delegation feature in debian etch

Gunnar Wrobel wrobel at pardus.de
Thu Feb 21 08:54:34 CET 2008


"Eleni Postantzi" <lenapostantzi at gmail.com> writes:

> Hi Gunnar,
>
> As far no answer from the debian group :/
>
> however,i've managed to get it work better... at least now i can see in the logs that the kolabpolicy is called...
>
> now, here's my config :
>
> /etc/postfix/main.cf
>
> # Debian specific:  Specifying a file name will cause the first
> # line of that file to be used as the name.  The Debian default
> # is /etc/mailname.
> #myorigin = /etc/mailname
>
> smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
> biff = no
>
> # appending .domain is the MUA's job.
> append_dot_mydomain = no
>
> # Uncomment the next line to generate "delayed mail" warnings
> #delay_warning_time = 4h
>
> # TLS parameters
> smtpd_tls_cert_file=/var/smtp/mail.pem
> smtpd_tls_key_file=/var/smtp/mail.key
> smtpd_use_tls=yes
> smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
> smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
>
> # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
> # information on enabling SSL in the smtp client.
>
> myhostname = myhost.mydomain.org
> alias_maps = hash:/etc/aliases
> alias_database = hash:/etc/aliases
> myorigin = /etc/mailname
> mydestination = myhost.mydomain.org, mydomain.org, localhost
> relayhost =
> mynetworks = 127.0.0.0/8
> mailbox_command = procmail -a "$EXTENSION"
> mailbox_size_limit = 0
> recipient_delimiter = +
> inet_interfaces = all
>
> virtual_alias_maps = ldap:/etc/postfix/kolab-ldapdistlist.cf,ldap:/etc/postfix/kolab-ldapvirtual.cf
> # transport_maps = ldap:/etc/postfix/kolab-ldaptransport.cf
>
> mailbox_transport = kolabmailboxfilter
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_security_options = noanonymous
> # Support broken clients like Microsoft Outlook Express 4.x which expect AUTH=LOGIN instead of AUTH LOGIN
> broken_sasl_auth_clients = yes
> smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated,reject_unauth_destination, reject_unlisted_recipient, check_policy_service unix:private/kolabpolicy
> #smtpd_sender_restrictions = permit_mynetworks, check_policy_service unix:private/kolabpolicy
>
> relay_domains=
>
> kolabpolicy_time_limit = 3600
> kolabpolicy_max_idle = 20
>
> ----------------------------------------------------------------------
>
> /etc/postfix/master.cf
>
> #
> # Postfix master process configuration file.  For details on the format
> # of the file, see the master(5) manual page (command: "man 5 master").
> #
> # ==========================================================================
> # service type  private unpriv  chroot  wakeup  maxproc command + args
> #               (yes)   (yes)   (yes)   (never) (100)
> # ==========================================================================
> smtp      inet  n       -       n       -       -       smtpd
> #submission inet n       -       -       -       -       smtpd
> #  -o smtpd_enforce_tls=yes
> #  -o smtpd_sasl_auth_enable=yes
> #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> smtps     inet  n       -       n       -       -       smtpd
>   -o smtpd_tls_wrappermode=yes
>   -o smtpd_sasl_auth_enable=yes
>   -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> #628      inet  n       -       -       -       -       qmqpd
> pickup    fifo  n       -       -       60      1       pickup
> cleanup   unix  n       -       -       -       0       cleanup
> qmgr      fifo  n       -       n       300     1       qmgr
> #qmgr     fifo  n       -       -       300     1       oqmgr
> tlsmgr    unix  -       -       -       1000?   1       tlsmgr
> rewrite   unix  -       -       -       -       -       trivial-rewrite
> bounce    unix  -       -       -       -       0       bounce
> defer     unix  -       -       -       -       0       bounce
> trace     unix  -       -       -       -       0       bounce
> verify    unix  -       -       -       -       1       verify
> flush     unix  n       -       -       1000?   0       flush
> proxymap  unix  -       -       n       -       -       proxymap
> smtp      unix  -       -       -       -       -       smtp
> # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
> relay     unix  -       -       -       -       -       smtp
>     -o fallback_relay=
> #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
> showq     unix  n       -       -       -       -       showq
> error     unix  -       -       -       -       -       error
> discard   unix  -       -       -       -       -       discard
> local     unix  -       n       n       -       -       local
> virtual   unix  -       n       n       -       -       virtual
> lmtp      unix  -       -       -       -       -       lmtp
> anvil     unix  -       -       -       -       1       anvil
> scache      unix    -    -    -    -    1    scache
> #
> # ====================================================================
> # ====================================================================
> # Interfaces to non-Postfix software. Be sure to examine the manual
> # pages of the non-Postfix software to find out what options it wants.
> #
> # Many of the following services use the Postfix pipe(8) delivery
> # agent.  See the pipe(8) man page for information about ${recipient}
> # and other message envelope options.
> # ====================================================================
> #
> # maildrop. See the Postfix MAILDROP_README file for details.
> # Also specify in main.cf: maildrop_destination_recipient_limit=1
> #
> maildrop  unix  -       n       n       -       -       pipe
>   flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
> #
> # See the Postfix UUCP_README file for configuration details.
> #
> uucp      unix  -       n       n       -       -       pipe
>   flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
> #
> # Other external delivery methods.
> #
> ifmail    unix  -       n       n       -       -       pipe
>   flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
> bsmtp     unix  -       n       n       -       -       pipe
>   flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
> scalemail-backend unix    -    n    n    -    2    pipe
>   flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
> mailman   unix  -       n       n       -       -       pipe
>   flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
>   ${nexthop} ${user}
> kolabfilter     unix  -       n       n       -       -       pipe user=nobody null_sender= argv=/usr/bin/php
>    -c /etc/php4/cli/php.ini
>    -f /usr/share/kolab-resource-handlers/kolabfilter.php
>    --
>    -h myhost.mydomain.org
>    -s ${sender}
>    -r ${recipient}
>    -c ${client_address}
>
> kolabmailboxfilter     unix  -       n       n       -       -       pipe user=nobody null_sender= argv=/usr/bin/php
>    -c /etc/php4/cli/php.ini
>    -f /usr/share/kolab-resource-handlers/kolabmailboxfilter.php
>    --
>    -h myhost.mydomain.org
>    -s ${sender}
>    -r ${recipient}
>    -c ${client_address}
> kolabpolicy    unix  -       n       n       -       -       spawn user=kolab argv=/usr/sbin/kolab_smtpdpolicy -v
>
> ------------------------------------------------------------
>
> and finally,
>
> /etc/kolab/kolab_smtpdpolicy.conf
>
> ldap_uri: ldap://127.0.0.1:389
> basedn: dc=mydomain,dc=org
> binddn: cn=manager,cn=internal,dc=mydomain,dc=org
> bindpw: mypassword
> domain: mydomain.org
> allow_unauth: 1
> permithosts: localhost
>
> Do these config files seem good to you?

