Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ubuntu 10.04.4 LTS
Exim version 4.71
Using Ubuntu split configuration.

I'm trying to set up virtual domains with Exim but all of the howtos I've read have all the mailboxes in a shared location - I'd like them to live in each user's home directory with correct permissions just for that particular user.

The server has five known users so I've set up a specific routing file per user as follows:

/etc/exim4/conf.d/router/360_exim4-bob_vdom_aliases
# http://www.debian-administration.org/articles/302
#
# First we look up in /home/bob/conf/mail/valiases, if we have to do any aliasas,
# based on the virtual domains!
#
vdom_aliases_bob:
      driver = redirect
      allow_defer
      allow_fail
      domains = dsearch;/home/bob/conf/mail/valiases
      data = ${expand:${lookup{$local_part}lsearch*@{/home/bob/conf/mail/valiases/$domain}}}
      retry_use_local_part
      pipe_transport   = address_pipe
      file_transport   = address_file
      user = bob
      group = bob

#
# Then, if there is no local delivery, let's go and look if we have
# a virtual domain defined at /home/bob/conf/mail/virtual
#
vdom_aliases_maildir_bob:
      debug_print = "R: vdom_aliases_maildir for $local_part@$domain"
      driver = redirect
      allow_defer
      allow_fail
      domains = dsearch;/home/bob/conf/mail/virtual
      data = /home/bob/conf/mail/virtual/$domain/$local_part/mail/
      directory_transport = address_directory
      pipe_transport   = address_pipe
      file_transport   = address_file
      user = bob
      group = bob

Note that each route config sets a user/group to that particular user.
User bob has virtual domain mailboxes under /home/bob/conf/mail/virtual/ and routing configs under /home/bob/conf/mail/valiases.

Next; I have a directory /etc/valiases where each domain we allow email for has an empty file for that domain name, eg: /etc/valiases/bobsburgers.com

Then I added domainlist local_domains = @:localhost:dsearch;/etc/valiases/ to /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs which effectively tells exim to allow mails for any domains with a matching filename in that directory.

This server also has authenticated SMTP set up. I've configured my local Thunderbird to use it as my outgoing SMTP server.

If I send an email from Thunderbird to bob@bobsburgers.com it connects to my mail server on port 587 with an authenticated username and password (over TLS) and the mail is correctly routed to bob's virtual mailbox in his home directory.

However; if I send an email from another host (on a different outgoing SMTP server) to bob@bobsburgers.com (ie, this time it will connect to port 25 and be unauthenticated) I see this error in my logs:

failed to open /home/bob/conf/mail/valiases for directory search: Permission denied (euid=XXX egid=XXX)

The euid/egid are for the debian exim user.

My theory is that exim is dropping privileges for unauthenticated emails on port 25 and therefore can't switch to user bob when it processes its routing file.

I'm quite new to Exim and I've put together this solution from reading various different howtos. I realise it's a bit cutting edge (I've not seen anyone else try it this way) but am hopeful it can be made to work.

Thanks, Darren.

Update: I've been looking through the Exim book and found this statement:

When processing an address for verification (as opposed to delivery), you cannot cause the uid and gid to be changed in this way. This is because Exim has normally given up its privilege when accepting incoming SMTP mail. Often, it is possible to set no_verify on drivers that make use of the facility. Otherwise, some other approach to the problem must be found.

I tried adding no_verify to each of my user's routes but that means they are then skipped which then rejects the email as no matching address seems to exist on the system.

I'm beginning to understand why nobody has tried this setup before. It looks like it can't be made to work. :-(

The only possible option I can see is to have some sort of file of allowed addresses stored in an exim readable file (a bit like the /etc/valiases directory I created for matching domains).

share|improve this question
    
So you have real users in virtual domains? Or users also are virtual? –  Kondybas Apr 15 '12 at 20:31
    
So, bob is a real user (account in /etc/passwd) but he can have many mailboxes with POP3 accounts for his friends and family members. –  Darren Greaves Apr 16 '12 at 9:52
    
May be you want something else than you try to build? Why don't you build an usual mail-server with virtual domains/users? That's enough for all and every needs I've ever met. If you want I can provide detailed how-to for exim-dovecot-mysql bundle. –  Kondybas Apr 17 '12 at 10:32
    
I'm trying to build a mail server with virtual domains and users - I'd just rather not have my mailboxes readable by anyone on the machine. Anyway, am testing a solution now - will respond if it works. –  Darren Greaves Apr 17 '12 at 12:07
    
I've move all mailboxes to the dovecot's ownership. Local users have access to their mailboxes via POP/IMAP only. Also, all mailboxes are stored in the /var/mail/%domain/%name, so backuping is much easier now. Also, while dovecot solely have access to the local storage, I have no troubles with ownership nor in exim nor in LDA nor in MUAs. –  Kondybas Apr 18 '12 at 14:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.