潛了好久，終於又浮上來了
【緣起】話說在農曆新年前，公司所在大樓發生了連續三次跳電，慘劇就此上演
一台3Com 3300 N年前老舊設備Power燒掉了(還好還有D-Link)
一台前人用Debian做的神奇Mail Server也掛了(如何神奇就不提了)
真是一陣晴天霹靂，快過年了來這種Trouble，難道是老天爺覺得我過太爽了嗎？
求助三子兄，救了半天…還是救不回來…
唉…只好重做了
即然要重做…那就用比較熟悉的FreeBSD吧
即然要重做…那就順便整合AD吧…懶得設定兩次帳號及密碼了(偷懶是MIS的美德)
【環境】FreeBSD 8.1
Postfix 2.8.1
Dovecot 1.2.16 提供POP3、IMAP、SASL
RoundCube 0.5.1 有Fu的Webmail，加上去好玩的
Apache 1.3.42
MySQL 5.0：roundcube可使用MySQL、PostgreSQL、SQLlite請自行選用
PHP 5.3.5
以上套件皆是使用Port的方式安裝
【安裝及設定】Windows 2003 AD Domain：cecl.corp
Domain：cecr.org.tw
虛擬郵件帳號及群組：vmail uid/gid 1002
虛擬郵件位址：/var/vmail
LDAP Search帳號：ldapuser
Apache及MySQL的設定不在這篇文章內
這邊只提一些設定項目，請依各人需要自行修改實際環境所需項目
Postfix安裝時請將dovecot SASL及LDAP支援等選項打勾，這邊不需用到Cyrus SASL
main.cf
myhostname=mail.cecr.org.tw
mydomain=cecr.org.tw
myorigin=cecr.org.tw
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks=127.0.0.1
virtual_mailbox_base = /var/vmail
virtual_uid_maps = static:1002
virtual_gid_maps = static:1002
smtpd_sender_restrictions =
check_sender_access hash:/usr/local/etc/postfix/senderaccess
reject_unknown_sender_domain
reject_unknown_address
smtpd_recipient_restrictions =
permit_sasl_authenticated
reject_unauth_destination
smtpd_client_restrictions =
check_client_access hash:/usr/local/etc/postfix/clientaccess
reject_rbl_client dnsbl.sorbs.net
reject_rbl_client xbl.spamhaus.org
alias_maps = hash:/usr/local/etc/postfix/aliases
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
virtual_mailbox_domains = cecr.org.tw
virtual_alias_maps = hash:/usr/local/etc/postfix/virtual
canonical_maps = hash:/usr/local/etc/postfix/canonical
#LDAP Stuff
virtual_mailbox_maps = ldap:ldapvirtual
ldapvirtual_server_host =
ldap://主機1
ldap://主機2
ldapvirtual_search_base = OU=TPE,DC=cecl,DC=corp
ldapvirtual_bind = yes
ldapvirtual_bind_dn = CECL\ldapuser
ldapvirtual_bind_pw = password
ldapvirtual_query_filter = (sAMAccountName=%u)
ldapvirtual_result_attribute = sAMAccountName
ldapvirtual_version = 3
ldapvirtual_chase_referrals = yes
ldapvirtual_result_format=%s/
#SASL
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
在AD的環境中有的帳號會自動於/var/vmail中建立郵件資料夾
當然，這跟搜尋的路徑有關係，請注意
請自行編輯canonical、virtual、senderaccess及clientaccess這四個檔案並產生需要之db檔
若要在加上什麼奇奇怪怪的過濾及檢查規則請自行處理
PS.請注意postfix的Client-Detection Rules及其SMTP Rules到底是檢查郵件表頭的那一個部分，要不然就白做工嘍(指我自己= =")
編輯/etc/rc..conf
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
編輯/etc/periodic.conf
daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"
Dovecotdovecot.conf
auth_debug_passwords=yes
protocols = pop3 imap
auth_username_format = %Lu
disable_plaintext_auth = no
ssl = no
mail_location = maildir:/var/vmail/%n
first_valid_uid = 1002
last_valid_uid = 1002
first_valid_gid = 1002
last_valid_gid = 1002
mail_uid = 1002
mail_gid = 1002
log_path = /var/log/dovecot.log
valid_chroot_dirs = /var/vmail
protocol pop3 {
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
auth default {
mechanisms = plain login
passdb ldap {
args = /usr/local/etc/dovecot-ldap.conf
}
userdb ldap {
args = /usr/local/etc/dovecot-ldap.conf
}
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
}
Dovecot-ldap.conf
hosts = 主機IP
dn = CN=ldapuser,OU=TPE,DC=cecl,DC=corp
dnpass = password
auth_bind = yes
auth_bind_userdn = CECL\%u
ldap_version = 3
base = ou=TPE, dc=cecl, dc=corp
user_attrs = .., homeDirectory=home=/var/vmail/%n
scope = subtree
deref = never
default_pass_scheme = CRYPT
user_filter = (&(ObjectClass=person)(sAMAccountName=%u))
pass_filter = (&(ObjectClass=person)(sAMAccountName=%u))
於dovecot.log檔中可看到Client透過POP3、IMAP認證是否OK
請自行測試
Roundcube請先於MySQL建立所需的資料庫及帳號權限
安裝的方式為installer目錄
基本設定的部分於安裝時即會產生，請自行建立main.inc.php及db.inc.php這兩個檔案，並視需求修改
這邊addressbook採用AD的方式抓取
config/main.inc.php
---IMAP---
$rcmail_config['default_host'] = 'IMAP主機IP';
---SMTP---
$rcmail_config['smtp_server'] = 'SMTP主機IP';
$rcmail_config['smtp_user'] = '%u'; 採SASL認證授權
$rcmail_config['smtp_pass'] = '%p'; 採SASL認證授權
---SYSTEM---
$rcmail_config['enable_installer'] = false;
$rcmail_config['mail_domain'] = '%d'; 自動帶出domain位址
---USER INTERFACE---
$rcmail_config['message_sort_col'] = 'date';
$rcmail_config['language'] = 'zh_TW';
$rcmail_config['create_default_folders'] = true; 自動建立預設資料夾
---ADDRESSBOOK SETTINGS---
$rcmail_config['address_book_type'] = 'ldap';
$rcmail_config['ldap_public'] ['通訊錄名稱'] = array(
'name' => '通訊錄名稱',
'hosts' => array('GC主機IP'),
'port' => 3268,
'use_tls'=> false,
'user_specific' => true,
'base_dn'=> 'OU=TPE,DC=CECL,DC=CORP',
'bind_dn' => 'CECL\ldapuser',
'bind_pass' => 'password',
'writable'=> false,
'search_fields' => array('mail', 'cn'),
'name_field' => 'cn',
'firstname_field' => 'givenName',
'surname_field' => 'sn',
'email_field' => 'mail',
'scope' => 'sub',
'filter' => '(&(mail=*)(!(mail=TRUE)))' ,
'sort' => 'cn',
'fuzzy_search' => TRUE);
有出現任何問題請設定main.inc.php裡的log項目查看相關問題所在
於/etc/rc.conf加入
postfix_enable="YES"
dovecot_enable="YES"
apache_enable="YES"
mysql_enable="YES"
下台一鞠躬
參考資料
http://blog.al-shami.net/index.php/freebsd-postfix-dovecot-and-active-directory/http://www.chrispont.co.uk/2011/02/roundcube-mail-configuring-ldap-with-windows-ad/
文章有任何錯誤的地方會再修正！謝謝！
顯示文章