What might be more important is the cyrus imapd configuration. 

>From what you reported so far I'm not certain if the delegation fails
within postfix or the IMAP server.

For Cyrus IMAPD you should have:

postuser: kolab
userprefix: user
sharedprefix: shared


For postfix you could also try the fix I suggested here:

https://www.intevation.de/roundup/kolab/issue828

Cheers,

Gunnar

>
> i can't understand why when putting allow_unauth: 0 then i get the following error when i send a mail from an external user to a kolab user
>
> Feb 20 21:47:47 mailhost /usr/sbin/kolab_smtpdpolicy[18637]: Checking sender="me at gmail.com", recipient="kolabuser at mydomain.org", username="", domains= permithosts=localhost,
> conf_allowunauth=0
> Feb 20 21:47:47 mailhost /usr/sbin/kolab_smtpdpolicy[18637]: LDAP search returned 0 objects
> Feb 20 21:47:47 mailhost /usr/sbin/kolab_smtpdpolicy[18637]: Attempt to fake address me at gmail.com
> Feb 20 21:47:47 mailhost /usr/sbin/kolab_smtpdpolicy[18637]: Action: REJECT Invalid sender
> Feb 20 21:47:47 mailhost postfix/smtpd[18631]: NOQUEUE: reject: RCPT from myserver.gmail.com: 554 5.7.1 <me at gmail.com>: Sender address rejected: Invalid sender; from=<
> me at gmail.com> to=<olabuser at mydomain.org> proto=ESMTP helo=<smtp.gmail.com>
>
> When i send a mail directly from Horde (which is on the same server) the policy is not called to treat the message... I suppose that it has something to do with the order of
> parameters in smtpd_recipient_restrictions ?
>
> Many thanks for your help,
>
> Eleni
>
> _______________________________________________
> Kolab-users mailing list
> Kolab-users at kolab.org
> https://kolab.org/mailman/listinfo/kolab-users

-- 
______ http://kdab.com _______________ http://kolab-konsortium.com _

p at rdus Kolab work is funded in part by KDAB and the Kolab Konsortium

____ http://www.pardus.de _________________ http://gunnarwrobel.de _
E-mail : p at rdus.de                                 Dr. Gunnar Wrobel
Tel.   : +49 700 6245 0000                          Bundesstrasse 29
Fax    : +49 721 1513 52322                          D-20146 Hamburg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   >> Mail at ease - Rent a kolab groupware server at p at rdus <<                 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




More information about the users mailing list