Last time I wrote about users’ authentication in LDAP directory to allow them receiving and sending e-mails. Now is time to configure Postfix for mail delivery to appropriate mailboxes.
\nIf you compile Postfix themselves, you need to remember to add support for LDAP. My description is based on Ubuntu, so I only need to install postfix-ldap package:<\/p>\n
\r\n$ sudo -i\r\n# apt-get install postfix-ldap\r\n<\/pre>\nThis will add support for
ldap:<\/code> maps in Postfix.<\/p>\nNow we go to Postfix configuration:<\/p>\n
\r\n# cd \/etc\/postfix\r\n# vi main.cf\r\n<\/pre>\n<\/p>\n
In
main.cf<\/code> we need to add something like this (you need to replace example.com with your domain name):<\/p>\n\r\nldap_bind_dn = cn=admin,dc=example,dc=com\r\nldap_bind_pw = secret\r\nldap_search_base = o=hosting,dc=example,dc=com\r\nldap_domain = dc=example,dc=com\r\nldap_server_host = localhost\r\nldap_server_port = 389\r\nldap_version = 3\r\n\r\n# Accounts\r\naccounts_server_host = $ldap_server_host\r\naccounts_search_base = $ldap_search_base\r\naccounts_query_filter = (&(objectClass=mailUser)(mail=%s))\r\naccounts_result_attribute = mailMessageStore\r\naccounts_cache = no\r\naccounts_bind = yes\r\naccounts_bind_dn = $ldap_bind_dn\r\naccounts_bind_pw = $ldap_bind_pw\r\naccounts_version = $ldap_version\r\n\r\naccountsmap_server_host = $ldap_server_host\r\naccountsmap_search_base = $ldap_search_base\r\naccountsmap_query_filter = (&(objectClass=mailUser)(mail=%s))\r\naccountsmap_result_attribute = mail\r\naccountsmap_cache = no\r\naccountsmap_bind = yes\r\naccountsmap_bind_dn = $ldap_bind_dn\r\naccountsmap_bind_pw = $ldap_bind_pw\r\naccountsmap_version = $ldap_version\r\n\r\n# aliases\r\naliases_server_host = $ldap_server_host\r\naliases_search_base = $ldap_search_base\r\naliases_query_filter = (&(objectClass=mailAlias)(mail=%s))\r\naliases_result_attribute = mailForwardingAddress\r\naliases_bind = yes\r\naliases_cache = no\r\naliases_bind_dn = $ldap_bind_dn\r\naliases_bind_pw = $ldap_bind_pw\r\naliases_version = $ldap_version\r\n\r\n# transports\r\ntransport_server_host = $ldap_server_host\r\ntransport_search_base = $ldap_search_base\r\ntransport_query_filter = (&(objectClass=mailDomain)(domainName=%s))\r\ntransport_result_attribute = mtaTransport\r\ntransport_cache = no\r\ntransport_bind = yes\r\ntransport_scope = one\r\ntransport_bind_dn = $ldap_bind_dn\r\ntransport_bind_pw = $ldap_bind_pw\r\ntransport_version = $ldap_version\r\n\r\n# transport_maps\r\nmaildrop_destination_concurrency_limit = 2\r\nmaildrop_destination_recipient_limit = 1\r\ntransport_maps = ldap:transport\r\nvirtual_alias_maps = ldap:aliases, ldap:accountsmap\r\n\r\n# virtual accounts for delivery\r\nvirtual_mailbox_domains = ldap:transport\r\nvirtual_mailbox_base = \/vdhome\r\nvirtual_mailbox_maps = ldap:accounts\r\nvirtual_minimum_uid = 501\r\nvirtual_uid_maps = static:501\r\nvirtual_gid_maps = static:501\r\n\r\nlocal_recipient_maps = $alias_maps $virtual_mailbox_maps\r\n<\/pre>\nThe lines above should be enough for mail delivery. I tried to simplify this, so I do not chceck account status (active\/nonactive) etc. There is no need to configure cn=admin to read directory also (security), you should define another user for this purpose, but it will be sufficient for now.<\/p>\n
