Paranoid Penguin - Secure Mail with LDAP and IMAP, Part II

In Part I, I described the role of mail delivery agents (MDAs) as delivering mail to mailboxes. Being an MDA, Cyrus IMAP can deliver mail, but it first must receive that mail from a message transfer agent (MTA). The most popular MTA is Sendmail, but a simpler and more secure option is Wietse Venema's excellent Postfix (www.postfix.org). As Postfix is my MTA of choice, and because it's available either as the default MTA or as an option in most major Linux distributions nowadays, it's the one I explain in detail here.

Does your IMAP server need to reside on your organization's SMTP relay? It can, but it doesn't have to. It may make more sense from the standpoints of security and performance to keep your SMTP relay dedicated to that purpose. You then can have your IMAP server run its own instance of Postfix that receives mail from the dedicated SMTP relay rather than directly from other networks' MTAs. In either case, we assume the MTA from which IMAP receives its mail is running on the same host as Cyrus IMAP.

Three files need to be edited in order to configure Postfix to transfer mail to Cyrus. The first file is /etc/postfix/main.cf, in which we need to add or uncomment this line:

mailbox_transport = cyrus

The second file we need to edit is /etc/postfix/master.cf, in which we need to add or uncomment these two lines:

cyrus     unix  -       n       n       -       -       pipe
user=cyrus argv=/usr/libexec/cyrus/deliver -r ${sender} ${user}

Actually, the second line may differ on your system; the syntax of Cyrus' deliver program has changed over the years. If you installed both Cyrus IMAP and Postfix from your Linux distribution's current CDs or download site, the included /etc/postfix/master.cf file should work without tweaking. If you installed either Cyrus IMAP or Postfix from source code, however, you may need to do some tweaking and Googling to get the second line exactly right. One key piece of the second line is the path in argv=/usr/libexec/cyrus/deliver, which must point to your local system's Cyrus deliver command.

The third and final Postfix file to edit is /etc/aliases; you may keep yours in /etc/postfix/aliases. Unless you're using LDAP for alias lookups—a process too involved for this article, but which I describe in the Sidebar—you need to have at least one entry in aliases for each Cyrus mailbox, plus any aliases to those mailboxes you need. For our example user Bubba, /etc/aliases needs the line:

bubba:    bubba

Simple enough, right? We omit the user. prefix; Cyrus mailboxes are referred to by user name. If your Cyrus (LDAP) user names correspond to local system user names, you don't need aliases entries for those users. But part of Cyrus' attraction lies in its not requiring users to have shell accounts.

If Bubba is our organization's marketing analyst, we also can add the line:

marketing_weasel: bubba

After you edit your aliases file, don't forget to use the postalias command to generate a new alias database:

bash-$> postalias hash:/etc/aliases