Postfix/Dovecot/ADS

ActiveDirectory/PostfixDovecot

• Ziel:* Einrichten von Postfix und Dovecot zur Authentifizierung von Benutzern in Active Directory.

Inhaltsverzeichnis

• Aufgabe
• Vorbereitung
• Postfix-Konfiguration
• Dovecot-Konfiguration
• Sicherheit
• Debugging

Aufgabe

• Postfix und Dovecot sollen so konfiguriert werden, dass sie die Benutzer aus Active Directory authentifizieren.
• Mailverzeichnis: /var/mail/<Benutzername>
• IMAPS-Zugriff (Port 993) und SMTP mit SSL (Port 465)
• Authentifizierung: Vollständige E-Mail-Adresse (z.B. rudi@lab34.linuggs.de) oder Benutzername (z.B. rudi)

Vorbereitung

• Erstellen eines Benutzers in Active Directory:

 * .samba-tool user create -W Users vmail
 * .samba-tool user setexpiry vmail --noexpiry

Postfix-Konfiguration

• Installation des Pakets postfix-ldap
• Anpassen der folgenden Dateien unter /etc/postfix:

 main.cf
   mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
   inet_protocols = ipv4
   virtual_mailbox_base = /var/mail
   virtual_mailbox_domains = lab34.linuggs.de
   virtual_mailbox_maps = ldap:/etc/postfix/ad_local_recipients.cf
   virtual_alias_maps = ldap:/etc/postfix/ad_mail_groups.cf
   virtual_transport = dovecot
   local_transport = virtual
   local_recipient_maps = $virtual_mailbox_maps
   smtpd_use_tls = yes
   smtpd_tls_security_level = encrypt
   smtpd_sasl_auth_enable = yes
   smtpd_sasl_local_domain = lab34.linuggs.de
   smtpd_sasl_path = private/auth
   smtpd_sasl_type = dovecot
   smtpd_sender_login_maps = ldap:/etc/postfix/ad_sender_login.cf
   smtpd_tls_auth_only = yes
   smtpd_tls_cert_file = /var/lib/ssl/certs/dovecot.cert
   smtpd_tls_key_file = /var/lib/ssl/private/dovecot.key
   smtpd_tls_CAfile = /var/lib/ssl/certs/dovecot.pem
   smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, permit_sasl_authenticated, reject
   smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch
   default_destination_recipient_limit = 1

   * Hinweis: Die Datei /etc/postfix/mydestination muss leer sein.

 master.cf
   dovecot unix - n n - - pipe
     flags=DRhu user=mail:mail argv=/usr/libexec/dovecot/deliver -d ${recipient}
   smtps inet n - n - - smtpd
     -o smtpd_tls_wrappermode=yes
     -o smtpd_sasl_auth_enable=yes
     -o smtpd_client_restrictions=permit_sasl_authenticated,reject

 ad_local_recipients.cf
   version = 3
   server_host = lab34.linuggs.de:389
   search_base = dc=lab34,dc=linuggs,dc=de
   scope = sub
   query_filter = (&(|(mail=%s)(otherMailbox=%u@%d))(sAMAccountType=805306368))
   result_filter = %s
   result_attribute = mail
   special_result_attribute = member
   bind = yes
   bind_dn = cn=vmail,cn=users,dc=lab34,dc=linuggs,dc=de
   bind_pw = Pa$$word

 ad_mail_groups.cf
   version = 3
   server_host = lab34.linuggs.de:389
   search_base = dc=lab34,dc=linuggs,dc=de
   timeout = 3
   scope = sub
   query_filter = (&(mail=%s)(sAMAccountType=268435456))
   result_filter = %s
   leaf_result_attribute = mail
   special_result_attribute = member
   bind = yes
   bind_dn = cn=vmail,cn=users,dc=lab34,dc=linuggs,dc=de
   bind_pw = Pa$$word

 ad_sender_login.cf
   version = 3
   server_host = lab34.linuggs.de:389
   search_base = dc=lab34,dc=linuggs,dc=de
   scope = sub
   query_filter = (&(objectClass=user)(|(sAMAccountName=%s)(mail=%s)))
   result_attribute = mail
   bind = yes
   bind_dn = cn=vmail,cn=users,dc=lab34,dc=de
   bind_pw = Pa$$word

• Testen der Postfix-Konfiguration:

 * .postconf >/dev/null
 * .postmap -q rudi@lab34.linuggs.de ldap:/etc/postfix/ad_local_recipients.cf
 * .postmap -q rudi@lab34.linuggs.de ldap:/etc/postfix/ad_sender_login.cf

• Neustart des Postfix-Dienstes:

 * .service postfix restart