aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--fripost-docs.org105
1 files changed, 83 insertions, 22 deletions
diff --git a/fripost-docs.org b/fripost-docs.org
index 5e7367b..172c1fe 100644
--- a/fripost-docs.org
+++ b/fripost-docs.org
@@ -676,8 +676,8 @@ Jamm's (http://jamm.sourceforge.net/howto/html/implementation.html).
dn: cn=mail.fripost.org,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: mail.fripost.org
- olcAttributeTypes: ( 1.3.6.1.4.1.12461.1.1.1 NAME 'mailbox'
- DESC 'The path to the mailbox.'
+ olcAttributeTypes: ( 1.3.6.1.4.1.12461.1.1.1 NAME 'maildir'
+ DESC 'The path to the maildir.'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
olcAttributeTypes: ( 1.3.6.1.4.1.12461.1.1.3 NAME 'quota'
@@ -696,7 +696,7 @@ Jamm's (http://jamm.sourceforge.net/howto/html/implementation.html).
olcObjectclasses: ( 1.3.6.1.4.1.12461.1.2.2 NAME 'virtualMailbox'
SUP top STRUCTURAL
DESC 'Mail Account Object'
- MUST ( mail $ userPassword $ dc $ mailbox $ isActive )
+ MUST ( mail $ userPassword $ dc $ maildir $ isActive )
MAY ( mailLocalAddress $ gn $ sn $ quota ) )
@@ -851,7 +851,7 @@ To delete a leaf or a sub-tree:
sn: Last Name
userPassword: {SSHA}epZKWD1SiSe/dwL0to+jjnwFzxVUbFvg
dc: fripost.org
- mailbox: fripost.org/user/
+ maildir: fripost.org/user/
isActive: TRUE
mailLocalAddress: user-alias@fripost.org
mailLocalAddress: user@example.org
@@ -926,11 +926,11 @@ We now ensure that the leaf has been updated:
[...]
userPassword:: aG9w
entryCSN: 20120404215647.957317Z#000000#000#000000
- modifiersName: mail=fripost@fripost.org,o=mailboxes,dc=mail,dc=fripost,dc=org
+ modifiersName: mail=user@fripost.org,o=mailboxes,dc=mail,dc=fripost,dc=org
modifyTimestamp: 20120404215647Z
-Doing the same thing with eg, trying to change the `mailbox', `ldapmodify'
+Doing the same thing with eg, trying to change the `maildir', `ldapmodify'
refuses with `Insufficient access (50)'.
*** Configuring the main IMAP server
@@ -1001,11 +1001,60 @@ sudo aptitude install dovecot-imapd
:: /etc/postfix/main.cf
+ virtual_mailbox_domains = ldap:$config_directory/ldap_virtual_mailbox_domains.cf
+ virtual_mailbox_maps = ldap:$config_directory/ldap_virtual_mailbox_maps.cf
+ virtual_alias_maps = ldap:$config_directory/ldap_virtual_alias_maps.cf
+
+ [...]
+
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
http://wiki.dovecot.org/LDA/Postfix
http://www.tehinterweb.co.uk/roundcube/#pisieverules
+
+
+:: /etc/postfix/ldap_virtual_mailbox_domains.cf
+
+ server_host = ldap://localhost/
+ version = 3
+ search_base = o=domains,dc=mail,dc=fripost,dc=org
+ bind = no
+ query_filter = (&(ObjectClass=virtualDomain)(dc=%s)(isActive=TRUE))
+ result_attribute = dc
+
+Test it:
+ postmap -q fripost.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!'
+ postmap -q fake.org ldap:/etc/postfix/ldap_virtual_domains_maps.cf || echo 'failed!'
