Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: DBMail: users

DBMail / Postfix / LDAP / SASL2 AUTH

 

 

DBMail users RSS feed   Index | Next | Previous | View Threaded


james at thereidsonline

Apr 28, 2008, 2:16 PM

Post #1 of 7 (382 views)
Permalink
DBMail / Postfix / LDAP / SASL2 AUTH

Hi Everyone,



I'm having a lot of trouble trying to get DBMail working with Postfix / LDAP
/ SASL2 Auth.



I've done a lot of searching and testing, but just can't quite get it to
work!



Does anyone have a sample main.cf and saslauthd.conf file that they could
show me?



I am planning to publish a comprehensive howto when I'm finished.



Thanks!



James.


daniel at gosi

Apr 28, 2008, 4:55 PM

Post #2 of 7 (365 views)
Permalink
Re: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

Hi James,

well you can start with the tutorial I have written here:

http://kb.gosi.at/content/16/20/en/dbmail-mysql-postfix-smtp-auth-via-sasl2-debian-etch.html

but that one doesn´t cover LDAP, still it should give you working SASL
and proper postfix setup.

greetings,
Daniel
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


paul at nfg

Apr 29, 2008, 2:36 AM

Post #3 of 7 (363 views)
Permalink
Re: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

I havent checked Daniels HOWTO, but the simplest way is to use the rimap
mechanism for saslauthd. If dbmail-imapd is running, saslauthd will also
work, period.

If you use ldap for dbmail, pam, etc, though you are better off using
the ldap mechanism directly (imo, the sasl pam mechanism sucks if your
users are in ldap).

On debian:

postconf -e smtpd_sasl_auth_enable=yes

add permit_sasl_authenticated to the list in smtpd_recipient_restrictions



cat > /etc/default/saslauthd << EOF
START=yes
MECHANISMS="rimap -O localhost"
EOF

restart saslauthd and reload postfix. Done.


For LDAP you could use:
cat > /etc/default/saslauthd << EOF
START=yes
MECHANISMS="ldap"
EOF

cat > /etc/ldap/saslauthd.conf << EOF
ldap_servers: ldap://ldapserver.mydomain.com
ldap_use_sasl: no
ldap_version: 3
ldap_search_base: dc=mydomain,dc=com
EOF






Daniel Urstöger wrote:
> Hi James,
>
> well you can start with the tutorial I have written here:
>
> http://kb.gosi.at/content/16/20/en/dbmail-mysql-postfix-smtp-auth-via-sasl2-debian-etch.html
>
>
> but that one doesn´t cover LDAP, still it should give you working SASL
> and proper postfix setup.
>
> greetings,
> Daniel
> _______________________________________________
> DBmail mailing list
> DBmail[at]dbmail.org
> https://mailman.fastxs.nl/mailman/listinfo/dbmail
>


--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


james at thereidsonline

Apr 29, 2008, 5:26 AM

Post #4 of 7 (362 views)
Permalink
RE: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

Hi Daniel,

Thanks for your suggestions!

I *believe* I need to put something in local_recipient_maps in main.cf to
point it at the ldap aliases (I think this is to stop emails for non-users
being checked by amavisd etc???), but can't quite figure this out - can you
give a suggestion for this?

Thanks!
James.

-----Original Message-----
From: dbmail-bounces[at]dbmail.org [mailto:dbmail-bounces[at]dbmail.org] On Behalf
Of Paul J Stevens
Sent: Tuesday, 29 April 2008 7:36 PM
To: DBMail mailinglist
Subject: Re: [Dbmail] DBMail / Postfix / LDAP / SASL2 AUTH



I havent checked Daniels HOWTO, but the simplest way is to use the rimap
mechanism for saslauthd. If dbmail-imapd is running, saslauthd will also
work, period.

If you use ldap for dbmail, pam, etc, though you are better off using
the ldap mechanism directly (imo, the sasl pam mechanism sucks if your
users are in ldap).

