Re: Virtual users or system users for a mail server

Thanks for your comments !

We're currently avoiding name collisions with virtual domains solely, we
only have one local domain which all the others virtual, users to domains
are mapped by virtual_maps.

One thing that I'm not quite sure about is how to deal with user provided
procmails, since the process which executes them has privileges for all
vmailboxes, this sounds like a security problem. Perhaps I'm mistaken or
missing something here. Do you guys need to provide this kind of service on
your mail servers (user provider procmail or sieve) ?


On Fri, Sep 26, 2014 at 8:31 PM, Sven Hartge <[email protected]> wrote:

> Marc Aymerich <[email protected]> wrote:
>
> > Everybody seems to be configuring their mail server using virtual
> > users instead of the traditional system user approach.
>
> > I find system users easy to configure and even more secure, since IMAP
> > and POP3 processes can run under the system user account (of course
> > disabling shell access).
>
> > I keep wondering if perhaps I'm missing some interesting advantage of
> > using virtual user accounts?
>
> > Anyone like to comment on this?
>
> Supporting IMAP shared folders with seperate users is a major pain in
> the lower back. This only really works painless if you only use one user
> for the mails on the mail-server and and IMAP ACLs on top of that.
>
> Also it allows you to support multiple domains without having to worry
> about username collisions.
>
> Third point: I don't have to add any NSS providers like libnss-ldapd or
> libnss-mysql to my mail-servers, only the mail handling daemons (exim4,
> postfix, dovecot) need to know the users. This reduces the complexity in
> a bigger system quite a bit.
>
> Grüße,
> Sven.
>
> --
> Sigmentation fault. Core dumped.
>
>
> --
> To UNSUBSCRIBE, email to [email protected]
> with a subject of "unsubscribe". Trouble? Contact
> [email protected]
> Archive: https://lists.debian.org/[email protected]
>
>


-- 
Marc