Javier de Miguel RodrÃguez
2010-Jun-06 12:38 UTC
[Dovecot] Questions about migration Sun Messaging -> Dovecot+Postfix+Ldap
Hello. We are planning a migration from Sun One Messaging Server to Dovecot+Postfix+Ldap. We are using Dovecot 1.2.11 with Sun One Directory Server 5.2 ldap (we will migrate to Directory Server 6.3.1) soon. In our University we have 65.000 students, 5.500 staff and 6.500 teachers. Our main ldap realm is dc=us,dc=es (us means University of Seville, Spain). We have two e-mail domains, @us.es (staff+teachers) and @alum.us.es (students). We use Sun One Directory Server to load data to our ldap from several sources (like Oracle databases, flat files, etc) Our ldap tree is like this: dc=us,dc=es | |----->ou=People,dc=us,dc=es // "special" users only used by apps | | |----->o=us.es,dc=us,dc=es // ldap branch for staff+teachers | | |----->o=alum.us.es,dc=us,dc=es // ldap branch for students A user id is unique, so there is only a "john_doe" in the ldap tree (I repeat, there is NOT uid=john_doe,o=us.es,dc=us,dc=es and uid=john_doe,o=alum.us.es,dc=us,dc=es). Below you will find a copy of the dovecot.conf and dovecot-ldap.conf. Our operating system is Red Hat Enteprise Linux 5 x64. These are our questions: 1) We are unable to make dbox work with quota, but we have no problem with maildir. Quota is stored in a ldap attibute called "mailQuota" 2) A user can be in different branches in the same time: for example, a teacher called pepito should be in the uid=pepito,o=us.es,dc=us,dc=es branch but if that teacher is also a student should have another ldap entry uid=pepitosurname,o=us.es,dc=us,dc=es. Our identity management is the piece of software that "promotes" a user in that case. How should we use "mail_location" to addres this? 3) We are planning to use two raid5 of 8 SAS 15.000 rpm disks for these mailboxes. We will use a "2.0, ajax-based webmail" like roundcube. Most of our users will use webmail (imap based). How many iops should we have in that enviroment? We would like to use dbox, but we are stuck in maildir because 1) 4) Some users could have their mailboxes "disabled". We use the following line: user_filter = (&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active)) but it does NOT work as expected. Any idea) 5) We are planning to use bacula to backup user mailboxes. Any known problem with this (i will ask in the bacula mailing list anyway) 6) I have read carefully perfomance in dovecot wiki. Can I use noatime in /etc/fstab safely with dovecot? Any perfomance hint apart from we already have in our config files? 7) When we set vacation messages they work but we see this error in the log: dovecot: deliver(jorgelp): file_dotlock_create(~/.dovecot.lda-dupes) failed: No such file or directory 8) When a user log in she uses his username "mary" (without @us.es or @alum.us.es) . Our dovecot search in all the ldap tree until it finds that uid. But we would like to store in our mail_location /buzones/us.es or /buzones/alum.us.es. How can we accomplish this? We should use the "upper branch name" as part of the mail_location. Thank you for your support (and for your patience). Regards Javier <---- Config files ------> dovecot.conf: # 1.2.11: /etc/dovecot.conf # OS: Linux 2.6.18-194.3.1.el5 i686 Red Hat Enterprise Linux Server release 5.5 (Tikanga) ext3 base_dir: /var/run/dovecot/ protocols: pop3 imap imaps pop3s managesieve listen(default): *, [::] listen(imap): *, [::] listen(pop3): *, [::] listen(managesieve): *:2000 login_dir: /var/run/dovecot//login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_executable(managesieve): /usr/libexec/dovecot/managesieve-login login_max_processes_count: 2000 max_mail_processes: 2000 verbose_proctitle: yes mail_uid: prueba mail_gid: prueba mail_location: maildir:/buzones/us.es/%M/%n/ fsync_disable: yes mail_executable(default): /usr/libexec/dovecot/rawlog /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/rawlog /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_executable(managesieve): /usr/libexec/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/lib/dovecot/managesieve pop3_enable_last(default): no pop3_enable_last(imap): no pop3_enable_last(pop3): yes pop3_enable_last(managesieve): no pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu pop3_uidl_format(managesieve): %08Xu%08Xv lda: postmaster_address: javierdemiguel at us.es hostname: us.es mail_plugins: sieve log_path: info_log_path: syslog_facility: mail fsync_disable: no auth default_with_listener: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot-ldap-userdb.conf auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot-ldap.