我一直在解决这个问题好几天，似乎已经用尽了所有的疑难解答，所以想到我会伸出援助的社区。
没有在邮件基础设施中引入OpenLDAP，Postfix和Dovecot运行良好。 在过去的几天里，Postfix MTAconfiguration了虚拟LDAP设置，但即使Postfix可以读取并且知道这些真实的邮件用户，邮件别名和虚拟域的存在，电子邮件也会显示退回状态。 这里是我的Postfix main.cf中的相关虚拟设置。
注意 ：只有3个虚拟LDAPconfiguration
virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 virtual_minimum_uid = 5000 virtual_mailbox_domains = ldap:/etc/postfix/ldap-virtual-domains.cf virtual_mailbox_maps = ldap:/etc/postfix/ldap-vmailbox.cf virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf virtual_mailbox_limit = 512000000 virtual_mailbox_base = /home/vmail transport_maps = hash:/etc/postfix/transport
这里是每个虚拟LDAP文件的内容。
server_host = ldap://ldap.example.net/ search_base = ou=Domains,dc=example,dc=net version = 3 bind = no query_filter = (&(ObjectClass=dNSDomain)(dc=%s)) result_attribute = dc
server_host = ldap://ldap.example.net/ search_base = ou=Mail,dc=example,dc=net version = 3 bind = no query_filter = (&(objectclass=inetOrgPerson)(mail=%s)) result_attribute = mail
server_host = ldap://ldap.example.net/ search_base = ou=Mail,dc=example,dc=net version = 3 bind = no query_filter = (&(objectclass=inetLocalMailRecipient)(mailLocalAddress=%s)) result_attribute = mail
validationPostfix可以读取和处理所有3个虚拟LDAP文件是否成功
ldap-virtual-domains.cf：
postmap -q example.net ldap:/etc/postfix/ldap-virtual-domains.cf example.net postmap -q example.org ldap:/etc/postfix/ldap-virtual-domains.cf example.org postmap -q example.com ldap:/etc/postfix/ldap-virtual-domains.cf example.com
ldap-vmailbox.cf：
postmap -q [email protected] ldap:/etc/postfix/ldap-vmailbox.cf [email protected] postmap postmap -q [email protected] ldap:/etc/postfix/ldap-vmailbox.cf [email protected] postmap -q [email protected] ldap:/etc/postfix/ldap-vmailbox.cf [email protected]
ldap-aliases.cf：
postmap -q [email protected] ldap:/etc/postfix/ldap-aliases.cf [email protected] postmap postmap -q [email protected] ldap:/etc/postfix/ldap-aliases.cf [email protected]
这是我在邮件日志中看到的：
10月26日16:54:17 example.net postfix / cleanup [2789]：3D26A105CC：info：header主题：testing来自[编辑]的虚拟LDAP; from = [email protected] to = [email protected] proto = ESMTP helo = macbook-air.moon Oct 26 16:54:17 example.net postfix / cleanup [2789]：3D26A105CC：message-id = [email protected] Oct 26 16:54:17 example.net opendkim [11877]：3D26A105CC：[编辑]不是内部的 10月26日16:54:17 example.net opendkim [11877]：3D26A105CC：未validation 10月26日16:54:17 example.net opendkim [11877]：3D26A105CC：没有签名数据 Oct 26 16:54:17 example.net postfix / qmgr [26221]：3D26A105CC：from = [email protected]，size = 571，nrcpt = 1（队列激活） 10月26日16:54:17 example.net postfix / smtpd [2461]：从[删除]断开ehlo = 1邮件= 1 rcpt = 1数据= 1退出= 1命令= 5 Oct 26 16:54:17 example.net postfix / pipe [2791]：3D26A105CC：to = [email protected]，relay = dovecot，delay = 0.12，delay = 0.08 / 0.01 / 0 / 0.02，dsn = 5.1.1 ，状态=退回（用户未知） Oct 26 16:54:17 example.net postfix / cleanup [2789]：55F2B1080A：message-id = [email protected] Oct 26 16:54:17 example.net postfix / qmgr [26221]：55F2B1080A：from =，size = 2460，nrcpt = 1（队列激活） Oct 26 16:54:17 example.net postfix / bounce [2793]：3D26A105CC：发件人未送达通知：55F2B1080A 10月26日16:54:17 example.net postfix / qmgr [26221]：3D26A105CC：删除 Oct 26 16:54:17 example.net postfix / smtp [2794]：55F2B1080A：to = [email protected]，relay = none，delay = 0.02，delay = 0 / 0.01 / 0/0，dsn = 5.4 .4，status = bounced（主机或域名未find名称服务错误名称= macbook-air.moon type = A：找不到主机）
LDAP中存在的有效邮件帐户在日志中显示： Oct 26 16:56:14 example.net postfix/pipe[3592]: 457871080A: [email protected], [email protected], relay=dovecot, delay=0.03, delays=0.01/0/0/0.02, dsn=5.1.1, status=bounced (user unknown)
[email protected]是LDAP中的真实邮件地址，[email protected]是LDAP中的真实别名。 postfix在使用postmap -qvalidation时没有问题。