Now we need to restart Postfix and check logs for errors. If Postfix is running, we can leave it and go to mail configuration in LDAP directory. You can use description from Mail system authentication in LDAP<\/a>, but I will add new domain virtdomain.com<\/b>, user jsmith<\/b> and alias postmaster<\/b>, which will point to jsmith<\/b>. You can create this in phpLDAPadmin or another utility, or you can import LDIF like this:<\/p>\n
\r\ndn: domainName=virtdomain.com,o=hosting,dc=example,dc=com\r\ndomainname: virtdomain.com\r\nmtatransport: virtual\r\nobjectclass: mailDomain\r\nobjectclass: top\r\n\r\ndn: uid=jsmith,domainName=virtdomain.com,o=hosting,dc=example,dc=com\r\ncn: John Smith\r\ngivenname: John\r\nhomedirectory: \/vdhome\/virtdomain.com\/jsmith\r\nmail: jsmith@virtdomain.com\r\nmailmessagestore: virtdomain.com\/jsmith\/Maildir\/\r\nobjectclass: inetOrgPerson\r\nobjectclass: top\r\nobjectclass: mailUser\r\nsn: Smith\r\nuid: jsmith\r\nuserpassword: {MD5}XD9034sf8w83sfoXXg==\r\n\r\ndn: mail=postmaster@virtdomain.com,domainName=virtdomain.com,o=hosting,dc=example,\r\n dc=com\r\ncn: Postmaster\r\nmail: postmaster@virtdomain.com\r\nmailforwardingaddress: jsmith@virtdomain.com\r\nobjectclass: mailAlias\r\nobjectclass: top\r\n<\/pre>\nIf you add this with phpLDAPadmin, then you need to choose
inetOrgPerson<\/code> as structural objectClass, and then addmailUser<\/code> object Class and needed attributes. As RDN you can choosemail<\/code> attribute, so you do not need to adduid<\/code> then.<\/p>\nPlease note
homeDirectory<\/code> andmailMessageStore<\/code> attributes. The last one contains relative<\/b> path to user’s mailbox. Base directory is added by Postfix, which gets it fromvirtual_mailbox_base<\/code> variable. Dovecot in contrast useshomeDirectory<\/code> attribute and stick\/Maildir<\/code> on the end. This is not good situation, and later I will write how to eliminate it. But it should work for now.<\/p>\nLet’s check if postfix resolves LDAP maps properly:<\/h3>\n
\r\n# postmap -q "virtdomain.com" ldap:transport\r\nvirtual\r\n# postmap -q "postmaster@virtdomain.com" ldap:aliases\r\njsmith@virtdomain.com\r\n# postmap -q "jsmith@virtdomain.com" ldap:accounts\r\nvirtdomain.com\/jsmith\/Maildir\/\r\n# postmap -q "jsmith@virtdomain.com" ldap:accountsmap\r\njsmith@virtdomain.com\r\n<\/pre>\nYou should see something like this above. If you do not have any results or you have connection to LDAP error, then you should check logs and improve configuration.<\/p>\n
If everything is fine, you can send message to yourself, and it should be delivered to mailbox. If you see in logs message like this:<\/p>\n
\r\nstatus=bounced (mail for example.com loops back to myself)\r\n<\/pre>\nthen there is a problem with transport. Note: you will find many results and solutions for this problem, but many of them suggest that you should your domain (example.com) to
mydestination<\/code>, this is not good solution!<\/b> In Postfix documentation, section VIRTUAL_README<\/a> Vietse wrote:<\/p>\n\r\nNEVER list a virtual MAILBOX domain name as a mydestination domain!\r\nNEVER list a virtual MAILBOX domain name as a virtual ALIAS domain!\r\n<\/pre>\nin the other words: if domain is virtual, then should be virtual, Postfix will receive mail for this domain, you need only point him where to deliver.<\/p>\n
<\/p>","protected":false},"excerpt":{"rendered":"