eGW on Virtual hosting w/ Cyrus and Postfix

Oscar_van_Eijk-3 2009-06-09 14:43:00 UTC #1

Hi all,

I’m running into all kinda troubles trying to setup a virtual hosting
environment with eGW.
Main goal is to have single login for eGW and Cyrus. This failed with
Dovecot, but Ralf suggested Cyrus, which also requires LDAP to work.
Problem is, I can’t find any good documentation on setting up such
environment using Cyrus, LDAP, SASL and (?) PAM (in fact I’m completely
new to Cyrus which doesn’t really help…)

Does anybody have experience in this and is willing to give me some
useful pointers?

TIA,
Oscar

Ralf_Becker_6 2009-06-09 15:20:26 UTC #2

Hi Oscar,

I have several systems with a that setup, but none I can give you access
too

Here’s a rough description, maybe you can document that in our wiki.

you need to get EGw working with LDAP, as described in phpgwapi/doc/ldap.

You can either choose the recommended qmailuser.schema from
emailadmin/doc (you have to comment out mailReplyText on most distros)
or you use the intOrgPerson schema (is more limited and not further
described).

It’s important for a multidomain setup that EGroupware domain names
match the real domain names, which are as o=domain.com,dc=something in LDAP.

setup SASL to use LDAP via /etc/saslauthd.conf:

ldap_servers: ldap://127.0.0.1/
ldap_search_base: dc=egroupware
ldap_auth_method: bind
ldap_filter: (&(mail=%u@%d)(accountStatus=active))
ldap_debug: 1
ldap_version: 3

configure postfix to use LDAP via /etc/postfix/main.cf:

virtual_transport = lmtp:unix:/var/lib/imap/socket/lmtp
virtual_mailbox_domains = ldap:/etc/postfix/virtual_mailbox_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap-aliases.cf
virtual_alias_maps = ldap:/etc/postfix/ldap-aliases-forward-also.cf

/etc/postfix/virtual_mailbox_domains.cf:

server_host = localhost
server_port = 389
search_base = dc=egroupware
query_filter = (o=%s)
result_attribute = o
bind = no
version = 3

/etc/postfix/ldap-aliases.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mail
bind = no
version = 3

/etc/postfix/ldap-aliases-forward-also.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mailForwardingAddress,mail
bind = no
version = 3

configure your egroupware instances with emailadmin to use Postfix
with qmailuser schema and Cyrus.

That’s all

Ralf

Oscar van Eijk schrieb:

Hi all,

I’m running into all kinda troubles trying to setup a virtual hosting
environment with eGW.
Main goal is to have single login for eGW and Cyrus. This failed with
Dovecot, but Ralf suggested Cyrus, which also requires LDAP to work.
Problem is, I can’t find any good documentation on setting up such
environment using Cyrus, LDAP, SASL and (?) PAM (in fact I’m completely
new to Cyrus which doesn’t really help…)

Does anybody have experience in this and is willing to give me some
useful pointers?

TIA,
Oscar

Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Ralf_Becker_6 2009-06-09 17:20:13 UTC #3

Hi Oscar,

SASL is using PAM.

That’s my /etc/sysconfig/saslauthd under CentOS5:

Directory in which to place saslauthd’s listening socket, pid file, and so # on. This directory must already exist.

SOCKETDIR=/var/run/saslauthd

Mechanism to use when checking passwords. Run “saslauthd -v” to get a

list # of which mechanism your installation was compiled to use.
MECH=pam

Additional flags to pass to saslauthd on the command line. See

saslauthd(8) # for the list of accepted flags.
FLAGS=

And /etc/pam.d/imap:
#%PAM-1.0 #auth required pam_stack.so service=system-auth #account required pam_stack.so service=system-auth
auth required pam_ldap.so
account required pam_ldap.so

same is also in /etc/pam.d/sieve and /etc/pam.d/smtp

Ralf

Oscar van Eijk schrieb:

Hi Ralf,

Thanks for your reply!

So far my attempts are documented, I’ll publish it on Wiki when done.
Although I might still go for the Dovecot solution — apart from the
single logon that setup has been working. If I’m able to make eGW
Dovecot aware I’ll implement and document that one.

My main problem seems to be with Cyrus; AFAIK I’ve bound it all together
using SASL, but when starting ‘cyradm’ I keep getting “perl: No worthy
mechs found” in auth.log.
I’ve set sasl_mech_list to PLAIN (tried PLAIN LOGIN as well) and
sasl_pwcheck_method to saslauthd. I created a cyrus user in sasldb (same
user/passw are in the password file).
In /etc/default/saslautdh, MECHANISMS has value “ldap”.

Is Cyrus looking in the wrong direction or do I need to specify the user
somewhere else?

Btw. the server is an Ubunto 8.04.

Grtz,
Oscar

Hi Oscar,

I have several systems with a that setup, but none I can give you access
too

Here’s a rough description, maybe you can document that in our wiki.

you need to get EGw working with LDAP, as described in phpgwapi/doc/ldap.

You can either choose the recommended qmailuser.schema from
emailadmin/doc (you have to comment out mailReplyText on most distros)
or you use the intOrgPerson schema (is more limited and not further
described).

It’s important for a multidomain setup that EGroupware domain names
match the real domain names, which are as o=domain.com,dc=something in LDAP.

setup SASL to use LDAP via /etc/saslauthd.conf:

ldap_servers: ldap://127.0.0.1/
ldap_search_base: dc=egroupware
ldap_auth_method: bind
ldap_filter: (&(mail=%u@%d)(accountStatus=active))
ldap_debug: 1
ldap_version: 3

configure postfix to use LDAP via /etc/postfix/main.cf:

virtual_transport = lmtp:unix:/var/lib/imap/socket/lmtp
virtual_mailbox_domains = ldap:/etc/postfix/virtual_mailbox_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap-aliases.cf
virtual_alias_maps = ldap:/etc/postfix/ldap-aliases-forward-also.cf

/etc/postfix/virtual_mailbox_domains.cf:

server_host = localhost
server_port = 389
search_base = dc=egroupware
query_filter = (o=%s)
result_attribute = o
bind = no
version = 3

/etc/postfix/ldap-aliases.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mail
bind = no
version = 3

/etc/postfix/ldap-aliases-forward-also.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mailForwardingAddress,mail
bind = no
version = 3

configure your egroupware instances with emailadmin to use Postfix
with qmailuser schema and Cyrus.

That’s all

Ralf

Oscar van Eijk schrieb:

Hi all,

I’m running into all kinda troubles trying to setup a virtual hosting
environment with eGW.
Main goal is to have single login for eGW and Cyrus. This failed with
Dovecot, but Ralf suggested Cyrus, which also requires LDAP to work.
Problem is, I can’t find any good documentation on setting up such
environment using Cyrus, LDAP, SASL and (?) PAM (in fact I’m completely
new to Cyrus which doesn’t really help…)

Does anybody have experience in this and is willing to give me some
useful pointers?

TIA,
Oscar

Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net mailto:eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Oscar van Eijk

Oveas Functionality Provider
Zwaardenburg 63 – 3437 RJ Nieuwegein
T: +31(0)30 - 889 7812 – F: +31(0)30 - 889 9117
http://oveas.com – mailto:info@oveas.com

Oveas Functionality Provider http://oveas.com

–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Oscar_van_Eijk-3 2009-06-12 20:51:09 UTC #4

I got it working; turned out to be a typo in th PAM filter in
ldap.conf
Documentation follows Thanks for your input Ralf!

Hi Oscar,

SASL is using PAM.

That’s my /etc/sysconfig/saslauthd under CentOS5:

Directory in which to place saslauthd’s listening socket, pid file, and so

on. This directory must already exist.

SOCKETDIR=/var/run/saslauthd

Mechanism to use when checking passwords. Run “saslauthd -v” to get a

list

of which mechanism your installation was compiled to use.

MECH=pam

Additional flags to pass to saslauthd on the command line. See

saslauthd(8)

for the list of accepted flags.

FLAGS=

And /etc/pam.d/imap:

#%PAM-1.0
#auth required pam_stack.so service=system-auth
#account required pam_stack.so service=system-auth
auth required pam_ldap.so
account required pam_ldap.so

same is also in /etc/pam.d/sieve and /etc/pam.d/smtp

Ralf

Oscar van Eijk schrieb:

Hi Ralf,

Thanks for your reply!

So far my attempts are documented, I’ll publish it on Wiki when done.
Although I might still go for the Dovecot solution — apart from the
single logon that setup has been working. If I’m able to make eGW
Dovecot aware I’ll implement and document that one.

My main problem seems to be with Cyrus; AFAIK I’ve bound it all together
using SASL, but when starting ‘cyradm’ I keep getting “perl: No worthy
mechs found” in auth.log.
I’ve set sasl_mech_list to PLAIN (tried PLAIN LOGIN as well) and
sasl_pwcheck_method to saslauthd. I created a cyrus user in sasldb (same
user/passw are in the password file).
In /etc/default/saslautdh, MECHANISMS has value “ldap”.

Is Cyrus looking in the wrong direction or do I need to specify the user
somewhere else?

Btw. the server is an Ubunto 8.04.

Grtz,
Oscar

Hi Oscar,

I have several systems with a that setup, but none I can give you access
too

Here’s a rough description, maybe you can document that in our wiki.

you need to get EGw working with LDAP, as described in phpgwapi/doc/ldap.

You can either choose the recommended qmailuser.schema from
emailadmin/doc (you have to comment out mailReplyText on most distros)
or you use the intOrgPerson schema (is more limited and not further
described).

It’s important for a multidomain setup that EGroupware domain names
match the real domain names, which are as o=domain.com,dc=something in LDAP.

setup SASL to use LDAP via /etc/saslauthd.conf:

ldap_servers: ldap://127.0.0.1/
ldap_search_base: dc=egroupware
ldap_auth_method: bind
ldap_filter: (&(mail=%u@%d)(accountStatus=active))
ldap_debug: 1
ldap_version: 3

configure postfix to use LDAP via /etc/postfix/main.cf:

virtual_transport = lmtp:unix:/var/lib/imap/socket/lmtp
virtual_mailbox_domains = ldap:/etc/postfix/virtual_mailbox_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap-aliases.cf
virtual_alias_maps = ldap:/etc/postfix/ldap-aliases-forward-also.cf

/etc/postfix/virtual_mailbox_domains.cf:

server_host = localhost
server_port = 389
search_base = dc=egroupware
query_filter = (o=%s)
result_attribute = o
bind = no
version = 3

/etc/postfix/ldap-aliases.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mail
bind = no
version = 3

/etc/postfix/ldap-aliases-forward-also.cf:

server_host = localhost
server_port = 389
search_base = o=%d,dc=egroupware
query_filter =
(&(accountStatus=active)(|(mail=%s)(mailAlternateAddress=%s)))
result_attribute = mailForwardingAddress,mail
bind = no
version = 3

configure your egroupware instances with emailadmin to use Postfix
with qmailuser schema and Cyrus.

That’s all

Ralf

Oscar van Eijk schrieb:

Hi all,

I’m running into all kinda troubles trying to setup a virtual hosting
environment with eGW.
Main goal is to have single login for eGW and Cyrus. This failed with
Dovecot, but Ralf suggested Cyrus, which also requires LDAP to work.
Problem is, I can’t find any good documentation on setting up such
environment using Cyrus, LDAP, SASL and (?) PAM (in fact I’m completely
new to Cyrus which doesn’t really help…)

Does anybody have experience in this and is willing to give me some
useful pointers?

TIA,
Oscar

Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net mailto:eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Oscar van Eijk

Oveas Functionality Provider
Zwaardenburg 63 – 3437 RJ Nieuwegein
T: +31(0)30 - 889 7812 – F: +31(0)30 - 889 9117
http://oveas.com – mailto:info@oveas.com

Oveas Functionality Provider http://oveas.com

Oscar van Eijk

Oveas Functionality Provider
Zwaardenburg 63 – 3437 RJ Nieuwegein
T: +31(0)30 - 889 7812 – F: +31(0)30 - 889 9117
http://oveas.com – mailto:info@oveas.com

Oveas Functionality Provider