Postfix+cyrus-saslauthd+dovecot+openldap

strah · Сообщение **strah** » 15.06.2009 20:28

Настройка связки postfix + dovecot + cyrus-saslauthd + openldap

1)Введение:
Итак, нам необходимо настроить почтовый сервер, который будет хранить инфу о пользователях/алиасах/etc в LDAP. В нашем примере мы будем использовать openldap, хотя можно взять любой другой LDAP-сервер. Кроме того, нам надо обеспечить smtp-аутентентификацию пользвательей, чтобы абы кто не мог отправлять с нашего сервера сообщения. Кроме того, надо будет настроить imaps-аутентификацию для того, чтобы анонимус не мог читать чужие письма. И smtp, и imaps аутентификация будет проводиться с использованием сертификатов – для повышения безопасности. В качестве smtp-сервера мы будем юзать postfix, как один из наиболее безопасных, в качестве сервера аутентификации для postfix'а будет использоваться cyrus-authd, а в качестве imaps-сервера – dovecot (аутентификацию через LDAP он умеет проводить сам).

2)Установка ПО:
В качестве openldap-сервера в нашем случае будет использоваться Redhat Enterprise Linux 5.0, а в качестве smtp/imaps сервера – FreeBSD 7.1. На машину с FreeBSD кроме самих пакетов postfix, cyrus-authd и dovecot надо будет установить openssl, но обо всем по порядку.

2.1)Настройка LDAP-сервера.
Для начала устанавливаем пакет openldap-2.3.27-8.el5_1.3.x86_64.rpm (или openldap-2.3.27-8.el5_1.3.i386.rpm – зависит от архитектуры). Далее открываем в своем любимом текстовом редакторе файл /etc/openldap/slapd.conf, и приводим его к следующему виду:

Код:


#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/mail.schema #содержимое схемы приведено ниже

# Allow LDAPv2 client connections.  This is NOT the default.
#allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules:
# modulepath    /usr/lib64/openldap
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by changing to
# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
# slapd.pem so that the ldap user or group can read it.  Your client software
# may balk at self-signed certificates, however.
# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
# TLSCertificateFile /etc/pki/tls/certs/slapd.pem
# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

database        bdb
suffix          "dc=local,dc=net"   #суффикс нашей БД
rootdn          "cn=God,dc=local,dc=net" #описание «админского» объекта, имеющего права на запись куда угодно в нашем дереве.
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
rootpw                  {MD5}X03MO1qnZdYdgyfeuILPmQ== #MD5-хеш пароля, генерируется программой slappasswd

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/ldap               #папка, где хранятся данные дерева.

# Indices to maintain for this database
#описания индексов.
index objectClass                       eq,pres
index mail                              eq
index maildrop                          eq
index ou,cn,surname,givenname           eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub


#разрешаем анонимусу аутентифицироваться
access to attrs=userPassword
    by self write
    by anonymous auth
    by * none

access to *
   by self read
   by * none

Далее, нам необходимо создать схему mail.schema с описанием нужных нам объектов:

/etc/openldap/schema/mail.schema:

Код:


#########
# old postfix mail address attribute from postfix-courier.schema
#attributetype ( 0.9.2342.19200300.100.5.3
#   NAME ( 'postfix-alias' 'postfix-email' )
#   DESC 'Postfix virtual mailbox'
#   EQUALITY caseIgnoreIA5Match
#   SUBSTR caseIgnoreIA5SubstringsMatch
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )


# standart mail address attribute from core.schema included at OpenLDAP 2.1.x version
#attributetype ( 0.9.2342.19200300.100.1.3
#   NAME ( 'mail' 'rfc822Mailbox' )
#   DESC 'RFC1274: RFC822 Mailbox'
#    EQUALITY caseIgnoreIA5Match
#    SUBSTR caseIgnoreIA5SubstringsMatch
#    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

# standart (from) mail address (for routing forwarding ) attribute from
# misc.schema included at OpenLDAP 2.1.x version

#attributetype ( 2.16.840.1.113730.3.1.13
#   NAME 'mailLocalAddress'
#   DESC 'RFC822 email address of this recipient'
#   EQUALITY caseIgnoreIA5Match
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )


# standart mail host attribute. see description.
# new unique attribute i'm not used this older howto.

#attributetype ( 2.16.840.1.113730.3.1.18
#   NAME 'mailHost'
#   DESC 'FQDN of the SMTP/MTA of this recipient'
#   EQUALITY caseIgnoreIA5Match
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
#   SINGLE-VALUE )


# old postfix mail forwarding attribute from postfix-courier.schema
#attributetype ( 0.9.2342.19200300.100.5.5
#   NAME ( 'postfix-forward' 'postfix-remote-alias')
#   DESC 'Postfix forwarding maps'
#   EQUALITY caseIgnoreIA5Match
#   SUBSTR caseIgnoreIA5SubstringsMatch
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

# standart mail routing attribute. may be used for forwarding (to)
#attributetype ( 2.16.840.1.113730.3.1.47
#   NAME 'mailRoutingAddress'
#   DESC 'RFC822 routing address of this recipient'
#   EQUALITY caseIgnoreIA5Match
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
#   SINGLE-VALUE )


