Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Unix system where user accounts only exist in LDAP. I'm using libnss-ldapd with nscd to do this and it works quite well. Postfix delivers mail as expected under normal circumstances.

However, in the event that the LDAP server is down and the user map is not fully cached in nscd, users appear not to exist (i.e. getent passwd username returns no results) therefore Postfix's local(8) hard bounces emails with a "unknown user" error. This is very bad.

The current configuration includes:

smtpd_smtpd_reject_unlisted_recipient = yes
local_recipient_maps = $alias_maps, ldap:/etc/postfix/ldap-passwd.cf
mailbox_transport_maps = ldap:/etc/postfix/ldap-passwd.cf

Mail coming in over SMTP correctly tempfails when the LDAP service is not available. However, mail originating on this host (e.g. using mail(1)) does not.

Apr 25 15:25:33 testmail postfix/local[5972]: warning: dict_ldap_lookup: Search error -1: Can't contact LDAP server
Apr 25 15:25:33 testmail postfix/local[5972]: 29B4847DB: to=<ENVELOPE_TO_ADDRESS>, orig_to=<ENVELOPE_FROM_ADDRESS>, relay=local, delay=0.12, delays=0.01/0/0/0.11, dsn=5.1.1, status=bounced (unknown user: "ENVELOPE_TO_ADDRESS_LOCALPART")

I am fairly certain that the map is configured correctly because everything works if the LDAP service is available, including the case where NSS is unable to see the LDAP map because nslcd is stopped. Leaving mailbox_transport_maps as default (empty) produces the same results except without the LDAP connection error. There is no improvement if proxymap(8) is used.

How do I make Postfix defer (instead of reject) incoming mail when LDAP is down?


This question was edited significantly since it was first asked. The original question asked how to make smtpd(8) tempfail when LDAP is not available; it turns out that it was already doing so. The real problem was later in the delivery process.


Possibly related:

share|improve this question
add comment

1 Answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.