Postfix/Dovecot/ADS Simple

Ziel

• Einrichten von Postfix und Dovecot zur Authentifizierung von Benutzern aus Active Directory und Speicherung der Mails unter /var/spool/mail.

Aufgabe

• Postfix und Dovecot sollen nur Benutzer aus der Domäne `lab34.linuggs.de` authentifizieren und die Mails unter /var/spool/mail ablegen.
• IMAPS-Zugriff (Port 993) und SMTPS (Port 465).

Vorbereitung

• Erstellen eines Service-Benutzers in Active Directory:

 * samba-tool user create -W Users mailservice
 * samba-tool user setexpiry mailservice --noexpiry

Postfix-Konfiguration

• Installation des Pakets postfix-ldap:

 * apt-get install postfix postfix-ldap

• Anpassen der folgenden Dateien unter /etc/postfix:

main.cf

inet_protocols = ipv4
virtual_mailbox_base = /var/spool/mail
virtual_mailbox_domains = lab34.linuggs.de
virtual_mailbox_maps = ldap:/etc/postfix/ad_local_recipients.cf
local_transport = virtual
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = lab34.linuggs.de
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
#smtpd_use_tls = yes
#smtpd_tls_auth_only = yes
#smtpd_tls_security_level = encrypt
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, permit_sasl_authenticated, reject

master.cf

   dovecot unix - n n - - pipe
     flags=DRhu user=mail:mail argv=/usr/lib/dovecot/deliver -d ${recipient}
   smtps inet n - n - - smtpd
     -o smtpd_tls_wrappermode=yes
     -o smtpd_sasl_auth_enable=yes
     -o smtpd_client_restrictions=permit_sasl_authenticated,reject

ad_local_recipients.cf

version = 3
server_host = lab34.linuggs.de:389
search_base = dc=lab34,dc=linuggs,dc=de
scope = sub
query_filter = (sAMAccountName=%s)
result_filter = %s@lab34.linuggs.de
result_attribute = sAMAccountName
bind = yes
bind_dn = cn=mailservice,cn=Users,dc=lab34,dc=linuggs,dc=de
bind_pw = 12345-Xinux

Testen der Postfix-Konfiguration

• postconf >/dev/null
• postmap -q rudi ldap:/etc/postfix/ad_local_recipients.cf

Neustart des Postfix-Dienstes

• service postfix restart

Dovecot-Konfiguration

• Installation des Pakets dovecot-lmtpd:

 * apt-get install dovecot-core dovecot-imapd dovecot-ldap dovecot-lmtpd

• Anpassen der folgenden Dateien unter /etc/dovecot:

dovecot-ldap.conf.ext

   hosts = lab34.linuggs.de:389
   ldap_version = 3
   auth_bind = yes
   dn = cn=mailservice,cn=Users,dc=lab34,dc=linuggs,dc=de
   dnpass = 12345-Xinux
   base = cn=Users,dc=lab34,dc=linuggs,dc=de
   scope = subtree
   user_filter = (sAMAccountName=%u)
   user_attrs = =uid=mail,gid=mail
   pass_filter = (sAMAccountName=%u)
   pass_attrs = sAMAccountName=user

10-auth.conf

   auth_mechanisms = plain login
   !include auth-ldap.conf.ext

10-mail.conf

   mail_location = mbox:/var/spool/mail/%u
   mail_uid = mail
   mail_gid = mail

10-master.conf

   service auth {
     unix_listener /var/spool/postfix/private/auth {
       mode = 0660
       user = postfix
       group = postfix
     }
   }

15-lda.conf

   protocol lda {
     postmaster_address = postmaster@lab34.linuggs.de
   }

Neustart des Dovecot-Dienstes

• service dovecot restart