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 511 user: prueba plugin: quota: maildir:Cuota de usuario quota_warning: storage=95%% /usr/local/bin/quota-warning.sh 95 quota_warning2: storage=80%% /usr/local/bin/quota-warning.sh 80 sieve: /buzones/us.es/%M/%n/dovecot.sieve sieve_dir: /buzones/us.es/%M/%n/sieve/ dovecot-ldap.conf hosts = ip_address:389 dn = uid=nuevobuzon,ou=People,dc=us,dc=es dnpass = password auth_bind = yes auth_bind_userdn= uid=%n,o=us.es,dc=us,dc=es ldap_version = 3 base = dc=us,dc=es user_attrs = mailQuota=quota_rule=*:storage=%$B user_filter = (&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active))
Timo Sirainen
2010-Jun-07 17:00 UTC
[Dovecot] Questions about migration Sun Messaging -> Dovecot+Postfix+Ldap
On su, 2010-06-06 at 14:38 +0200, Javier de Miguel Rodr?guez wrote:> 1) We are unable to make dbox work with quota, but we have no > problem with maildir. Quota is stored in a ldap attibute called "mailQuota"I don't really recommend using dbox in v1.2. It has much better performance and stability in v2.0. Anyway, with dbox you'll have to use dict quota instead of maildir quota.> 2) A user can be in different branches in the same time: for > example, a teacher called pepito should be in the > uid=pepito,o=us.es,dc=us,dc=es branch but if that teacher is also a > student should have another ldap entry > uid=pepitosurname,o=us.es,dc=us,dc=es. Our identity management is the > piece of software that "promotes" a user in that case. How should we use > "mail_location" to addres this?You mean both pepito at us.es and pepitosurname at alum.us.es (did you forget alum above?) should point to same mail directory? There would have to be some kind of a common identifier between them in LDAP.> 4) Some users could have their mailboxes "disabled". We use the > following line: user_filter = > (&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active)) but it > does NOT work as expected. Any idea)You should do it also for pass_filter. But other than that, I'd guess it should work.> 6) I have read carefully perfomance in dovecot wiki. Can I use > noatime in /etc/fstab safely with dovecot?Yes.> Any perfomance hint apart > from we already have in our config files?Wiki lists most of the things I can think of.> 7) When we set vacation messages they work but we see this error in > the log: dovecot: deliver(jorgelp): > file_dotlock_create(~/.dovecot.lda-dupes) failed: No such file or directoryYour userdb doesn't return a home directory for users. http://wiki.dovecot.org/VirtualUsers/Home> 8) When a user log in she uses his username "mary" (without @us.es > or @alum.us.es) . Our dovecot search in all the ldap tree until it finds > that uid. But we would like to store in our mail_location /buzones/us.es > or /buzones/alum.us.es. How can we accomplish this? We should use the > "upper branch name" as part of the mail_location.pass_attrs = .., someField=domain, .. where someField contains the us.es or alum.us.es. If there's no such field, I guess there's no way to do it.> auth default_with_listener: > mechanisms: plain login > passdb: > driver: ldap > args: /etc/dovecot-ldap.conf > userdb: > driver: ldap > args: /etc/dovecot-ldap-userdb.conf > auth default: > mechanisms: plain login > passdb: > driver: ldap > args: /etc/dovecot-ldap.conf > userdb: > driver: ldap > args: /etc/dovecot-ldap.confDon't add more than one auth block, now it's sometimes (more or less randomly) using dovecot-ldap-userdb.conf and other times dovecot-ldap.conf for userdb lookups.