+
+
+:: /etc/postfix/ldap_virtual_mailbox_maps.cf
+
+ server_host = ldap://localhost/
+ version = 3
+ search_base = o=mailboxes,dc=mail,dc=fripost,dc=org
+ bind = no
+ query_filter = (&(ObjectClass=virtualMailbox)(mail=%s)(isActive=TRUE))
+ result_attribute = maildir
+
+Test it:
+ postmap -q user@fripost.org ldap:/etc/ldap/local/ldap_virtual_mailbox_maps.cf
+
+
+:: /etc/postfix/ldap_virtual_alias_maps.cf
+
+ server_host = ldap://localhost/
+ version = 3
+ search_base = o=mailboxes,dc=mail,dc=fripost,dc=org
+ bind = no
+ query_filter = (&(ObjectClass=virtualMailbox)(mailLocalAddress=%s)(isActive=TRUE))
+ result_attribute = mail
+
+Test it:
+ postmap -q user-alias@fripost.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf
+ postmap -q user@example.org ldap:/etc/postfix/ldap_virtual_alias_maps.cf
+
+
**** Test delivery
sudo mkdir -p /home/mail/virtual/fripost.org/
@@ -1084,7 +1133,10 @@ sudo /etc/init.d/dovecot restart
sudo update-rc.d -n dovecot stop 2 3 4 5 .
sudo update-rc.d -n postfix stop 2 3 4 5 .
-**** Use LDAP authenticate binds.
+**** Use LDAP authenticate binds, and LDAP user queries.
+
+[TODO: The following handle the dialog the LDAP server. It should replace
+the MySQL bits above.]
Instead of making a SQL query to fetch the (hashed) passwords, which implies to
expose all credentials to Dovecot, an other approach is to forward the login
@@ -1099,26 +1151,35 @@ http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds
Debian provides a squeleton configuration in /usr/share/dovecot/dovecot-ldap.conf .
Copy this file in /etc/dovecot, and chmod 600 it. Uncomment the following lines:
-hosts = localhost # Or wherever is our LDAP server
-auth_bind = yes
-auth_bind_userdn = uid=%u,ou=accounts,dc=fripost,dc=org
-ldap_version = 3
-base = ou=accounts,dc=fripost,dc=org
-pass_filter = (&(objectClass=posixAccount)(uid=%u))
+ hosts = localhost # Or wherever is our LDAP server
+ ldap_version = 3
+ auth_bind = yes
+ auth_bind_userdn = mail=%u,o=mailboxes,dc=mail,dc=fripost,dc=org
+ base = o=mailboxes,dc=mail,dc=fripost,dc=org
+ deref = never
+ scope = subtree
+ user_attrs = maildir=home=/home/mail/virtual/%$
+ user_filter = (&(objectClass=virtualMailbox)(mail=%u)(domain=%d)(isActive=TRUE))
+ pass_attrs = mail=user
+ pass_filter = (&(objectClass=virtualMailbox)(mail=%u)(domain=%d)(isActive=TRUE))
(And the TLS-related lines in case we are not using a tunnel.) The "base" is the root
-of our tree structure, in our case dn="ou=accounts,dc=fripost,dc=org".
+of our tree structure, in our case dn="o=mailboxes,dc=mail,dc=fripost,dc=org".
+
+[Note: the `user_attrs' and `user_filter' are only relevant if the result of the query is
+used in the `dovecot.conf', for instance with mail_location = maildir:~. Otherwise, the
+userdb would better be dropped.]
We can now amend the `dovecot.conf': Comment the "passwd sql {...}" and "userdb sql {...}"
blocks, and uncomment
- passdb ldap {
- args = /etc/dovecot/dovecot-ldap.conf
- }
-# and
- userdb ldap {
- args = /etc/dovecot/dovecot-ldap-userdb.conf
- }
+ passdb ldap {
+ args = /etc/dovecot/dovecot-ldap.conf
+ }
+ # and
+ userdb ldap {
+ args = /etc/dovecot/dovecot-ldap-userdb.conf
+ }
Following http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds, `dovecot-ldap-userdb.conf'
can simply be a symlink to `dovecot-ldap.conf'. The names have to differ for Dovecot to send
@@ -1173,7 +1234,7 @@ test our installation.)
ldap_version: 3
ldap_search_base: o=mailboxes,dc=mail,dc=fripost,dc=org
ldap_scope: sub
- ldap_filter: uid=%u
+ ldap_filter: mail=%u
ldap_auth_method: bind
After restarting saslauthd (`/etc/init.d/saslauthd restart'), we can test the