Re: [Dovecot] Samba AD and Dovecot
Ccing mailing list, since I'm not all-knowing..
On Oct 7, 2009, at 12:49 AM, Trever L. Adams wrote:
Timo Sirainen wrote:
On Oct 7, 2009, at 12:36 AM, Trever L. Adams wrote:
- I have seen how to configure for LDAP and Kerberos. AD uses both together. All user information is in AD/LDAP and authentication is AD/Kerberos. How can I configure Dovecot to use both appropriately? You could forget about the Kerberos part and just use AD as an LDAP server. I really want to use kerberos/SPNEGO everywhere I can for various reasons. The LDAP would be for the configuration.
Do you actually want the IMAP/POP3 clients to use Kerberos? For
plaintext auth I don't see any benefit in Dovecot using Kerberos
rather than LDAP (and it doesn't support that, except via pam_kerberos
or whatever I guess). But for clients to use Kerberos (GSSAPI) and
authenticate against AD while Dovecot is in the middle... I've no
idea. I guess that's possible somehow.
- For example if I have a directory /var/mail/domain/user. Can I have Dovecot auto create (with proper permissions) the domain/user part? These would be used for maildir. If you're using the same UNIX UID for all users, there's really nothing you need to do. Dovecot tries to create missing directories automatically. No, I will be using the new Samba IDMAP stuff that hashes all the
parts of the windows ID to a 32 bit UID. Anyway to do to this, or will I
need to find another solution (not for mailing, but for directory
creation)?
There's no great way to do this.. A couple of kludgy ways. Like chmod
01777 /var/mail. Or override mail_executable setting to a script that
still runs as root and can create the directory with proper
permissions. http://wiki.dovecot.org/PostLoginScripting
Timo Sirainen wrote:
I really want to use kerberos/SPNEGO everywhere I can for various reasons. The LDAP would be for the configuration. Do you actually want the IMAP/POP3 clients to use Kerberos? For plaintext auth I don't see any benefit in Dovecot using Kerberos rather than LDAP (and it doesn't support that, except via pam_kerberos or whatever I guess). But for clients to use Kerberos (GSSAPI) and authenticate against AD while Dovecot is in the middle... I've no idea. I guess that's possible somehow. You have all of the Kerberos/GSSAPI/SPNEGO stuff done. It is just a matter of can I still have the configuration (for user directories, etc.) done in LDAP?
http://wiki.dovecot.org/Authentication/Mechanisms/Winbind?highlight=%28spneg... for the SNPEG/Kerberos
I am not using this via Plain Text. This is for AD and Kerberos domains. (Yes, I understand that if I want to do straight kerberos, I use http://wiki.dovecot.org/Authentication/Kerberos instead.
There's no great way to do this.. A couple of kludgy ways. Like chmod 01777 /var/mail. Or override mail_executable setting to a script that still runs as root and can create the directory with proper permissions. http://wiki.dovecot.org/PostLoginScripting Alright, I am going to have to find another way for this part. The other
But instead of userdb static, can it be userdb ldap or some such? part (Kerberos and LDAP together), I do need. LDAP for configuration, Kerberos (or NTLM in some cases for SPNEGO) for authentication.
Trever Adams
On Wed, Oct 07, 2009 at 12:57:21AM -0400, Timo Sirainen wrote:
Ccing mailing list, since I'm not all-knowing..
On Oct 7, 2009, at 12:49 AM, Trever L. Adams wrote:
Timo Sirainen wrote:
On Oct 7, 2009, at 12:36 AM, Trever L. Adams wrote:
- I have seen how to configure for LDAP and Kerberos. AD uses both together. All user information is in AD/LDAP and authentication is AD/Kerberos. How can I configure Dovecot to use both appropriately? You could forget about the Kerberos part and just use AD as an LDAP server. I really want to use kerberos/SPNEGO everywhere I can for various reasons. The LDAP would be for the configuration.
Do you actually want the IMAP/POP3 clients to use Kerberos? For
plaintext auth I don't see any benefit in Dovecot using Kerberos
rather than LDAP (and it doesn't support that, except via pam_kerberos
or whatever I guess). But for clients to use Kerberos (GSSAPI) and
authenticate against AD while Dovecot is in the middle... I've no
idea. I guess that's possible somehow.
There was a thread a month or so ago on how to do GSSAPI with AD and dovecot kerberos. It works great, and I highly recommend it for AD sites. Check the archives, it isn't really too hard.
The problem with LDAP is you have to use SSL ldap for security. The overhead is much higher than using native kerberos or samba pam modules. There is also an obnoxios setup procedure on the AD side to get a LDAP SSL cert installed and serious issues with failover to backup domain controllers. For plain text password auth on AD sites, samba's pam_winbind is probably the best choice. Secure, easy to setup and pretty fast.
If you have an AD server I also *highly* recommend the dovcot winbind NTLM method. Almost every client in the world will do some level of NTLM hashing and it reduces the risk from plain password exposure.
No, I will be using the new Samba IDMAP stuff that hashes all the
parts of the windows ID to a 32 bit UID. Anyway to do to this, or will I
need to find another solution (not for mailing, but for directory
creation)?There's no great way to do this.. A couple of kludgy ways. Like chmod
01777 /var/mail. Or override mail_executable setting to a script that
still runs as root and can create the directory with proper
permissions. http://wiki.dovecot.org/PostLoginScripting
Can dovecot use pam_mkhomedir?
Jason
participants (3)
-
Jason Gunthorpe
-
Timo Sirainen
-
Trever L. Adams