alias_database = $ alias_maps alias_maps = hash：/ etc / postfix / aliases append_dot_mydomain = no broken_sasl_auth_clients =是 command_directory = / usr / bin compatibility_level = 2 daemon_directory = / usr / lib / postfix / bin data_directory = / var / lib / postfix debug_peer_level = 2 debug_peer_list = 127.0.0.1 debugger_command = PATH = / bin：/ usr / bin：/ usr / local / bin：/ usr / X11R6 / bin ddd $ daemon_directory / $ process_name $ process_id＆sleep 5 header_checks = regexp：/ etc / postfix / header_checks home_mailbox = Maildir / html_directory = no inet_interfaces = all inet_protocols = ipv4 mail_owner =后缀 mail_spool_directory = / var / spool / mail mailbox_command = / usr / lib / dovecot / deliver mailq_path = / usr / bin / mailq manpage_directory = / usr / share / man message_size_limit = 20480000 meta_directory = / etc / postfix milter_default_action =接受 milter_protocol = 2 mydestination = mydomain = example.net myhostname = mail。$ mydomain mynetworks = 127.0.0.0/8 10.8.0.0/24 192.168.128.0/17 [SERVER IP REDACTED] [:: 1] / 128 [2600：3c01 ::] / 64 [fe80 ::] / 64 myorigin = $ mydomain newaliases_path = / usr / bin / newaliases non_smtpd_milters = inet：127.0.0.1：8891 queue_directory = / var / spool / postfix readme_directory = / usr / share / doc / postfix recipient_delimiter = + sample_directory = / etc / postfix / sample sendmail_path = / usr / bin / sendmail setgid_group = postdrop shlib_directory = / usr / lib / postfix smtp_tls_mandatory_protocols =！SSLv2，！SSLv3 smtp_tls_note_starttls_offer =是 smtp_tls_protocols =！SSLv2，！SSLv3 smtp_tls_security_level =可能 smtpd_error_sleep_time = 1s smtpd_hard_error_limit = 20 smtpd_milters = inet：127.0.0.1：8891 smtpd_recipient_restrictions = permit_sasl_authenticated，permit_mynetworks，reject_unauth_destination，check_policy_service inet：mail.example.net：12340 smtpd_sasl_auth_enable =是 smtpd_sasl_authenticated_header =是 smtpd_sasl_local_domain = smtpd_soft_error_limit = 10 smtpd_tls_CAfile = /etc/postfix/ssl/PositiveSSL.ca-bundle smtpd_tls_cert_file = /etc/postfix/ssl/STAR_example_net.crt smtpd_tls_key_file = /etc/postfix/ssl/key.pem smtpd_tls_loglevel = 1 smtpd_tls_mandatory_protocols =！SSLv2，！SSLv3 smtpd_tls_protocols =！SSLv2，！SSLv3 smtpd_tls_received_header =是 smtpd_tls_security_level =可能 smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls =是 tls_random_source = dev：/ dev / urandom transport_maps = hash：/ etc / postfix / transport unknown_local_recipient_reject_code = 550 virtual_alias_maps = ldap：/etc/postfix/ldap-aliases.cf virtual_gid_maps = static：5000 virtual_mailbox_base = / home / vmail virtual_mailbox_domains = ldap：/etc/postfix/ldap-virtual-domains.cf virtual_mailbox_limit = 512000000 virtual_mailbox_maps = ldap：/etc/postfix/ldap-vmailbox.cf virtual_minimum_uid = 5000 virtual_transport = dovecot virtual_uid_maps = static：5000
LDAP用户
看起来我很亲密，但也许另一双眼睛可以提供一些解决这个问题的见解。 任何input，不胜感激。
更新1
我设法通过改变main.cf中的virtual_transport的值来解决status=bounced (user unknown)错误
virtual_transport = dovecot
至
virtual_transport = lmtp:unix:private/dovecot-lmtp
在master.cf我改变了这一行
dovecot unix - nn - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
到这一行
dovecot unix - nn - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient}
我在LDAP中添加了一个名为[email protected]的新用户和一个快速postmap -qcertificatePostfix知道[email protected]，但是我看到这个错误。
Oct 26 23:46:46 example.net dovecot: quota-status([email protected]): Error: User initialization failed: Namespace '': stat(/home/vmail/postmaster/.Maildir) failed: Permission denied (euid=5003() egid=5000(vmail) missing +x perm: /home/vmail, dir owned by 5000:5000 mode=0700) Oct 26 23:46:46 example.net postfix/smtpd[25851]: NOQUEUE: reject: RCPT from[REDACTED]: 450 4.7.1 : Recipient address rejected: Invalid user settings. Refer to server log for more information.; from= to= proto=ESMTP helo=
经过多一点的研究，我开始考虑我的Dovecot LDAPconfiguration，特别是dovecot-ldap.conf.ext