On debian:

postconf -e smtpd_sasl_auth_enable=yes

add permit_sasl_authenticated to the list in smtpd_recipient_restrictions



cat > /etc/default/saslauthd << EOF
START=yes
MECHANISMS="rimap -O localhost"
EOF

restart saslauthd and reload postfix. Done.


For LDAP you could use:
cat > /etc/default/saslauthd << EOF
START=yes
MECHANISMS="ldap"
EOF

cat > /etc/ldap/saslauthd.conf << EOF
ldap_servers: ldap://ldapserver.mydomain.com
ldap_use_sasl: no
ldap_version: 3
ldap_search_base: dc=mydomain,dc=com
EOF






Daniel Urstöger wrote:
> Hi James,
>
> well you can start with the tutorial I have written here:
>
>
http://kb.gosi.at/content/16/20/en/dbmail-mysql-postfix-smtp-auth-via-sasl2-
debian-etch.html
>
>
> but that one doesn´t cover LDAP, still it should give you working SASL
> and proper postfix setup.
>
> greetings,
> Daniel
> _______________________________________________
> DBmail mailing list
> DBmail[at]dbmail.org
> https://mailman.fastxs.nl/mailman/listinfo/dbmail
>


--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


paul at nfg

Apr 30, 2008, 5:41 AM

Post #5 of 7 (355 views)
Permalink
Re: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

James Reid wrote:
> I *believe* I need to put something in local_recipient_maps in main.cf to
> point it at the ldap aliases (I think this is to stop emails for non-users
> being checked by amavisd etc???), but can't quite figure this out - can you
> give a suggestion for this?


Ok, I run multiple MX servers, each of which has it's own
amavis/spamassassin setup. They also run dbmail-lmtpd each of them,
which all connect to the same central mysql backend.

My LDAP structure looks like this:

1) each domain has it's own subtree
# domain setup
dn: mailDomain=somedomain.org,ou=mailDomains,dc=nfg,dc=nl
objectClass: top
objectClass: dbmailDomain
mailDomain: somedomain.org
mailHost: lmtp:[10.1.2.3]:24

2) pop3/imap accounts are always below a domain:
# an account
dn:
uid=user[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=nfg,dc=nl
objectClass: account
objectClass: dbmailUser
objectClass: top
uidNumber: 8973
gidNumber: 100
mailHost: dbmail
uid: user[at]somedomain.org
mail: user[at]somedomain.org

3) same for forwarding setups
# a forward
dn:
uid=forward[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=nfg,dc=nl
objectClass: top
objectClass: account
objectClass: dbmailForwardingAddress
uid: forward[at]somedomain.org
mailForwardingAddress: forwardto[at]otherdomain.org
mail: forward[at]somedomain.org



# in /etc/postfix/main.cf:
# add to relay_domains: ldap:/etc/postfix/ldap_relay.cf
transport_maps = ldap:/etc/postfix/ldap_transport.cf
virtual_transport = lmtp:[localhost]:24
virtual_mailbox_domains = ldap:/etc/postfix/ldap_virtual_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox.cf
alias_maps = ldap:/etc/postfix/ldap_aliases.cf

/etc/postfix/ldap_relay.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter =
(&(mailDomain=%s)(objectClass=dbmailDomain)(!(mailHost=lmtp:[dbmail]:24)))
result_attribute = mailDomain

/etc/postfix/ldap_aliases.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (&(objectclass=dbmailforwardingaddress)(mail=%s))
result_attribute = mailForwardingAddress

/etc/postfix/ldap_transport.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (&(mailDomain=%d)(objectClass=dbmailDomain))
result_attribute = mailHost
result_filter = %s

/etc/postfix/ldap_virtual_domains.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter =
(&(objectClass=dbmailDomain)(mailDomain=%s)(mailHost=lmtp:[dbmail]:24))
result_attribute = mailDomain

/etc/postfix/ldap_virtual_mailbox.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (mail=%s)
result_attribute = uid


I've altered some attributeTypes in dbmail.schema to allow for more
substring matching. Also, the mailHost match in ldap_virtual_domains.cf
should probably also allow for substring matching if you want to use
more than one lmtp server. Currently, I'm hard-coding the 'dbmail'
hostname in /etc/hosts to point to the lmtp daemon running on localhost.

