Differences

This shows you the differences between two versions of the page.

--- ubuntuserver810:postfix_vs_dovecot [2008/11/30 22:19] – svschwartz
+++ ubuntuserver810:postfix_vs_dovecot [2010/06/20 16:19] (current) – svschwartz
@@ Line 1: / Line 1: @@
+Добавим учетные записи для работы с виртуальными почтовыми ящиками
+<code>
+groupadd -g 500 vmail
+useradd -g vmail -u 500 vmail
+mkdir /var/vmail
+chown vmail.vmail /var/vmail
+</code>
 Устанавливаем postfix
 <code>
@@ Line 14: / Line 22: @@
   * Системной почтовое имя - daemon.drivesource.ru
-Стартовый конфиг
+Добавляем в основной файл конфигурации **/etc/postfix/main.cf**
 <code>
-# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+# basic protection
-# Debian specific:  Specifying a file name will cause the first
+smtpd_helo_required = yes
-# line of that file to be used as the name.  The Debian default
+strict_rfc821_envelopes = yes
-# is /etc/mailname.
+smtpd_helo_restrictions =
-#myorigin = /etc/mailname
+        permit_mynetworks
+        reject_invalid_helo_hostname
+        reject_non_fqdn_helo_hostname
+        reject_unknown_hostname
-smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
+smtpd_recipient_restrictions =
-biff = no
+        permit_mynetworks
+        permit_sasl_authenticated
+        reject_unauth_destination
-# appending .domain is the MUA's job.
+virtual_mailbox_domains = drivesource.ru
-append_dot_mydomain = no
+virtual_alias_maps = hash:/etc/postfix/virtual_alias
+virtual_mailbox_maps = ldap:/etc/postfix/ldap-aliases.cf
+virtual_transport = dovecot
+dovecot_destination_recipient_limit = 1
-# Uncomment the next line to generate "delayed mail" warnings
+# SASL authentication
-#delay_warning_time = 4h
+smtpd_sasl_auth_enable = yes
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
-readme_directory = no
-# TLS parameters
-smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
-smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
-smtpd_use_tls=yes
-smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
-smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
-# information on enabling SSL in the smtp client.
-myhostname = daemon.drivesource.ru
-alias_maps = hash:/etc/aliases
-alias_database = hash:/etc/aliases
-myorigin = /etc/mailname
-mydestination = daemon.drivesource.ru, drivesource.ru, localhost
-relayhost =
-mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
-mailbox_size_limit = 0
-message_size_limit = 0
-virtual_mailbox_limit = 0
-recipient_delimiter =
-inet_interfaces = all
-inet_protocols = all
 </code>
-Добавим учетные записи для работы с виртуальными почтовыми ящиками
+Запишем в файл ** /etc/postfix/ldap-aliases.cf ** следующую конфигурацию
 <code>
-groupadd -r -g 500 vmail
+server_host = localhost
-useradd -r -g vmail -u 500 vmail
+search_base = ou=Users,dc=drivesource, dc=ru
-mkdir /var/vmail
+query_filter = uid=%u
-chown vmail.vmail /var/vmail
+result_attribute = uid
 </code>
-Тестируем маппинг
+В конфигурацию транспорта **/etc/postfix/master.cf**
 <code>
-postmap -q svschwartz ldap:/etc/postfix/ldap-aliases.cf
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}
 </code>
 Устанавливаем [[http://www.dovecot.org/|dovecot]]
@@ Line 78: / Line 69: @@
 apt-get update
 apt-get install dovecot-common dovecot-imapd
+</code>
+Отредактируем основной файл конфигурации **/etc/dovecot/dovecot.conf**
+<code php>
+# Disable LOGIN command and all other plaintext authentications unless
+# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
+# matches the local IP (ie. you're connecting from the same computer), the
+# connection is considered secure and plaintext authentication is allowed.
+disable_plaintext_auth = no
+mail_location = maildir:/var/vmail/%u
+# System user and group used to access mails. If you use multiple, userdb
+# can override these by returning uid or gid fields. You can use either numbers
+# or names. <doc/wiki/UserIds>
+mail_uid = 500
+mail_gid = 500
+protocol lda {
+  sendmail_path = /usr/lib/sendmail
+  auth_socket_path = /var/run/dovecot/auth-master
+}
+# заблокировать системные учетные записи
+#passdb pam {
+#}
+passdb ldap {
+  args = /etc/dovecot/dovecot-ldap.conf
+}
+# заблокировать системные учетные записи
+#userdb passwd {
+#}
+userdb ldap {
+  args = /etc/dovecot/dovecot-ldap.conf
+}
+## dovecot-lda specific settings
+##
+socket listen {
+  master {
+    path = /var/run/dovecot/auth-master
+    mode = 0600
+    user = vmail # User running Dovecot LDA
+    group = vmail # Or alternatively mode 0660 + LDA user in this group
+  }
+  client {
+      # The client socket is generally safe to export to everyone. Typical use
+      # is to export it to your SMTP server so it can do SMTP AUTH lookups
+      # using it.
+      #path = /var/run/dovecot/auth-client
+      #mode = 0660
+      path = /var/spool/postfix/private/auth
+      mode = 0660
+      user = postfix
+      group = postfix
+    }
+}
+</code>
+Отредактируем файл **/etc/dovecot/dovecot-ldap.conf** для авторизации пользователей ldap
+<code php>
+hosts = localhost
+auth_bind = yes
+auth_bind_userdn = uid=%u,ou=Users,dc=drivesource,dc=ru
+ldap_version = 3
+base = ou=Users, dc=drivesource, dc=ru
+# User attributes are given in LDAP-name=dovecot-internal-name list. The
+# internal names are:
+#   uid - System UID
+#   gid - System GID
+#   home - Home directory
+#   mail - Mail location
+#
+# There are also other special fields which can be returned, see
+# http://wiki.dovecot.org/UserDatabase/ExtraFields
+user_attrs =
+# Filter for user lookup. Some variables can be used (see
+# http://wiki.dovecot.org/Variables for full list):
+#   %u - username
+#   %n - user part in user@domain, same as %u if there's no domain
+#   %d - domain part in user@domain, empty if user there's no domain
+user_filter = (&(objectClass=posixAccount)(uid=%u))
+# You can use same UID and GID for all user accounts if you really want to.
+# If the UID/GID is still found from LDAP reply, it overrides these values.
+#user_global_uid = 500
+#user_global_gid = 500
 </code>