Erol wrote:
> Hi,
>
> What should I do to setup LDAP objects on oes to setup a mail server?
>
> Thanks

Need some more information please:

OpenLDAP or eDirectory?
What kind of access do you want? (POP3, IMAP, Webmail)


For most mailservers, you don't need to do any fancy LDAP setup. I
usually recommend Postfix for the MTA (which comes by default on OES).
An MTA is the part that accepts the messages via SMTP and delivers the
mail locally (or reroutes it/rewrites it, postfix is very powerful). You
can also later integrate spamassassin and clamav (or your favorites) for
spam and antivirus filtering via amavis-new.

For mail retrieval, I usually go with Dovecot for POP3/IMAP access, and
IMP from the horde package (horde.org) for webmail.

Postfix can generally handle the local delivery for you (I recommend
Maildir format to home dirs if small scale, otherwise a dedicated
directory on a SAN-mounted disk or database storage to
MySQL/PostGre/Oracle).

On OES, assuming you're using eDirectory and not OpenLDAP, you really
don't need to touch the LDAP objects unless you have more than 65,000
individual users on a single machine. Just set up the users for Linux
User Management (LUM) and they'll show up as local users in PAM, and you
just set up the package as if you had created them all locally.

Let me know if you have a more specific reason why you need to use LDAP.

--
Justin Grote
Network Architect
JWG Networks

Hi,

First of all thanks for the answer.. I have 2 sles based oes servers, I
have edirectory on one and I am trying to install a mail server to the other
one which will use the edirectory users. I have installed the
yast2-mail-server module to configure and when I try to use it, it says that
I need to run LDAP client module and enable the 'create default
configuration objects' option and Enable "LDAP Support Active" in the DNS
Server module. As far as I understand from your reply I don't need to
install yast2-mail-server module but how will I configure postfix with yast
then?

Thanks

Erol



"Justin Grote" <rastan@junkmail.com> wrote in message
news:OzJef.123$Pe3.87@prv-forum2.provo.novell.com...
> Erol wrote:
>> Hi,
>>
>> What should I do to setup LDAP objects on oes to setup a mail server?
>>
>> Thanks
>
> Need some more information please:
>
> OpenLDAP or eDirectory?
> What kind of access do you want? (POP3, IMAP, Webmail)
>
>
> For most mailservers, you don't need to do any fancy LDAP setup. I usually
> recommend Postfix for the MTA (which comes by default on OES). An MTA is
> the part that accepts the messages via SMTP and delivers the mail locally
> (or reroutes it/rewrites it, postfix is very powerful). You can also later
> integrate spamassassin and clamav (or your favorites) for spam and
> antivirus filtering via amavis-new.
>
> For mail retrieval, I usually go with Dovecot for POP3/IMAP access, and
> IMP from the horde package (horde.org) for webmail.
>
> Postfix can generally handle the local delivery for you (I recommend
> Maildir format to home dirs if small scale, otherwise a dedicated
> directory on a SAN-mounted disk or database storage to
> MySQL/PostGre/Oracle).
>
> On OES, assuming you're using eDirectory and not OpenLDAP, you really
> don't need to touch the LDAP objects unless you have more than 65,000
> individual users on a single machine. Just set up the users for Linux User
> Management (LUM) and they'll show up as local users in PAM, and you just
> set up the package as if you had created them all locally.
>
> Let me know if you have a more specific reason why you need to use LDAP.
>
> --
> Justin Grote
> Network Architect
> JWG Networks

Erol wrote:
> As far as I understand from your reply I don't need to
> install yast2-mail-server module but how will I configure postfix with yast
> then?

I honestly never use Yast for anything except for package management, so
I couldn't tell you. I just edit the configuration files in /etc/postfix
with my favorite editor (Kate on Linux GUI, nano for command line,
notepad2 via WinSCP on Windows). But you probably will need it to
install a postfix MTA with YaST. Can't help you there though, I find
it's much easier to just work with the config files than try to do it
through YaST. That's just me though.



--
Justin Grote
Network Architect
JWG Networks

Have you tried to run cyrus? I couldnt hande the authentication for cyrus..
Any experience about it?

thanks..

"Justin Grote" <rastan@junkmail.com> wrote in message
news:TiNef.407$Pe3.336@prv-forum2.provo.novell.com...
> Erol wrote:
>> As far as I understand from your reply I don't need to install
>> yast2-mail-server module but how will I configure postfix with yast then?
>
> I honestly never use Yast for anything except for package management, so I
> couldn't tell you. I just edit the configuration files in /etc/postfix
> with my favorite editor (Kate on Linux GUI, nano for command line,
> notepad2 via WinSCP on Windows). But you probably will need it to install
> a postfix MTA with YaST. Can't help you there though, I find it's much
> easier to just work with the config files than try to do it through YaST.
> That's just me though.
>
>
>
> --
> Justin Grote
> Network Architect
> JWG Networks

Erol wrote:
> Have you tried to run cyrus? I couldnt hande the authentication for cyrus..
> Any experience about it?