Also, this setup allows me to specify a different transport for a domain
that is not lmtp. Some clients run their own smtp server, and we only
run backup mx.




--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


james at thereidsonline

May 1, 2008, 4:42 AM

Post #6 of 7 (350 views)
Permalink
RE: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

Hi Paul,

Thanks for your help - very much appreciated!

BUT!!!

I get the following error in mailog when I try to send a message to myself:
May 1 20:50:34 fs02 dbmail/lmtpd[11626]: Error:[message]
dbmail-message.c,dbmail_message_store(+786): unable to find user_idnr for
user [__@!internal_delivery_user!@__]. Make sure this system user is in the
database!
May 1 20:50:34 fs02 dbmail/lmtpd[11626]: Error:[delivery]
pipe.c,insert_messages(+545): failed to store temporary message.

I've traced the delivery through and can see that I've successfully
authenticated.

Can someone give me some suggestions on how to fix this?

Thanks!
James.

-----Original Message-----
From: dbmail-bounces[at]dbmail.org [mailto:dbmail-bounces[at]dbmail.org] On Behalf
Of Paul J Stevens
Sent: Wednesday, 30 April 2008 10:41 PM
To: DBMail mailinglist
Subject: Re: [Dbmail] DBMail / Postfix / LDAP / SASL2 AUTH

James Reid wrote:
> I *believe* I need to put something in local_recipient_maps in main.cf to
> point it at the ldap aliases (I think this is to stop emails for non-users
> being checked by amavisd etc???), but can't quite figure this out - can
you
> give a suggestion for this?


Ok, I run multiple MX servers, each of which has it's own
amavis/spamassassin setup. They also run dbmail-lmtpd each of them,
which all connect to the same central mysql backend.

My LDAP structure looks like this:

1) each domain has it's own subtree
# domain setup
dn: mailDomain=somedomain.org,ou=mailDomains,dc=nfg,dc=nl
objectClass: top
objectClass: dbmailDomain
mailDomain: somedomain.org
mailHost: lmtp:[10.1.2.3]:24

2) pop3/imap accounts are always below a domain:
# an account
dn:
uid=user[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=nfg,dc=n
l
objectClass: account
objectClass: dbmailUser
objectClass: top
uidNumber: 8973
gidNumber: 100
mailHost: dbmail
uid: user[at]somedomain.org
mail: user[at]somedomain.org

3) same for forwarding setups
# a forward
dn:
uid=forward[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=nfg,d
c=nl
objectClass: top
objectClass: account
objectClass: dbmailForwardingAddress
uid: forward[at]somedomain.org
mailForwardingAddress: forwardto[at]otherdomain.org
mail: forward[at]somedomain.org



# in /etc/postfix/main.cf:
# add to relay_domains: ldap:/etc/postfix/ldap_relay.cf
transport_maps = ldap:/etc/postfix/ldap_transport.cf
virtual_transport = lmtp:[localhost]:24
virtual_mailbox_domains = ldap:/etc/postfix/ldap_virtual_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox.cf
alias_maps = ldap:/etc/postfix/ldap_aliases.cf

/etc/postfix/ldap_relay.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter =
(&(mailDomain=%s)(objectClass=dbmailDomain)(!(mailHost=lmtp:[dbmail]:24)))
result_attribute = mailDomain

/etc/postfix/ldap_aliases.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (&(objectclass=dbmailforwardingaddress)(mail=%s))
result_attribute = mailForwardingAddress

