dovecot - Jun 2010 - Questions about migration Sun Messaging -> Dovecot+Postfix+Ldap

Hello.

     We are planning a migration from Sun One Messaging Server to 
Dovecot+Postfix+Ldap. We are using Dovecot 1.2.11 with Sun One Directory 
Server 5.2 ldap (we will migrate to Directory Server 6.3.1) soon. In our 
University we have 65.000 students, 5.500 staff and 6.500 teachers.

     Our main ldap realm is dc=us,dc=es (us means University of Seville, 
Spain). We have two e-mail domains, @us.es (staff+teachers) and 
@alum.us.es (students). We use Sun One Directory Server to load data to 
our ldap from several sources (like Oracle databases, flat files, etc)

     Our ldap tree is like this:

   dc=us,dc=es
     |
     |----->ou=People,dc=us,dc=es   // "special" users only used by
apps
     |
     |
     |----->o=us.es,dc=us,dc=es // ldap branch for staff+teachers
     |
     |
     |----->o=alum.us.es,dc=us,dc=es // ldap branch for students


     A user id is unique, so there is only a "john_doe" in the ldap
tree
(I repeat, there is NOT uid=john_doe,o=us.es,dc=us,dc=es and 
uid=john_doe,o=alum.us.es,dc=us,dc=es). Below you will find a copy of 
the dovecot.conf and dovecot-ldap.conf.

     Our operating system is Red Hat Enteprise Linux 5 x64.

     These are our questions:

     1) We are unable to make dbox work with quota, but we have no 
problem with maildir. Quota is stored in a ldap attibute called
"mailQuota"

     2) A user can be in different branches in the same time: for 
example, a teacher called pepito should be in the 
uid=pepito,o=us.es,dc=us,dc=es branch but if that teacher is also a 
student should  have another ldap entry 
uid=pepitosurname,o=us.es,dc=us,dc=es. Our identity management is the 
piece of software that "promotes" a user in that case. How should we
use
"mail_location" to addres this?

     3) We are planning to use two raid5 of 8 SAS 15.000 rpm disks for 
these mailboxes. We will use a "2.0, ajax-based webmail" like
roundcube.
Most of our users will use webmail (imap based). How many iops should we 
have in that enviroment? We would like to use dbox, but we are stuck in 
maildir because 1)

     4)  Some users could have their mailboxes "disabled". We use the 
following line: user_filter = 
(&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active)) but it 
does NOT work as expected. Any idea)

     5) We are planning to use bacula to backup user mailboxes. Any 
known problem with this (i will ask in the bacula mailing list anyway)

     6) I have read carefully perfomance in dovecot wiki. Can I use 
noatime in /etc/fstab safely with dovecot? Any perfomance hint apart 
from we already have in our config files?

     7) When we set vacation messages they work but we see this error in 
the log:   dovecot: deliver(jorgelp): 
file_dotlock_create(~/.dovecot.lda-dupes) failed: No such file or directory

     8) When a user log in she uses his username "mary" (without
@us.es
or @alum.us.es) . Our dovecot search in all the ldap tree until it finds 
that uid. But we would like to store in our mail_location /buzones/us.es 
or /buzones/alum.us.es. How can we accomplish this? We should use the 
"upper branch name" as part of the mail_location.

     Thank you for your support (and for your patience).

     Regards

     Javier










<---- Config files ------>


dovecot.conf:

