|
||
clearTimeout(debounceTimerHandle)
|
||
debounceTimerHandle = setTimeout(func, delayMillis)
|
||
} else {
|
||
func.call()
|
||
}
|
||
}
|
||
|
||
const requiredOptions = ['searchInput', 'resultsContainer', 'json']
|
||
|
||
/* removed: const _$Templater_7 = require('./Templater') */;
|
||
/* removed: const _$Repository_4 = require('./Repository') */;
|
||
/* removed: const _$JSONLoader_2 = require('./JSONLoader') */;
|
||
const optionsValidator = _$OptionsValidator_3({
|
||
required: requiredOptions
|
||
})
|
||
/* removed: const _$utils_9 = require('./utils') */;
|
||
|
||
window.SimpleJekyllSearch = function (_options) {
|
||
const errors = optionsValidator.validate(_options)
|
||
if (errors.length > 0) {
|
||
throwError('You must specify the following required options: ' + requiredOptions)
|
||
}
|
||
|
||
options = _$utils_9.merge(options, _options)
|
||
|
||
_$Templater_7.setOptions({
|
||
template: options.searchResultTemplate,
|
||
middleware: options.templateMiddleware
|
||
})
|
||
|
||
_$Repository_4.setOptions({
|
||
fuzzy: options.fuzzy,
|
||
limit: options.limit,
|
||
sort: options.sortMiddleware,
|
||
exclude: options.exclude
|
||
})
|
||
|
||
if (_$utils_9.isJSON(options.json)) {
|
||
initWithJSON(options.json)
|
||
} else {
|
||
initWithURL(options.json)
|
||
}
|
||
|
||
const rv = {
|
||
search: search
|
||
}
|
||
|
||
typeof options.success === 'function' && options.success.call(rv)
|
||
return rv
|
||
}
|
||
|
||
function initWithJSON (json) {
|
||
_$Repository_4.put(json)
|
||
registerInput()
|
||
}
|
||
|
||
function initWithURL (url) {
|
||
_$JSONLoader_2.load(url, function (err, json) {
|
||
if (err) {
|
||
throwError('failed to get JSON (' + url + ')')
|
||
}
|
||
initWithJSON(json)
|
||
})
|
||
}
|
||
|
||
function emptyResultsContainer () {
|
||
options.resultsContainer.innerHTML = ''
|
||
}
|
||
|
||
function appendToResultsContainer (text) {
|
||
options.resultsContainer.innerHTML += text
|
||
}
|
||
|
||
function registerInput () {
|
||
options.searchInput.addEventListener('input', function (e) {
|
||
if (isWhitelistedKey(e.which)) {
|
||
emptyResultsContainer()
|
||
debounce(function () { search(e.target.value) }, options.debounceTime)
|
||
}
|
||
})
|
||
}
|
||
|
||
function search (query) {
|
||
if (isValidQuery(query)) {
|
||
emptyResultsContainer()
|
||
render(_$Repository_4.search(query), query)
|
||
}
|
||
}
|
||
|
||
function render (results, query) {
|
||
const len = results.length
|
||
if (len === 0) {
|
||
return appendToResultsContainer(options.noResultsText)
|
||
}
|
||
for (let i = 0; i < len; i++) {
|
||
results[i].query = query
|
||
appendToResultsContainer(_$Templater_7.compile(results[i]))
|
||
}
|
||
}
|
||
|
||
function isValidQuery (query) {
|
||
return query && query.length > 0
|
||
}
|
||
|
||
function isWhitelistedKey (key) {
|
||
return [13, 16, 20, 37, 38, 39, 40, 91].indexOf(key) === -1
|
||
}
|
||
|
||
function throwError (message) {
|
||
throw new Error('SimpleJekyllSearch --- ' + message)
|
||
}
|
||
})(window)
|
||
|
||
}());
|
||
</script>
|
||
|
||
<!-- Configuration -->
|
||
<script>
|
||
SimpleJekyllSearch({
|
||