/etc/postfix/ldap_transport.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (&(mailDomain=%d)(objectClass=dbmailDomain))
result_attribute = mailHost
result_filter = %s

/etc/postfix/ldap_virtual_domains.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter =
(&(objectClass=dbmailDomain)(mailDomain=%s)(mailHost=lmtp:[dbmail]:24))
result_attribute = mailDomain

/etc/postfix/ldap_virtual_mailbox.cf:
server_host = ldap
bind = no
search_base = dc=nfg,dc=nl
query_filter = (mail=%s)
result_attribute = uid


I've altered some attributeTypes in dbmail.schema to allow for more
substring matching. Also, the mailHost match in ldap_virtual_domains.cf
should probably also allow for substring matching if you want to use
more than one lmtp server. Currently, I'm hard-coding the 'dbmail'
hostname in /etc/hosts to point to the lmtp daemon running on localhost.

Also, this setup allows me to specify a different transport for a domain
that is not lmtp. Some clients run their own smtp server, and we only
run backup mx.




--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


mysql.jorge at decimal

May 1, 2008, 5:50 AM

Post #7 of 7 (348 views)
Permalink
RE: DBMail / Postfix / LDAP / SASL2 AUTH [In reply to]

That is a system user for DBMail wich has to exist.

Insert this SQL's:

# create the user for the delivery chain
INSERT INTO dbmail_users (userid, passwd, encryption_type)
VALUES ('__@!internal_delivery_user!@__', '', 'md5');
# create the 'anyone' user for ACLs
INSERT INTO dbmail_users (userid, passwd, encryption_type)
VALUES ('anyone', '', 'md5');
# create the user to own #Public mailboxes
INSERT INTO dbmail_users (userid, passwd, encryption_type)
VALUES ('__public__', '', 'md5');