hosts = ldap.example.net auth_bind = no ldap_version = 3 base = ou=Mail,dc=example,dc=net deref = never scope = subtree user_attrs = uidNumber=uid,gidNumber=gid,mailHomeDirectory=home,quotaBytes=quota_rule=*:bytes=%$ user_filter = (&(objectclass=inetOrgPerson)(mail=%u)) pass_attrs = mail=user,userPassword=password pass_filter = (&(objectClass=posixAccount)(uid=%u)) default_pass_scheme = SSHA
我不再在邮件日志中看到user unknown ，但是看到失败的login尝试。 我不知道，但可以从user_attrs或我的dovecot-ldap.conf.ext中的任何其他LDAP属性。
Oct 27 00:01:19 example.net dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=192.168.176.128, lip=192.168.176.128, TLS: Disconnected, session=<w/r1pBAj0YjAqLCA>
更新2
我在OpenLDAP中创build了一个名为Dovecot的pipe理员帐户，并为其提供了read权限
by dn="uid=dovecot,ou=System,dc=example,dc=net" read
Dovecot现在成功读取了userPassword属性。 这里是dovecot-ldap.conf.ext看起来像绑定启用。
hosts = ldap.example.net auth_bind = yes auth_bind_userdn = uid=%u,ou=Mail,dc=example,dc=net dn = uid=dovecot,ou=System,dc=example,dc=net dnpass = password ldap_version = 3 base = ou=Mail,dc=example,dc=net deref = never scope = subtree user_filter = (&(objectclass=inetOrgPerson)(mail=%u)) pass_filter = (&(objectclass=inetOrgPerson)(mail=%u)) default_pass_scheme = SSHA user_attrs = uidNumber=uid,gidNumber=gid,mailHomeDirectory=,quotaBytes=quota_rule=*:bytes=%$ pass_attrs = mail=uid,userPassword=password
尝试login到vmail帐户时，我看到Dovecot无法从userdb中find用户
Oct 27 20:42:47 example.net dovecot: auth: Error: ldap(vmail,192.168.176.128,<8C7h/CEjo5DAqLCA>): user not found from userdb Oct 27 20:42:47 example.net dovecot: imap: Error: Authenticated user not found from userdb, auth lookup id=4111597569 (client-pid=26724 client-id=1) Oct 27 20:42:47 example.net dovecot: imap-login: Internal login failure (pid=26724 id=1) (internal failure, 1 successful auths): user=<vmail>, method=PLAIN, rip=192.168.176.128, lip=192.168.176.128, mpid=26726, secured, session=<8C7h/CEjo5DAqLCA>
如果我将user_filter属性更改为下面的行，我可以成功login。
user_filter = (&(objectClass=posixAccount)(uid=%u))
但随后消息又开始反弹了。
Oct 27 20:46:09 example.net postfix/smtp[27702]: ECA4F10848: to=<[email protected]>, relay=none, delay=0.16, delays=0.01/0.01/0.14/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=macbook-air.moon type=A: Host not found)
Oct 27 20:46:08 example.net postfix/lmtp[27698]: E0994102FA: to=<[email protected]>, relay=example.net[private/dovecot-lmtp], delay=0.06, delays=0.05/0.01/0/0, dsn=5.1.1, status=bounced (host mail.example.net[private/dovecot-lmtp] said: 550 5.1.1 <[email protected]> User doesn't exist: [email protected] (in reply to RCPT TO command))
在这一点上，我认为问题可能是用户和通过filter，但我真的不知道了。 这是dovecot -n和Dovecot的LDAP部分的当前Dovecotconfiguration： http ： //ix.io/lEE
我希望这可以提供什么可能丢失或搞砸，以便用户login和发送/接收邮件成功的线索。
pass_attrs = mail=user,userPassword=password
可能是错的。 这意味着“使用邮件作为用户名ldap属性名称和userPassword作为密码属性名称”。
我相信它应该是：
pass_attrs = mail=uid,userPassword=password
您可以通过查看OpenLDAP日志来检查它。
我也怀疑：
user_attrs = mailHomeDirectory=home
因为存在语义冲突。 Unix home目录使用LDAP属性home ，但现在它被用作maildir位置。 你可以仔细检查一下吗？
这已经解决了。 在dovecot-ldap.conf.ext我更改了以下filter。
user_attrs = user_filter = (&(objectclass=inetOrgPerson)(uid=%n)(mailEnabled=TRUE))
pass_attrs = mail=user,userPassword=password pass_filter = (&(objectclass=inetOrgPerson)(uid=%n))
hosts = ldap.example.net auth_bind = yes dn = uid=dovecot,ou=System,dc=example,dc=net dnpass = PASS ldap_version = 3 base = ou=Mail,dc=example,dc=net deref = never scope = subtree default_pass_scheme = SSHA user_attrs = user_filter = (&(objectclass=inetOrgPerson)(uid=%n)) pass_attrs = mail=user,userPassword=password pass_filter = (&(objectclass=inetOrgPerson)(uid=%n))
我还必须更新mail_location中的mail_location
mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/
最终权限检查
/home/vmail/*具有适当的用户/组权限，如vmail:vmail Dovecot本地交付代理现在可以处理电子邮件并将其存储在/home/vmail/user@domain目录中。