Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to migrate our linux system user based post system to virtual users.

I have

  • sendmail with procmail delivery
  • dovecot
  • system users with different uids
  • roundcube web interface

Sendmail handles all mail delivery to user mailboxes, dovecot handles pop3 and imap interraction with users, everything is working like a charm

Now we start to implement active directory globally and i want to refuse from linux system email users prior to ldap virutal users.

I enabled sendmail ldap_routing

define(`confLDAP_DEFAULT_SPEC', `-h "" -b "ou=portal,dc=univ,dc=priv" -d "cn=portal admin,ou=portal,dc=univ,dc=priv" -MLDAP_AUTH_SIMPLE -P/etc/mail/ldap_pass')dnl


FEATURE(`ldap_routing', `null', `ldap -1 -T -v sAMAccountName -k (&(|(objectclass=user)(objectclass=group))(|(mail=%0)(proxyAddresses=smtp:%0)))',`passthru')dnl

created simple alias file for ldap users via perl script. File initially looked like this

sAMAccountName1:    vmail
sAMAccountName2:    vmail
sAMAccountNameN:    vmail

enabled dovecot-lda using this howto

Unfortunately sendmail passes real system user name ("vmail" in my case) as -d argument, not sAMAccountName of virtial user with this configuration.

After that i modify my alias file in something like this (inspired by this topic)

sAMAccountName1:    "|/usr/libexec/dovecot/dovecot-lda -d sAMAccountName1"
sAMAccountName2:    "|/usr/libexec/dovecot/dovecot-lda -d sAMAccountName1"
sAMAccountNameN:    "|/usr/libexec/dovecot/dovecot-lda -d sAMAccountName1"

This solution fails because of system right problem i can't solve. Here's log messages

Fatal: setgid(5000(vmail) from userdb lookup) failed with euid=8(mail), gid=12(mail), egid=12(mail): Operation not permitted (This binary should probably be called with process group set to 5000(vmail) instead of 12(mail))

dovecot deliver agent defined in with U=vmail:vmail

Mdovecot,      P=/usr/libexec/dovecot/dovecot-lda,
           S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
           A=/usr/libexec/dovecot/dovecot-lda -d $u

dovecot-lda has same owner and group

-rwxr-x--- 1 vmail vmail 28512 апр.   5  2013 /usr/libexec/dovecot/dovecot-lda

If i use system user mail instead vmail everything starts working fine. But this config seems to me less secure and i want use user vmail with uid > 100 instead of user mail.

So mail delivery fails. I appreciate any help solving this problem.

share|improve this question
  1. Skip reading if you are not determined :-)

  2. Make vmail special to sendmail (no DNS lookups for destination)

  3. Use FEATURE(ldap_routing) to select mailHost not mailRoutingAddress

  4. Use FEATURE(mailertable) to select delivery method (mailer)


    vmail  dovecot:dummy
  5. Do not make dovecot the local mailer - FEATURE(local_procmail,...)

  6. In dovecot mailer definition use xSMTP rules not xL (local) rules

share|improve this answer
So step 2 helps to treat it like a host in mailertable. – Andrzej A. Filip Feb 24 '14 at 18:59
I have existent local users in same domain. Delivery to local users fails if i use 'bounce' in ldap_routing. And sendmail doesn't return "550 User Unknown" error if recipient doesnt't exists in ldap and in local database if i use 'passthru'. How can i solve this issue? – Ilya 'elcamlost' Rassadin Feb 24 '14 at 19:17
And one more issue. I don't store hostMail in Active Directory, is it possible to return some static value from ldap query if mail address was found? – Ilya 'elcamlost' Rassadin Feb 24 '14 at 19:29
1) I suggested redirecting SOME users/addresses to another mailer (dovecot) so standard local mailer would reject mails to non existing users. 2) I can see no easy way but you can use returned "vmail" – Andrzej A. Filip Feb 24 '14 at 20:13
2) i meant syntax. Simple ldap query suggest -v 'some ldap param name' -k 'ldap_filter'. How can i write query, which return simple prefefined string, not value of ldap param specified with -v. – Ilya 'elcamlost' Rassadin Feb 25 '14 at 8:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.