[Dovecot] dovecot 1.2 and quota_rules from AD
Hi
I´m trying to figure how to proper configure postfix+dovecot to enforce quotas from a AD (ldap). I´m using the following configuration:
dovecot.conf:
... protocol lda { mail_plugins = quota .. }
auth default {
passdb ldap { args = /etc/dovecot/dovecot-ldap-pass.conf } userdb ldap { args = /etc/dovecot/dovecot-ldap.conf } ... }
plugin { quota = maildir:User quota #quota_rule = *:storage=2M // tried with and without this line }
dovecot-ldap.conf: ... user_attrs = sAMAccountName=mail=maildir:/var/vmail/%$/Maildir, quotaMail=quota_rule=*:storage=%$ user_filter = (&(objectClass=person)(|(mail=%u)(sAMAccountName=%u)))
pass_attrs = sAMAaccountName=user,userPassword=password pass_filter = (&(objectClass=person)(sAMAaccountName=%u))
Quotas are set by the quotaMail in AD. And here is the log:
Aug 9 11:41:37 vm29 dovecot: auth(default): master in: USER#0111#011testeti@teste.mydomain#011service=deliver Aug 9 11:41:37 vm29 dovecot: auth(default): ldap(testeti@teste.mydomain): user search: base=dc=mydomain scope=subtree filter=(&(objectClass=person)(| (mail=testeti@teste.mydomain)(sAMAccountName=testeti@teste.mydomain))) fields=sAMAccountName,quotaMail Aug 9 11:41:37 vm29 dovecot: auth(default): ldap(testeti@teste.mydomain): result: sAMAccountName(mail=maildir:/var/vmail/%$/Maildir)=maildir:/var/vmail/testeti/Maildir Aug 9 11:41:37 vm29 dovecot: auth(default): master out: USER#0111#011testeti@teste.mydomain#011mail=maildir:/var/vmail/testeti/Maildir Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): auth input: mail=maildir:/var/vmail/testeti/Maildir Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): Quota root: name=User quota backend=maildir args= Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): maildir: data=/var/vmail/testeti/Maildir Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): maildir++: root=/var/vmail/testeti/Maildir, index=, control=, inbox=/var/vmail/testeti/Maildir Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): Namespace : Using permissions from /var/vmail/testeti/Maildir: mode=0700 gid=-1 Aug 9 11:41:37 vm29 dovecot: deliver(testeti@teste.mydomain): msgid=201008091142.53089.lyra@pop-pr.rnp.br: saved mail to INBOX
There´s no quota_rule in logs... uncomenting the line quota_rule = *:storage=2M I got quota, bu only this static one, and not per-user. What I´m doing wrong?
Btw... with static configuration the maildirsize file is created, but without static configuration it´s not (well.. no quota_rule...).
thanks in advance,
-- Christian Lyra POP-PR - RNP
On Mon, 2010-08-09 at 11:49 -0300, Christian Lyra wrote:
plugin { quota = maildir:User quota #quota_rule = *:storage=2M // tried with and without this line
If you always override it in userdb, it doesn't matter if you have it or not.
user_attrs = sAMAccountName=mail=maildir:/var/vmail/%$/Maildir,
Not related to your problem, but I'd change that to:
user_attrs = sAMAccountName=home=/var/vmail/%$
and then in dovecot.conf use: mail_location = maildir:~/Maildir
because http://wiki.dovecot.org/VirtualUsers/Home
quotaMail=quota_rule=*:storage=%$ user_filter = (&(objectClass=person)(|(mail=%u)(sAMAccountName=%u)))
Looks ok.
(mail=testeti@teste.mydomain)(sAMAccountName=testeti@teste.mydomain))) fields=sAMAccountName,quotaMail
Dovecot requests sAMAccountName and quotaMail fields from LDAP.
Aug 9 11:41:37 vm29 dovecot: auth(default): ldap(testeti@teste.mydomain): result: sAMAccountName(mail=maildir:/var/vmail/%$/Maildir)=maildir:/var/vmail/testeti/Maildir
But LDAP returns only sAMAccountName, not quotaMail field. So either that field doesn't exist in LDAP or it doesn't exist for this user or the DN you use to access LDAP doesn't have permissions to it. Or something else, in any case the problem isn't with Dovecot configuration.
Hi,
I have some news about my problem with quotaMail field.
ldap(testeti@teste.mydomain): result: sAMAccountName(mail=maildir:/var/vmail/%$/Maildir)=maildir:/var/vmail/testeti/Maildir
But LDAP returns only sAMAccountName, not quotaMail field. So either that field doesn't exist in LDAP or it doesn't exist for this user or the DN you use to access LDAP doesn't have permissions to it. Or something else, in any case the problem isn't with Dovecot configuration.
The problem is with the "something" else. I´m using port 3268 to connect to AD. I used ldapsearch to reproduce the problem, and found that if I use port 389 the quotaMail shows up, but using port 3268 it didnt. I guess that there was a good reason to use port 3268 instead of 389, or not? Should I just change ports or try to fix AD (i mean, persuade the AD admin to fix it)?
-- Christian Lyra PoP-PR/RNP
On Thu, 2010-08-19 at 14:58 -0300, Christian Lyra wrote:
The problem is with the "something" else. I´m using port 3268 to connect to AD. I used ldapsearch to reproduce the problem, and found that if I use port 389 the quotaMail shows up, but using port 3268 it didnt. I guess that there was a good reason to use port 3268 instead of 389, or not? Should I just change ports or try to fix AD (i mean, persuade the AD admin to fix it)?
The reason why 3268 port was suggested was because some people said that 389 didn't work. I updated the wiki LDAP page now to say:
When connecting to AD, you may need to use port 3268. Then again, not all LDAP fields are available in port 3268. Use whatever works.
participants (2)
-
Christian Lyra
-
Timo Sirainen