ldapforward is an add-on to qmail to forward mail to one or more addresses retrieved from an LDAP server.
ldapforward can be used e.g. to resolve email aliases, to route incoming addresses to local maildrop addresses or remote forward addresses, and it can be used to implement mailing lists. It can preserve qmail-style dash-separated address extensions. Connections to the server with strong encryption and strong client authentication is possible.
Author:
Timo Felbinger
Quantum Optics Group
Institut für Physik
University of Potsdam
ldapforward is free software and comes with NO WARRANTY. Here is the
ldapforward can forward mail to one or more addresses obtained from an LDAP directory. LDAP queries are controlled by command line arguments in the form of LDAP URLs (RFC 2255):
| ldapforward [-d] [-t] URL ... [emailaddress] [errorcode]
inetorgperson below ou=people,ou=physics,o=uni-potsdam,c=de
which has the attribute
memberof=quantum:
| ldapforward -d
'ldap://ldap.qipc.org
/ou=people,ou=physics,o=uni-potsdam,c=de
?maildrop,mail
?sub
?(&(objectclass=inetorgperson)(memberof=quantum))
?matchesLimit=0'
'ldaps://ldap-slave.qipc.org
/ou=people,ou=physics,o=uni-potsdam,c=de
?maildrop,mail
?sub
?(&(objectclass=inetorgperson)(memberof=quantum))
?matchesLimit=0'
postmaster@some.where
To determine a delivery address, the attribute maildrop is searched
first; attribute mail is checked if there is no maildrop.
There are two almost identical URLs: the second one specifies a backup server for failover.
If both servers fail, mail is forwarded to postmaster@some.where.
The backup server is accessed with TLS (scheme ldaps).
The extension matchesLimit=0 means there is no limit imposed
on the number of delivery addresses obtained (but note that LDAP servers
may impose limits on the number of hits they are willing to hand out!).
/var/qmail/alias/.qmail-...-default, the mail hub of several virtual
domains:
| ldapforward
'ldap://ldap.qipc.org
/ou=people,ou=physics,o=uni-potsdam,c=de
?maildrop
?sub
?(&(objectclass=inetorgperson)(memberof=${LOCAL0})(|(mail=${LOCAL1}@physik.uni-potsdam.de)(physikalias=${LOCAL1}@physik.uni-potsdam.de)(uid=${LOCAL1})))
?matchesLimit=1,preserveExtension=2,authoritative'
'ldaps://ldap-slave.qipc.org
/ou=people,ou=physics,o=uni-potsdam,c=de
?maildrop
?sub
?(&(objectclass=inetorgperson)(memberof=${LOCAL0})(|(mail=${LOCAL1}@physik.uni-potsdam.de)(physikalias=${LOCAL1}@physik.uni-potsdam.de)(uid=${LOCAL1})))
?matchesLimit=1,preserveExtension=2,authoritative'
111
This assumes that there is a line like
dom.org:dom
/var/qmail/control/virtualdomains for every virtual domain.
If email to joe.average-ext@dom.org arrives, qmail will set the
variable LOCAL=dom-joe.average-ext in the environment.
ldapforward expands LOCAL0 (here: dom, see
ldapforward(1)) to match only people with the
appropriate memberof attribute.
LOCAL1 is expanded (here: joe.average) to form an
LDAP filter expression to search for people with any of
mail=joe.average@physik.uni-potsdam.de
physikalias=joe.average@physik.uni-potsdam.de
uid=joe.average
maildrop. The match must be unique
(matchesLimit=1, which is redundant because it is the default).
Both URLs are marked authoritative: if either LDAP query succeeds but
does not find a match, a hard error (100) is returned (ie, the mail will
bounce). If both servers are down, error 111 (temporary failure) is
returned.
preserveExtension=2 will insert the address extension following
the second dash in LOCAL (if any) into every delivery address.
userPassword attribute, which the
client must send to prove its identity. Simple authentication is used when you
you specify a binddn extension. Most likely, you will also need
a indpwfile extention.
ldaps),
"LDAP simple authentication" will transmit the password in clear text from client to server,
and the session may also be vulnerable to other kinds of attacks (like hijacking);
you have been warned!
external: the client proves his identity by
sasl_mech=external,tls_cert=certfile,tls_key=keyfile
where certfile contains an X509 certificate acceptable to the LDAP
server, and keyfile the corresponding private RSA key.
Since external authentication takes place in the TLS layer, this works
only when connecting with TLS, ie: you must use ldaps for
the scheme of the URL.
libldap.so
installed.
cd qmail-1.03
patch < ldapforward-1.3.0-patch
Makefile
and remove the comment characters from the two lines
# sasl_libs=-lsasl2
# sasl_defs=-DWITH_SASL
close to the bottom of the file. To build with SASL support, you will need to have the
Cyrus-SASL
client libraries installed.
qmail-1.03/INSTALL, and also various
sources listed at http://www.qmail.org.
In addition to a standard qmail-1.03 installation, this will give you
one additional program, ldapforward, and
its man page.
make ldapforward