# 1.2.11: /etc/dovecot.conf
# OS: Linux 2.6.18-194.3.1.el5 i686 Red Hat Enterprise Linux Server 
release 5.5 (Tikanga) ext3
base_dir: /var/run/dovecot/
protocols: pop3 imap imaps pop3s managesieve
listen(default): *, [::]
listen(imap): *, [::]
listen(pop3): *, [::]
listen(managesieve): *:2000
login_dir: /var/run/dovecot//login
login_executable(default): /usr/libexec/dovecot/imap-login
login_executable(imap): /usr/libexec/dovecot/imap-login
login_executable(pop3): /usr/libexec/dovecot/pop3-login
login_executable(managesieve): /usr/libexec/dovecot/managesieve-login
login_max_processes_count: 2000
max_mail_processes: 2000
verbose_proctitle: yes
mail_uid: prueba
mail_gid: prueba
mail_location: maildir:/buzones/us.es/%M/%n/
fsync_disable: yes
mail_executable(default): /usr/libexec/dovecot/rawlog 
/usr/libexec/dovecot/imap
mail_executable(imap): /usr/libexec/dovecot/rawlog /usr/libexec/dovecot/imap
mail_executable(pop3): /usr/libexec/dovecot/pop3
mail_executable(managesieve): /usr/libexec/dovecot/managesieve
mail_plugins(default): quota imap_quota
mail_plugins(imap): quota imap_quota
mail_plugins(pop3): quota
mail_plugins(managesieve):
mail_plugin_dir(default): /usr/lib/dovecot/imap
mail_plugin_dir(imap): /usr/lib/dovecot/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/pop3
mail_plugin_dir(managesieve): /usr/lib/dovecot/managesieve
pop3_enable_last(default): no
pop3_enable_last(imap): no
pop3_enable_last(pop3): yes
pop3_enable_last(managesieve): no
pop3_uidl_format(default): %08Xu%08Xv
pop3_uidl_format(imap): %08Xu%08Xv
pop3_uidl_format(pop3): %08Xv%08Xu
pop3_uidl_format(managesieve): %08Xu%08Xv
lda:
   postmaster_address: javierdemiguel at us.es
   hostname: us.es
   mail_plugins: sieve
   log_path:
   info_log_path:
   syslog_facility: mail
   fsync_disable: no
auth default_with_listener:
   mechanisms: plain login
   passdb:
     driver: ldap
     args: /etc/dovecot-ldap.conf
   userdb:
     driver: ldap
     args: /etc/dovecot-ldap-userdb.conf
auth default:
   mechanisms: plain login
   passdb:
     driver: ldap
     args: /etc/dovecot-ldap.conf
   userdb:
     driver: ldap
     args: /etc/dovecot-ldap.conf
   socket:
     type: listen
     master:
       path: /var/run/dovecot/auth-master
       mode: 511
       user: prueba
plugin:
   quota: maildir:Cuota de usuario
   quota_warning: storage=95%% /usr/local/bin/quota-warning.sh 95
   quota_warning2: storage=80%% /usr/local/bin/quota-warning.sh 80
   sieve: /buzones/us.es/%M/%n/dovecot.sieve
   sieve_dir: /buzones/us.es/%M/%n/sieve/

dovecot-ldap.conf

hosts = ip_address:389
dn = uid=nuevobuzon,ou=People,dc=us,dc=es
dnpass = password
auth_bind = yes
auth_bind_userdn= uid=%n,o=us.es,dc=us,dc=es
ldap_version = 3
base = dc=us,dc=es
user_attrs = mailQuota=quota_rule=*:storage=%$B
user_filter = (&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active))

On su, 2010-06-06 at 14:38 +0200, Javier de Miguel Rodr?guez wrote:
>      1) We are unable to make dbox work with quota, but we have no 
> problem with maildir. Quota is stored in a ldap attibute called
"mailQuota"
I don't really recommend using dbox in v1.2. It has much better
performance and stability in v2.0. Anyway, with dbox you'll have to use
dict quota instead of maildir quota.
>      2) A user can be in different branches in the same time: for 
> example, a teacher called pepito should be in the 
> uid=pepito,o=us.es,dc=us,dc=es branch but if that teacher is also a 
> student should  have another ldap entry 
> uid=pepitosurname,o=us.es,dc=us,dc=es. Our identity management is the 
> piece of software that "promotes" a user in that case. How should
we use
> "mail_location" to addres this?
You mean both pepito at us.es and pepitosurname at alum.us.es (did you forget
alum above?) should point to same mail directory? There would have to be
some kind of a common identifier between them in LDAP.
>      4)  Some users could have their mailboxes "disabled". We use
the
> following line: user_filter = 
> (&(objectClass=inetorgperson)(uid=%n)(mailUserStatus=active)) but it 
> does NOT work as expected. Any idea)
You should do it also for pass_filter. But other than that, I'd guess it
should work.
>      6) I have read carefully perfomance in dovecot wiki. Can I use 
> noatime in /etc/fstab safely with dovecot? 
Yes.
> Any perfomance hint apart 
> from we already have in our config files?
Wiki lists most of the things I can think of.
>      7) When we set vacation messages they work but we see this error in 
> the log:   dovecot: deliver(jorgelp): 
> file_dotlock_create(~/.dovecot.lda-dupes) failed: No such file or directory
Your userdb doesn't return a home directory for users.
http://wiki.dovecot.org/VirtualUsers/Home
>      8) When a user log in she uses his username "mary" (without
@us.es
> or @alum.us.es) . Our dovecot search in all the ldap tree until it finds 
> that uid. But we would like to store in our mail_location /buzones/us.es 
> or /buzones/alum.us.es. How can we accomplish this? We should use the 
> "upper branch name" as part of the mail_location.
pass_attrs = .., someField=domain, ..

where someField contains the us.es or alum.us.es. If there's no such
field, I guess there's no way to do it.
> auth default_with_listener:
>    mechanisms: plain login
>    passdb:
>      driver: ldap
>      args: /etc/dovecot-ldap.conf
>    userdb:
>      driver: ldap
>      args: /etc/dovecot-ldap-userdb.conf
> auth default:
>    mechanisms: plain login
>    passdb:
>      driver: ldap
>      args: /etc/dovecot-ldap.conf
>    userdb:
>      driver: ldap
>      args: /etc/dovecot-ldap.conf
Don't add more than one auth block, now it's sometimes (more or less
randomly) using dovecot-ldap-userdb.conf and other times
dovecot-ldap.conf for userdb lookups.