Paranoid Penguin - Secure Mail with LDAP and IMAP, Part II

An IMAP mail server with an LDAP directory makes things simple, secure and easy for the user. Now Mick explains the tricky parts to make you the company e-mail guru.
Configuring Postfix to Deliver to Cyrus IMAP

In Part I, I described the role of mail delivery agents (MDAs) as delivering mail to mailboxes. Being an MDA, Cyrus IMAP can deliver mail, but it first must receive that mail from a message transfer agent (MTA). The most popular MTA is Sendmail, but a simpler and more secure option is Wietse Venema's excellent Postfix (www.postfix.org). As Postfix is my MTA of choice, and because it's available either as the default MTA or as an option in most major Linux distributions nowadays, it's the one I explain in detail here.

Does your IMAP server need to reside on your organization's SMTP relay? It can, but it doesn't have to. It may make more sense from the standpoints of security and performance to keep your SMTP relay dedicated to that purpose. You then can have your IMAP server run its own instance of Postfix that receives mail from the dedicated SMTP relay rather than directly from other networks' MTAs. In either case, we assume the MTA from which IMAP receives its mail is running on the same host as Cyrus IMAP.

Three files need to be edited in order to configure Postfix to transfer mail to Cyrus. The first file is /etc/postfix/main.cf, in which we need to add or uncomment this line:

mailbox_transport = cyrus

The second file we need to edit is /etc/postfix/master.cf, in which we need to add or uncomment these two lines:

cyrus     unix  -       n       n       -       -       pipe
user=cyrus argv=/usr/libexec/cyrus/deliver -r ${sender} ${user}

Actually, the second line may differ on your system; the syntax of Cyrus' deliver program has changed over the years. If you installed both Cyrus IMAP and Postfix from your Linux distribution's current CDs or download site, the included /etc/postfix/master.cf file should work without tweaking. If you installed either Cyrus IMAP or Postfix from source code, however, you may need to do some tweaking and Googling to get the second line exactly right. One key piece of the second line is the path in argv=/usr/libexec/cyrus/deliver, which must point to your local system's Cyrus deliver command.

The third and final Postfix file to edit is /etc/aliases; you may keep yours in /etc/postfix/aliases. Unless you're using LDAP for alias lookups—a process too involved for this article, but which I describe in the Sidebar—you need to have at least one entry in aliases for each Cyrus mailbox, plus any aliases to those mailboxes you need. For our example user Bubba, /etc/aliases needs the line:

bubba:    bubba

Simple enough, right? We omit the user. prefix; Cyrus mailboxes are referred to by user name. If your Cyrus (LDAP) user names correspond to local system user names, you don't need aliases entries for those users. But part of Cyrus' attraction lies in its not requiring users to have shell accounts.

If Bubba is our organization's marketing analyst, we also can add the line:

marketing_weasel: bubba

After you edit your aliases file, don't forget to use the postalias command to generate a new alias database:

bash-$> postalias hash:/etc/aliases

______________________

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState