Postfix/Dovecot/ADS Simple

Ziel

• Einrichten von Postfix und Dovecot zur Authentifizierung von Benutzern aus Active Directory und Speicherung der Mails unter /var/spool/mail.

Aufgabe

• Postfix und Dovecot sollen nur Benutzer aus der Domäne `lab34.linuggs.de` authentifizieren und die Mails unter /var/spool/mail ablegen.
• IMAPS-Zugriff (Port 993) und SMTPS (Port 465).

Vorbereitung

• Erstellen eines Service-Benutzers in Active Directory:

 * samba-tool user create -W Users mailservice
 * samba-tool user setexpiry mailservice --noexpiry

Postfix-Konfiguration

• Installation des Pakets postfix-ldap:

 * apt-get install postfix postfix-ldap

• Anpassen der folgenden Dateien unter /etc/postfix:

main.cf
inet_protocols = ipv4
virtual_mailbox_base = /var/spool/mail
virtual_mailbox_domains = lab34.linuggs.de
virtual_mailbox_maps = ldap:/etc/postfix/ad_local_recipients.cf
local_transport = virtual
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = lab34.linuggs.de
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
#smtpd_use_tls = yes
#smtpd_tls_auth_only = yes
#smtpd_tls_security_level = encrypt
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, permit_sasl_authenticated, reject

master.cf
dovecot unix - n n - - pipe
  flags=DRhu user=mail:mail argv=/usr/lib/dovecot/deliver -d ${recipient}
smtps inet n - n - - smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

ad_local_recipients.cf
version = 3
server_host = lab34.linuggs.de:389
search_base = dc=lab34,dc=linuggs,dc=de
scope = sub
query_filter = (sAMAccountName=%s)
result_filter = %s@lab34.linuggs.de
result_attribute = sAMAccountName
bind = yes
bind_dn = cn=mailservice,cn=Users,dc=lab34,dc=linuggs,dc=de
bind_pw = 12345-Xinux

Testen der Postfix-Konfiguration

• postconf >/dev/null
• postmap -q rudi ldap:/etc/postfix/ad_local_recipients.cf

Neustart des Postfix-Dienstes

• service postfix restart

Dovecot-Konfiguration

• Installation des Pakets dovecot-lmtpd:

 * apt-get install dovecot-core dovecot-imapd dovecot-ldap dovecot-lmtpd

• Anpassen der folgenden Dateien unter /etc/dovecot:

dovecot-ldap.conf.ext
hosts = lab34.linuggs.de:389
ldap_version = 3
auth_bind = yes
dn = cn=mailservice,cn=Users,dc=lab34,dc=linuggs,dc=de
dnpass = 12345-Xinux
base = cn=Users,dc=lab34,dc=linuggs,dc=de
scope = subtree
user_filter = (sAMAccountName=%u)
user_attrs = =uid=mail,gid=mail
pass_filter = (sAMAccountName=%u)
pass_attrs = sAMAccountName=user

10-auth.conf
auth_mechanisms = plain login
!include auth-ldap.conf.ext

10-mail.conf
mail_location = mbox:/var/spool/mail/%u
mail_uid = mail
mail_gid = mail

10-master.conf
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

15-lda.conf
protocol lda {
  postmaster_address = postmaster@lab34.linuggs.de
}

Neustart des Dovecot-Dienstes

• service dovecot restart