0

So I have working mail server which authenticates against active directory. Everything works fine until I try to add a secondary authentication backend..

Server info:

Server OS: CentOS 7.1.1503
Postfix version: 2.10.1
Dovecot version: 2.2.10

At the moment mine configuration looks like this:

Postfix Configuration files:

/etc/postfix/main.cf

virtual_mailbox_base = /homes/vmail/homes 
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users-primary.cf 
virtual_alias_maps = ldap:/etc/postfix/ldap-groups-primary.cf
virtual_uid_maps = static:989 
virtual_gid_maps = static:987

ldap-users-primary.cf

server_host = 192.168.250.200
search_base = cn=Users, dc=domain, dc=local
version = 3
query_filter = (&(objectclass=person)(mail=%s))
result_attribute = samaccountname
result_format = %s/
bind = yes
bind_dn = user@domain.local
bind_pw = password

ldap-groups-primary.cf

server_host = 192.168.250.200
search_base = ou=Email_Groups, dc=domain,dc=local
version = 3
query_filter = (&(objectclass=group)(mail=%s))
leaf_result_attribute = mail
special_result_attribute = member
bind = yes
bind_dn = user@domain.local
bind_pw = password
start_tls = no

Dovecot configuration files:

/etc/dovecot/conf.d/10-auth.conf

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-primary.conf
}

userdb {
driver = static
args = uid=989 gid=987 home=/homes/vmail/homes/%u
}

dovecot-ldap-primary.conf

hosts = 192.168.250.200
base = cn=Users, dc=domain, dc=local
ldap_version = 3
auth_bind = yes
auth_bind_userdn = domain\%u

All the above setup is working fine and doesn't cause any problems. Until I try to add secondary domain controller..

To do that I have created new configuration files: ldap-users-secondary.cf, ldap-groups-secondary.cf, dovecot-ldap-secondary.conf.

The only thing that is different in those files are and IP address of server (it just points to secondary domain controller). If I use those files alone everything works just fine. But if I modify /etc/postfix/main.cf like this:

virtual_mailbox_base = /homes/vmail/homes 
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users-primary.cf, ldap:/etc/postfix/ldap-users-secondary.cf
virtual_alias_maps = ldap:/etc/postfix/ldap-groups-primary.cf, ldap:/etc/postfix/ldap-groups-secondary.cf
virtual_uid_maps = static:989 
virtual_gid_maps = static:987

And /etc/dovecot/conf.d/10-auth.conf

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-primary.conf
}

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-secondary.conf
}

userdb {
driver = static
args = uid=989 gid=987 home=/homes/vmail/homes/%u
}

It just stops working and starts giving out these errors:

NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 451 4.3.0 <user@domain.local>: Temporary lookup failure;

Anyone can help me with this?

  • So this is a secondary controller of the same domain, am I right? So why don't you just put a DNS name instead of IP address? This way you're gonna provide redundancy without introducing another config file. – sam_pan_mariusz Nov 16 '15 at 16:15
  • Yes, you're right... And probably this is going to fix this issue since in this case DNS will take care of which server is getting requests.. Feeling a bit stupid tho that I didn't came up with such a simple solution. Going to test it later to see if it works as it should. – Martynas Smilgevičius Nov 16 '15 at 16:33
  • i'm sorry, but there are arguments against just using dns as a crutch here. the original question is much more interesting. why does postfix not allow multiple ldap sources? at least dovecot allows multiple ldap hosts in a config file. DNS round-robin'ing actually will just hand out the ip of the dead LDAP server 1/number-of-servers of the time. – user145837 Jun 28 '17 at 21:04
0

It turns out that Postfix and Dovecot both allow failover with multiple ldap hosts in the ldap configs. As far as I can tell, though, the configs have to be the same on all the LDAP servers. At least for postfix.

On Postfix, this does NOT work reliably :

virtual_mailbox_maps = ldap:/etc/postfix/ad-users-dc-1.cf, ldap:/etc/postfix/ad-users-dc-2.cf

This does work. In main.cf :

virtual_mailbox_maps = ldap:/etc/postfix/ad-users.cf

... and in the ad-users.cf file :

server_host     = 192.168.44.75,192.168.44.76
server_port     = 389
version         = ...
bind            = ...
start_tls       = ...
bind_dn         = CN=...
bind_pw         = ...
... etc

In Dovecot, this works. In your ldap target config file :

hosts   = 192.168.44.75:389, 192.168.44.76:389
-1

Solution was pretty simple.. Just as @sam_pan_mariusz sugested instead of IP address I've putted DNS name. Runned some testing and everything works as it should.

  • this is more of a bad work-around than a solution. – user145837 Jun 28 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.