searchInput: document.getElementById('search-input'),
|
||
resultsContainer: document.getElementById('results-container'),
|
||
noResultsText: '<p>Aucun résultat!</p>',
|
||
json: '/search.json',
|
||
searchResultTemplate: '<li><a href="{url}">{date} {title}</a> (Création {create})</li>'
|
||
})
|
||
</script>
|
||
|
||
</div></div>
|
||
|
||
|
||
<script>(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
function scrollToAnchor(anchor, duration, callback) {
|
||
var $root = this;
|
||
$root.animate({ scrollTop: $(anchor).position().top }, duration, function() {
|
||
window.history.replaceState(null, '', window.location.href.split('#')[0] + anchor);
|
||
callback && callback();
|
||
});
|
||
}
|
||
$.fn.scrollToAnchor = scrollToAnchor;
|
||
});
|
||
})();
|
||
(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
function affix(options) {
|
||
var $root = this, $window = $(window), $scrollTarget, $scroll,
|
||
offsetBottom = 0, scrollTarget = window, scroll = window.document, disabled = false, isOverallScroller = true,
|
||
rootTop, rootLeft, rootHeight, scrollBottom, rootBottomTop,
|
||
hasInit = false, curState;
|
||
|
||
function setOptions(options) {
|
||
var _options = options || {};
|
||
_options.offsetBottom && (offsetBottom = _options.offsetBottom);
|
||
_options.scrollTarget && (scrollTarget = _options.scrollTarget);
|
||
_options.scroll && (scroll = _options.scroll);
|
||
_options.disabled !== undefined && (disabled = _options.disabled);
|
||
$scrollTarget = $(scrollTarget);
|
||
isOverallScroller = window.isOverallScroller($scrollTarget[0]);
|
||
$scroll = $(scroll);
|
||
}
|
||
function preCalc() {
|
||
top();
|
||
rootHeight = $root.outerHeight();
|
||
rootTop = $root.offset().top + (isOverallScroller ? 0 : $scrollTarget.scrollTop());
|
||
rootLeft = $root.offset().left;
|
||
}
|
||
function calc(needPreCalc) {
|
||
needPreCalc && preCalc();
|
||
scrollBottom = $scroll.outerHeight() - offsetBottom - rootHeight;
|
||
rootBottomTop = scrollBottom - rootTop;
|
||
}
|
||
function top() {
|
||
if (curState !== 'top') {
|
||
$root.removeClass('fixed').css({
|
||
left: 0,
|
||
top: 0
|
||
});
|
||
curState = 'top';
|
||
}
|
||
}
|
||
function fixed() {
|
||
if (curState !== 'fixed') {
|
||
$root.addClass('fixed').css({
|
||
left: rootLeft + 'px',
|
||
top: 0
|
||
});
|
||
curState = 'fixed';
|
||
}
|
||
}
|
||
function bottom() {
|
||
if (curState !== 'bottom') {
|
||
$root.removeClass('fixed').css({
|
||
left: 0,
|
||
top: rootBottomTop + 'px'
|
||
});
|
||
curState = 'bottom';
|
||
}
|
||
}
|
||
function setState() {
|
||
var scrollTop = $scrollTarget.scrollTop();
|
||
if (scrollTop >= rootTop && scrollTop <= scrollBottom) {
|
||
fixed();
|
||
} else if (scrollTop < rootTop) {
|
||
top();
|
||
} else {
|
||
bottom();
|
||
}
|
||
}
|
||
function init() {
|
||
if(!hasInit) {
|
||
var interval, timeout;
|
||
calc(true); setState();
|
||
// run calc every 100 millisecond
|
||
interval = setInterval(function() {
|
||
calc();
|
||
}, 100);
|
||
timeout = setTimeout(function() {
|
||
clearInterval(interval);
|
||
}, 45000);
|
||
window.pageLoad.then(function() {
|
||
setTimeout(function() {
|
||
clearInterval(interval);