You can find it in sql/*your database*/create_tables.sql




> -----Original Message-----
> From: dbmail-bounces[at]dbmail.org [mailto:dbmail-bounces[at]dbmail.org] On
> Behalf Of James Reid
> Sent: quinta-feira, 1 de Maio de 2008 12:42
> To: 'DBMail mailinglist'
> Subject: RE: [Dbmail] DBMail / Postfix / LDAP / SASL2 AUTH
>
> Hi Paul,
>
> Thanks for your help - very much appreciated!
>
> BUT!!!
>
> I get the following error in mailog when I try to send a message to
> myself:
> May 1 20:50:34 fs02 dbmail/lmtpd[11626]: Error:[message]
> dbmail-message.c,dbmail_message_store(+786): unable to find user_idnr
> for
> user [__@!internal_delivery_user!@__]. Make sure this system user is in
> the
> database!
> May 1 20:50:34 fs02 dbmail/lmtpd[11626]: Error:[delivery]
> pipe.c,insert_messages(+545): failed to store temporary message.
>
> I've traced the delivery through and can see that I've successfully
> authenticated.
>
> Can someone give me some suggestions on how to fix this?
>
> Thanks!
> James.
>
> -----Original Message-----
> From: dbmail-bounces[at]dbmail.org [mailto:dbmail-bounces[at]dbmail.org] On
> Behalf
> Of Paul J Stevens
> Sent: Wednesday, 30 April 2008 10:41 PM
> To: DBMail mailinglist
> Subject: Re: [Dbmail] DBMail / Postfix / LDAP / SASL2 AUTH
>
> James Reid wrote:
> > I *believe* I need to put something in local_recipient_maps in
> main.cf to
> > point it at the ldap aliases (I think this is to stop emails for non-
> users
> > being checked by amavisd etc???), but can't quite figure this out -
> can
> you
> > give a suggestion for this?
>
>
> Ok, I run multiple MX servers, each of which has it's own
> amavis/spamassassin setup. They also run dbmail-lmtpd each of them,
> which all connect to the same central mysql backend.
>
> My LDAP structure looks like this:
>
> 1) each domain has it's own subtree
> # domain setup
> dn: mailDomain=somedomain.org,ou=mailDomains,dc=nfg,dc=nl
> objectClass: top
> objectClass: dbmailDomain
> mailDomain: somedomain.org
> mailHost: lmtp:[10.1.2.3]:24
>
> 2) pop3/imap accounts are always below a domain:
> # an account
> dn:
> uid=user[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=nfg
> ,dc=n
> l
> objectClass: account
> objectClass: dbmailUser
> objectClass: top
> uidNumber: 8973
> gidNumber: 100
> mailHost: dbmail
> uid: user[at]somedomain.org
> mail: user[at]somedomain.org
>
> 3) same for forwarding setups
> # a forward
> dn:
> uid=forward[at]somedomain.org,mailDomain=somedomain.org,ou=MailDomains,dc=
> nfg,d
> c=nl
> objectClass: top
> objectClass: account
> objectClass: dbmailForwardingAddress
> uid: forward[at]somedomain.org
> mailForwardingAddress: forwardto[at]otherdomain.org
> mail: forward[at]somedomain.org
>
>
>
> # in /etc/postfix/main.cf:
> # add to relay_domains: ldap:/etc/postfix/ldap_relay.cf
> transport_maps = ldap:/etc/postfix/ldap_transport.cf
> virtual_transport = lmtp:[localhost]:24
> virtual_mailbox_domains = ldap:/etc/postfix/ldap_virtual_domains.cf
> virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox.cf
> alias_maps = ldap:/etc/postfix/ldap_aliases.cf
>
> /etc/postfix/ldap_relay.cf:
> server_host = ldap
> bind = no
> search_base = dc=nfg,dc=nl
> query_filter =
> (&(mailDomain=%s)(objectClass=dbmailDomain)(!(mailHost=lmtp:[dbmail]:24
> )))
> result_attribute = mailDomain
>
> /etc/postfix/ldap_aliases.cf:
> server_host = ldap
> bind = no
> search_base = dc=nfg,dc=nl
> query_filter = (&(objectclass=dbmailforwardingaddress)(mail=%s))
> result_attribute = mailForwardingAddress
>
> /etc/postfix/ldap_transport.cf:
> server_host = ldap
> bind = no
> search_base = dc=nfg,dc=nl
> query_filter = (&(mailDomain=%d)(objectClass=dbmailDomain))
> result_attribute = mailHost
> result_filter = %s
>
> /etc/postfix/ldap_virtual_domains.cf:
> server_host = ldap
> bind = no
> search_base = dc=nfg,dc=nl
> query_filter =
> (&(objectClass=dbmailDomain)(mailDomain=%s)(mailHost=lmtp:[dbmail]:24))
> result_attribute = mailDomain
>
> /etc/postfix/ldap_virtual_mailbox.cf:
> server_host = ldap
> bind = no
> search_base = dc=nfg,dc=nl
> query_filter = (mail=%s)
> result_attribute = uid
>
>
> I've altered some attributeTypes in dbmail.schema to allow for more
> substring matching. Also, the mailHost match in ldap_virtual_domains.cf
> should probably also allow for substring matching if you want to use
> more than one lmtp server. Currently, I'm hard-coding the 'dbmail'
> hostname in /etc/hosts to point to the lmtp daemon running on
> localhost.
>
> Also, this setup allows me to specify a different transport for a
> domain
> that is not lmtp. Some clients run their own smtp server, and we only
> run backup mx.
>
>
>
>
> --
> ________________________________________________________________
> Paul Stevens paul at nfg.nl
> NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
> The Netherlands________________________________http://www.nfg.nl
> _______________________________________________
> DBmail mailing list
> DBmail[at]dbmail.org
> https://mailman.fastxs.nl/mailman/listinfo/dbmail
>
>
> _______________________________________________
> DBmail mailing list
> DBmail[at]dbmail.org
> https://mailman.fastxs.nl/mailman/listinfo/dbmail

_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail

DBMail users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.