# very intresting attribute. This it can used in mail subscribe by members.
# You know any MTA support this ?

#attributetype ( 1.3.6.1.4.1.42.2.27.2.1.15
#   NAME 'rfc822MailMember'
#   DESC 'rfc822 mail address of group member(s)'
#   EQUALITY caseIgnoreIA5Match
#   SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

########## courier schema ###############
# Remember ! if you use this schema exclude authldap.schema.

attributetype ( 1.3.6.1.4.1.10018.1.1.454 NAME 'mailAlias'
 DESC 'A mail alias'
 EQUALITY caseIgnoreIA5Match
 SUBSTR caseIgnoreIA5SubstringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

attributetype ( 1.3.6.1.4.1.10018.1.1.2 NAME 'quota'
 DESC 'A string that represents the quota on a mailbox'
 EQUALITY caseExactIA5Match
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.10018.1.1.3 NAME 'maildrop'
 DESC 'The absolute path to the mailbox for a mail account in a non-default location'
 EQUALITY caseIgnoreIA5Match
 SUBSTR caseIgnoreIA5SubstringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

# use mailHost ?
attributetype ( 1.3.6.1.4.1.10018.1.1.4 NAME 'mailDomain'
 DESC 'A virtual mail domain'
 EQUALITY caseIgnoreIA5Match
 SUBSTR caseIgnoreIA5SubstringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

attributetype ( 1.3.6.1.4.1.10018.1.1.5
 NAME 'mailTransport'
 DESC 'transport for domain'
 EQUALITY caseIgnoreIA5Match
 SUBSTR caseIgnoreIA5SubstringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

attributetype ( 1.3.6.1.4.1.10018.1.1.6
 NAME 'mailAccess'
 DESC 'Access string'
 EQUALITY caseIgnoreIA5Match
 SUBSTR caseIgnoreIA5SubstringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

############################
#   object class
############################

# old postfix object for mail forwarding.
#objectclass (0.9.2342.19200300.100.5.13
#   NAME 'postfix-forward-map'
#   DESC 'Postfix forward map'
#   SUP top STRUCTURAL
#   MUST ( postfix-alias $ postfix-forward ) )
#
# standart object for mail forward.

# object class for routing & forwarding.
# additional information mailHost.
# Can help routing in multi MTA & LDAP server configuration and saves timein search.
# objectclass ( 2.16.840.1.113730.3.2.147
#   NAME 'inetLocalMailRecipient'
#   DESC 'Internet local mail recipient'
#   SUP top STRUCTURAL
#   MAY     ( mailLocalAddress $ mailHost $ mailRoutingAddress ) )
# warning !!! change AUXILIARY to STRUCTURAL !

#objectclass (0.9.2342.19200300.100.5.12
#   NAME 'postfix-alias-map'
#   DESC 'Postfix virtual account map'
#   SUP top STRUCTURAL
#   MUST ( postfix-alias $ postfix-uid $ postfix-gid $ postfix-maildir )
#   MAY ( userPassword $ courier-clearPassword $ courier-home $ courier-quota ) )

objectclass ( 1.3.6.1.4.1.10018.1.2.1235 NAME 'mailPerson'
        DESC 'RFC2256: a person'
        SUP top AUXILIARY
        MUST ( sn $ cn )
        MAY ( telephoneNumber ) )

objectclass ( 1.3.6.1.4.1.10018.1.2.1234 NAME 'aliasObject' SUP TOP STRUCTURAL
 DESC 'Mail alias object'
 MUST ( mail $ mailAlias ) )

# object class for full mail account
objectclass ( 1.3.6.1.4.1.10018.1.2.1 NAME 'fullMailAccount' SUP top STRUCTURAL
 DESC 'Full mail account object as used by the mail for server recive &storage messages'
 MUST ( mail $ maildrop )
 MAY ( uid $ cn $ description $ quota $ userPassword ) )

# object class for mail account
# others attributes contains in additonal posixAccount.

objectclass ( 1.3.6.1.4.1.10018.1.2.2 NAME 'mailAccount' SUP organizationalPerson STRUCTURAL
 DESC 'mail account object as used by the mail for server recive & storage messages'
 MUST ( mail $ maildrop )
 MAY ( quota ) )

#objectclass (0.9.2342.19200300.100.5.11
#   NAME 'postfix-transport-map'
#   DESC 'Postfix virtual domain-transport map'
#   SUP top STRUCTURAL
#   MUST ( postfix-domain $ postfix-transport ) )

# object class for virtual mail domain
# & additional transport table

objectclass ( 1.3.6.1.4.1.10018.1.2.3 NAME 'mailDomainTransport' SUP top STRUCTURAL
 DESC 'Domain mail aliasing/transporting entry'
 MUST ( mailDomain )
 MAY ( mailTransport $ description ) )

# alternate object class
#objectclass ( 1.3.6.1.4.1.10018.1.2.3 NAME 'mailDomainTransport' SUP top STRUCTURAL
#   DESC 'Domain mail aliasing/transporting entry'
#   MUST ( mailHost )
#   MAY ( mailTransport $ description ) )

# additional class object for access network & ip we can got in nis.schema
# ipHost & ipNetwork

# blacklist object class

objectclass ( 1.3.6.1.4.1.10018.1.2.4 NAME 'mailAccess' SUP top STRUCTURAL
 DESC 'mail & domain access entry'
 MUST ( mail )
 MAY ( mailAccess $ description ) )

Теперь, запускаем наш LDAP-сервер, для чего выполняем