Consulting djbware Publications
≡  

qmail-ldapam

From qmail-ldap to s/qmail+qmail-ldapam

Some years after D. J. Bernstein raised qmail, André Oppermann extended its user and configuration management interface together with significant perfomance improvements known as qmail-ldap.

While s/qmail includes those performance enhancements since some years, the question of user management by means of OpenLDAP (or other LDAP-compatible sources like Microsoft's AD) was only partially solved by means of an attached ldapam PERL module.

The basic idea behind the qmail-ldapam was to provide a checkpassword API compatible PAM, which can be called and customized for some relevant use cases though without the full-loaded solution, André Oppermann's approach delivers.

Features of qmail-ldapam

The qmail-ldapam provides a full user integraton for the following cases:

  1. Ingress email validation of existing mailboxes for qmail-smtpd given the RECIPIENTS extension.
  2. Outgress user authorization for email submission together with qmail-smtpd based on the SMTPAUTH interface.
  3. User verification for mailbox access either for POP3 qmail-popup or IMAP4 services given by bincimap-up.

The last case is entirely valid for stock vanilla qmail, while the other ones are encompassed by s/qmail, or some of the qmail patches provided by me.

Futher, the qmail-ldapam understands LDAP's UserPrincipalName UPN which can be used in an environment of virtual users, typically provided by VPopMail or the VMailMgr.

Unlike Andrè Oppermann's solution, the qmail-ldapam is TLS enabled, thus supporting simple bind, StartTLS enabled bind, and strong bind. Multitenancy - thus a domain-based LDAP server lookup without the requirement of referrals - is also possible.

In order to support such a behavior, qmail-ldapam reads a configuration file available at QMAILHOME/control/ldapbind. This may be matter of change.

Requirements for the qmail-ldapam

Though developed for s/qmail, the qmail-ldapam is not restricted to it. However, the following requirements need to be met:

In order to be used for SMTP email validation and/or SMTP user authorization, an existing qmail system needs to be enhanced by:

The SMTPAUTH extension is available in several other qmail derivatives as well, such this would work out-of-the-box.

Sources

Version & Download Description fehQlibs version Verification
qmail-ldapam-0.1 The first release of qmail-ldapam developed for s/qmail 4.4 (still beta, LICENSE file added) fehQlibs-31 MD5: 137279e21211f2c001917f5ca7e42061
Build: 20261005183629

The qmail-ldapam's source files are documented in doxygen.

Documentation

The included documentation for the qmail-ldapam is still brief:

How to install the qmail-ldapam

In order to get a working version of qmail-ldapam, you need to install the fitting fehQlibs in the first place. Please follow instructions here. OpenLDAP is assumed to be installed. Further, the DIT should be populated with the user DNs and is accessible.

Interaction of qmail-ldapam with the LDAP server

qmail-ldapam works Schema-free. Thus, apart from the standard POSIX schema, no particular other is required, but rather the LDAP lookup can be customized to the given DAP settings.

Typically, the following use cases may be encountered:

In case simple bind is used against a remote LDAP server, the communication can be encrypted by means of StartTLS. This is important, because the passwords are exchanged in plaintext and only protected in the backend DIT.

Strong bind is supported, but requires a X.509 client certificate for qmail-ldapam signed by the same CA as the LDAP server's cert.

Tickets, Change Requests, communication

An Ezmlmx mailing list keeps you updated with current developments, bug fixes, and features discussed. This list also can be used to file

To inscribe use the: sqmail mailing list

As usual, I can't guarantee a certain response level; but reasonable issues will be answered.