☰

Dovecot 不使用 pam 会话来创建邮件传递主页

tag-icon • tag-icon postfix dovecot pam
Dovecot 不使用 pam 会话来创建邮件传递主页

我有一个带有 Postfix 和 Dovecot 的邮件服务器，我的用户主要存储在 LDAP 数据库中，我希望 dovecot/postfix 在需要时自动创建用户主目录（通过 pam）。

当用户尝试（通过 imap）登录他的新邮箱时，它运行良好，dovecot 要求 pam 打开会话，然后 pam（通过 pam_mkhomedir）完成该工作。

但是，如果邮件在有效用户登录之前到达该用户，则会失败并显示以下消息：

Mar 20 15:55:45 galilee dovecot: lda(mouton): Error: User initialization failed: Namespace '': mkdir(/home/mouton/Maildir) failed: Permission denied (euid=588628(mouton) egid=588628(<unknown>) missing +w perm: /home, dir owned by 0:0 mode=0755)
Mar 20 15:55:45 galilee dovecot: lda: Fatal: Invalid user settings. Refer to server log for more information.

那么，当我的服务器收到邮件时，如何要求 dovecot（或 postfix）通过 pam 打开会话，以便创建主目录？

这是我的鸽舍配置dovecot -n：

# 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.16 (fed8554)
# OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 
auth_mechanisms = plain login
hostname = XXXX.XXXX.XX
mail_location = maildir:~/Maildir
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Spam {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = failure_show_msg=yes session=yes dovecot
  driver = pam
}
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_before = /etc/dovecot/sieve/spamfilter.sieve
  sieve_editheader_forbid_add = X-Verified
  sieve_editheader_forbid_delete = X-Verified X-Seen
  sieve_editheader_max_header_size = 1k
  sieve_extensions = +notify +imapflags +editheader
}
postmaster_address = [email protected]
protocols = " imap lmtp sieve pop3 sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 2000
  }
  inet_listener sieve_deprecated {
    port = 2001
  }
  process_min_avail = 0
  service_count = 1
  vsz_limit = 64 M
}
service managesieve {
  process_limit = 1024
}
ssl = required
ssl_cert = </etc/letsencrypt/live/galilee.eedf.fr/fullchain.pem
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_dh_parameters_length = 2048
ssl_key =  # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
ssl_require_crl = no
userdb {
  driver = passwd
}
protocol lmtp {
  mail_plugins = " sieve"
}
protocol lda {
  mail_plugins = " sieve"
}
protocol imap {
  mail_max_userip_connections = 150
}

附言：我使用 spamassassin，但是我认为它不会对这个问题造成任何问题。

答案1

我认为您必须将 dovecot 配置为与单个 unix vmail 用户一起运行。这应该可以解决这个问题。首先创建一个用户，例如 vmail：

service lmtp {
 unix_listener /var/spool/postfix/private/dovecot-lmtp {
   group = postfix
   mode = 0600
   user = postfix
  }
  user = vmail
}

mail_uid = 1000   # uid of vmail user
mail_gid = 1000   # gid of vmail user

mail_home = /home/vmail/%d/%n

相关内容