|
||
clearTimeout(timeout);
|
||
}, 3000);
|
||
});
|
||
$scrollTarget.on('scroll', function() {
|
||
disabled || setState();
|
||
});
|
||
$window.on('resize', function() {
|
||
disabled || (calc(true), setState());
|
||
});
|
||
hasInit = true;
|
||
}
|
||
}
|
||
|
||
setOptions(options);
|
||
if (!disabled) {
|
||
init();
|
||
}
|
||
$window.on('resize', window.throttle(function() {
|
||
init();
|
||
}, 200));
|
||
return {
|
||
setOptions: setOptions,
|
||
refresh: function() {
|
||
calc(true, { animation: false }); setState();
|
||
}
|
||
};
|
||
}
|
||
$.fn.affix = affix;
|
||
});
|
||
})();
|
||
(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
function toc(options) {
|
||
var $root = this, $window = $(window), $scrollTarget, $scroller, $tocUl = $('<ul class="toc toc--ellipsis"></ul>'), $tocLi, $headings, $activeLast, $activeCur,
|
||
selectors = 'h1,h2,h3', container = 'body', scrollTarget = window, scroller = 'html, body', disabled = false,
|
||
headingsPos, scrolling = false, hasRendered = false, hasInit = false;
|
||
|
||
function setOptions(options) {
|
||
var _options = options || {};
|
||
_options.selectors && (selectors = _options.selectors);
|
||
_options.container && (container = _options.container);
|
||
_options.scrollTarget && (scrollTarget = _options.scrollTarget);
|
||
_options.scroller && (scroller = _options.scroller);
|
||
_options.disabled !== undefined && (disabled = _options.disabled);
|
||
$headings = $(container).find(selectors).filter('[id]');
|
||
$scrollTarget = $(scrollTarget);
|
||
$scroller = $(scroller);
|
||
}
|
||
function calc() {
|
||
headingsPos = [];
|
||
$headings.each(function() {
|
||
headingsPos.push(Math.floor($(this).position().top));
|
||
});
|
||
}
|
||
function setState(element, disabled) {
|
||
var scrollTop = $scrollTarget.scrollTop(), i;
|
||
if (disabled || !headingsPos || headingsPos.length < 1) { return; }
|
||
if (element) {
|
||
$activeCur = element;
|
||
} else {
|
||
for (i = 0; i < headingsPos.length; i++) {
|
||
if (scrollTop >= headingsPos[i]) {
|
||
$activeCur = $tocLi.eq(i);
|
||
} else {
|
||
$activeCur || ($activeCur = $tocLi.eq(i));
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
$activeLast && $activeLast.removeClass('active');
|
||
($activeLast = $activeCur).addClass('active');
|
||
}
|
||
function render() {
|
||
if(!hasRendered) {
|
||
$root.append($tocUl);
|
||
$headings.each(function() {
|
||
var $this = $(this);
|
||
$tocUl.append($('<li></li>').addClass('toc-' + $this.prop('tagName').toLowerCase())
|
||
.append($('<a></a>').text($this.text()).attr('href', '#' + $this.prop('id'))));
|
||
});
|
||
$tocLi = $tocUl.children('li');
|
||
$tocUl.on('click', 'a', function(e) {
|
||
e.preventDefault();
|
||
var $this = $(this);
|
||
scrolling = true;
|
||
setState($this.parent());
|
||
$scroller.scrollToAnchor($this.attr('href'), 400, function() {
|
||
scrolling = false;
|
||
});
|
||
});
|
||
}
|
||
hasRendered = true;
|
||
}
|
||
function init() {
|
||
var interval, timeout;
|
||
if(!hasInit) {
|
||
render(); calc(); setState(null, scrolling);
|
||
// run calc every 100 millisecond
|
||
interval = setInterval(function() {