Yes, Cyrus is basically a black-box system that uses its own messaging
format, and the cyrus implementation of SASL, which is like GSSAPI or
PAM in that it is supposed to be an authentication framework. Cyrus also
uses Sieve, a server side filtering language that you can get a frontend
for called Ingo from the Horde project.

Cyrus scales pretty well, and has a solid IMAP implementation, but I've
since moved to Dovecot for the following reasons:

- Designed for security from the start
- Uses Maildir standard format (a standard so it's not hard to migrate
to another program or use Maildir-compatible tools)
- Much more lightweight with the same scalability
- Uses SASL authentication (so it can be tied to many systems)

Unfortunately Dovecot doesn't come with SLES9, I had to build RPMs
separately. Cyrus should work fine for you, though I'll admit the SASL
authentication setup can be a *** at first.

--
Justin Grote
Network Architect
JWG Networks

I did the pam authentication quiet easily. Now my problem is, how can I
create alieses for the users. All of my users have their email addresses as
<firstname>.<lastname> and user names in sles based oes have problems with
'.' How do you create your alieses? Use ldap mapping to the 'email' in
edirectory?


"Justin Grote" <rastan@junkmail.com> wrote in message
news:9cKgf.6813$Pe3.5905@prv-forum2.provo.novell.com...
> Erol wrote:
>> Have you tried to run cyrus? I couldnt hande the authentication for
>> cyrus.. Any experience about it?
>
> Yes, Cyrus is basically a black-box system that uses its own messaging
> format, and the cyrus implementation of SASL, which is like GSSAPI or PAM
> in that it is supposed to be an authentication framework. Cyrus also uses
> Sieve, a server side filtering language that you can get a frontend for
> called Ingo from the Horde project.
>
> Cyrus scales pretty well, and has a solid IMAP implementation, but I've
> since moved to Dovecot for the following reasons:
>
> - Designed for security from the start
> - Uses Maildir standard format (a standard so it's not hard to migrate to
> another program or use Maildir-compatible tools)
> - Much more lightweight with the same scalability
> - Uses SASL authentication (so it can be tied to many systems)
>
> Unfortunately Dovecot doesn't come with SLES9, I had to build RPMs
> separately. Cyrus should work fine for you, though I'll admit the SASL
> authentication setup can be a *** at first.
>
> --
> Justin Grote
> Network Architect
> JWG Networks

Erol wrote:
> I did the pam authentication quiet easily. Now my problem is, how can I
> create alieses for the users. All of my users have their email addresses as
> <firstname>.<lastname> and user names in sles based oes have problems with
> '.' How do you create your alieses? Use ldap mapping to the 'email' in
> edirectory?

Postfix is very powerful for setting up any sort of aliases you need.
See the /etc/aliases and the associated manpage for details, but you can
do pretty much anything you need to do, including email addresses with
periods in them with a few regular expressions.

http://www.postfix.org/aliases.5.html

--
Justin Grote
Network Architect
JWG Networks

I just struggled through making dovecot work with LUM on OES 2018 SP3. Two issues prevent LUM user authentication from working:

Problem

1. Apparmor breaks dovecot authentication, as it prevents dovecot from authenticating any credentials (as well as from logging to a dedicated logfile).
2. /etc/pam.d/dovecot is not configured correctly.

Solution

1. in /etc/apparmor.d/
usr.lib.dovecot.auth
usr.lib.dovecot.imap
usr.lib.dovecot.imap-login
usr.lib.dovecot.log
usr.lib.dovecot.pop3
usr.lib.dovecot.pop3-login
usr.sbin.dovecot
   add "flags=(complain)" to config, e.g. "/usr/lib/dovecot/auth flags=(complain) {"
2. in /etc/pam.d/dovecot add references to pam_nam.so at the top. The following configuration works for both local and eDirectory users:
   #%PAM-1.0
auth     sufficient     pam_nam.so      use_first_pass
account  sufficient     pam_nam.so
password sufficient     pam_nam.so
session  optional       pam_nam.so
auth     optional       pam_shells.so
auth     include        common-auth
account  optional       pam_nologin.so
account  include        common-account
password include        common-password
session  optional       pam_loginuid.so
session  include        common-session
3. in /etc/dovecot/conf.d/auth-system.conf.ext I also added
   args = session=yes failure_show_msg=yes dovecot
   to the passdb entry. However this may not be necessary, but helped with debugging.

You may also have to adjust permissions and/or group memberships for the dovecot user as needed