On Wed, Oct 07, 2009 at 12:57:21AM -0400, Timo Sirainen wrote:
Ccing mailing list, since I'm not all-knowing..
On Oct 7, 2009, at 12:49 AM, Trever L. Adams wrote:
Timo Sirainen wrote:
On Oct 7, 2009, at 12:36 AM, Trever L. Adams wrote:
- I have seen how to configure for LDAP and Kerberos. AD uses both together. All user information is in AD/LDAP and authentication is AD/Kerberos. How can I configure Dovecot to use both appropriately? You could forget about the Kerberos part and just use AD as an LDAP server. I really want to use kerberos/SPNEGO everywhere I can for various reasons. The LDAP would be for the configuration.
Do you actually want the IMAP/POP3 clients to use Kerberos? For
plaintext auth I don't see any benefit in Dovecot using Kerberos
rather than LDAP (and it doesn't support that, except via pam_kerberos
or whatever I guess). But for clients to use Kerberos (GSSAPI) and
authenticate against AD while Dovecot is in the middle... I've no
idea. I guess that's possible somehow.
There was a thread a month or so ago on how to do GSSAPI with AD and dovecot kerberos. It works great, and I highly recommend it for AD sites. Check the archives, it isn't really too hard.
The problem with LDAP is you have to use SSL ldap for security. The overhead is much higher than using native kerberos or samba pam modules. There is also an obnoxios setup procedure on the AD side to get a LDAP SSL cert installed and serious issues with failover to backup domain controllers. For plain text password auth on AD sites, samba's pam_winbind is probably the best choice. Secure, easy to setup and pretty fast.
If you have an AD server I also *highly* recommend the dovcot winbind NTLM method. Almost every client in the world will do some level of NTLM hashing and it reduces the risk from plain password exposure.
No, I will be using the new Samba IDMAP stuff that hashes all the
parts of the windows ID to a 32 bit UID. Anyway to do to this, or will I
need to find another solution (not for mailing, but for directory
creation)?There's no great way to do this.. A couple of kludgy ways. Like chmod
01777 /var/mail. Or override mail_executable setting to a script that
still runs as root and can create the directory with proper
permissions. http://wiki.dovecot.org/PostLoginScripting
Can dovecot use pam_mkhomedir?
Jason