|
||
calc();
|
||
}, 100);
|
||
timeout = setTimeout(function() {
|
||
clearInterval(interval);
|
||
}, 45000);
|
||
window.pageLoad.then(function() {
|
||
setTimeout(function() {
|
||
clearInterval(interval);
|
||
clearTimeout(timeout);
|
||
}, 3000);
|
||
});
|
||
$scrollTarget.on('scroll', function() {
|
||
disabled || setState(null, scrolling);
|
||
});
|
||
$window.on('resize', window.throttle(function() {
|
||
if (!disabled) {
|
||
render(); calc(); setState(null, scrolling);
|
||
}
|
||
}, 100));
|
||
}
|
||
hasInit = true;
|
||
}
|
||
|
||
setOptions(options);
|
||
if (!disabled) {
|
||
init();
|
||
}
|
||
$window.on('resize', window.throttle(function() {
|
||
init();
|
||
}, 200));
|
||
return {
|
||
setOptions: setOptions
|
||
};
|
||
}
|
||
$.fn.toc = toc;
|
||
});
|
||
})();
|
||
/*(function () {
|
||
|
||
})();*/
|
||
</script><script>
|
||
/* toc must before affix, since affix need to konw toc' height. */(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
var TOC_SELECTOR = window.TEXT_VARIABLES.site.toc.selectors;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
var $window = $(window);
|
||
var $articleContent = $('.js-article-content');
|
||
var $tocRoot = $('.js-toc-root'), $col2 = $('.js-col-aside');
|
||
var toc;
|
||
var tocDisabled = false;
|
||
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
|
||
var hasToc = $articleContent.find(TOC_SELECTOR).length > 0;
|
||
|
||
function disabled() {
|
||
return $col2.css('display') === 'none' || !hasToc;
|
||
}
|
||
|
||
tocDisabled = disabled();
|
||
|
||
toc = $tocRoot.toc({
|
||
selectors: TOC_SELECTOR,
|
||
container: $articleContent,
|
||
scrollTarget: hasSidebar ? '.js-page-main' : null,
|
||
scroller: hasSidebar ? '.js-page-main' : null,
|
||
disabled: tocDisabled
|
||
});
|
||
|
||
$window.on('resize', window.throttle(function() {
|
||
tocDisabled = disabled();
|
||
toc && toc.setOptions({
|
||
disabled: tocDisabled
|
||
});
|
||
}, 100));
|
||
|
||
});
|
||
})();
|
||
(function() {
|
||
var SOURCES = window.TEXT_VARIABLES.sources;
|
||
window.Lazyload.js(SOURCES.jquery, function() {
|
||
var $window = $(window), $pageFooter = $('.js-page-footer');
|
||
var $pageAside = $('.js-page-aside');
|
||
var affix;
|
||
var tocDisabled = false;
|
||
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
|
||
|
||
affix = $pageAside.affix({
|
||
offsetBottom: $pageFooter.outerHeight(),
|
||
scrollTarget: hasSidebar ? '.js-page-main' : null,
|
||
scroller: hasSidebar ? '.js-page-main' : null,
|
||
scroll: hasSidebar ? $('.js-page-main').children() : null,
|
||
disabled: tocDisabled
|
||
});
|
||
|
||
$window.on('resize', window.throttle(function() {
|
||
affix && affix.setOptions({
|
||
disabled: tocDisabled
|
||
});
|
||
}, 100));
|
||
|
||
window.pageAsideAffix = affix;
|
||
});
|
||
})();
|
||
</script><!---->
|
||
|
||
</div>
|
||
<script>(function () {
|
||
var $root = document.getElementsByClassName('root')[0];
|
||
if (window.hasEvent('touchstart')) {
|
||
$root.dataset.isTouch = true;
|
||
document.addEventListener('touchstart', function(){}, false);
|
||
}
|
||
})();
|
||
</script>
|
||
</body>
|
||
</html>
|
||
|