I've configured dovecot to authenticate against a Fedora Directory Server. The mail server on which dovecot is installed has the nss_ldap and pam_ldap packages installed, and /etc/dovecot.conf has the following two lines:

auth_userdb = ldap /etc/dovecot-ldap.conf auth_passdb = pam

In other words, I want dovecot to use LDAP to access the user database, but PAM for authentication. This part is working, since users authenticate and get their mails correctly through dovecot.

/etc/dovecot-ldap.conf contains the following:

hosts = 192.168.0.2 ldap_version = 3 base = ou=People, dc=duraflex, dc=com, dc=sv deref = never scope = subtree user_attrs = uid,homeDirectory,,,uidNumber,gidNumber user_filter = (&(objectClass=posixAccount)(uid=%u))

I haven't specified a dn or dnpass, since all I need is that dovecot perform an anonymous query for the uid, homeDirectory, uidNumber and gidNumber fields of its users, which are publically viewable. However, my FDS server's access log has entries like these:

conn=3266227 fd=138 slot=138 connection from 192.168.0.100 to 192.168.0.2 conn=3266227 op=0 BIND dn="" method=128 version=3 conn=3266227 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" conn=3266227 op=1 SRCH base="ou=People,dc=duraflex,dc=com,dc=sv" scope=1 filter="(&(objectClass=posixAccount)(uid=dovecot))" attrs=ALL conn=3266227 op=1 RESULT err=0 tag=101 nentries=0 etime=0 conn=3266227 op=2 SRCH base="ou=Groups,dc=duraflex,dc=com,dc=sv" scope=1 filter="(&(objectClass=posixGroup)(memberUid=dovecot))" attrs="gidNumber" conn=3266227 op=2 RESULT err=0 tag=101 nentries=0 etime=0 conn=3266227 op=-1 fd=138 closed - B1

Dovecot binds anonimously with an empty dn, then queries FDS for a user and a group called dovecot (which don't exist on the DS), and finds 0 entries.

Is it possible to access the user database through PAM (auth_userdb = pam)? Since I'm running the nss_ldap and pam_ldap modules, it'd really be an LDAP query for users, and a query in /etc/passwd and /etc/group for dovecot (since it's a local user and group on the mail server).

Oscar A. Valdez