Re: Authentication

Michael wrote:
> Hi jamm-users,
> 
> 
> the following (debian) configuration for postfix allows me "only" to 
> authenticate ALL users (local and virtual) with pam/ldap + sasl (local 
> users have to be virtual users).
> 
> Does the configuration of jamm and postfix allow to seperate the 
> authentication process for local users (authentication over pam/passwd + 
> sasl) and  virtual users (authentication over pam/ldap + sasl)?

I use the following configuration, but beware: it's rather complicate ;)

My ldap has two trees:

let's call the first

o=example

and the second

dc=example,dc=com

inside o=example I've an ou=hosting and inside this all my hosting ldap 
tree, that is all jvd domains

inside dc=example,dc=com I've three ou

ou=Users
ou=Groups
ou=Computer

I've integrated ldap, unix and samba logins using Idealx howto
http://www.idealx.org/prj/samba/samba-ldap-howto.pdf
(my solution is still samba 2.2 based, I'm migrating to LAM and samba 
3.0 just these days)

unix logins have been integrated using pam-ldap and libnss-ldap (nscd), 
and they point to ou=Users,dc=example,dc=com
The are several documents that explain how to do this.

All the mail system (postfix + courier pop/imap) see both unix (pam) 
accounts and ldap accounts

Sasl into postfix was one the most trickiest part: I've "glued" it using 
imap :)

/etc/default/saslauthd:

# This needs to be uncommented before saslauthd will be run automatically
START=yes

# You must specify the authentication mechanisms you wish to use.
# This defaults to "pam" for PAM support, but may also include
# "shadow" or "sasldb", like this:
# MECHANISMS="pam shadow"

MECHANISMS="rimap"
PARAMS="-m /var/spool/postfix/var/run/saslauthd -r -O 127.0.0.1"
PWDIR=/var/spool/postfix/var/run/saslauthd

Some notes:
- MECHANISMS="rimap" of course means to use imap for authentication
- the saslauthd socket has been moved into the postfix chroot jail
- the -r is used to pass the user in the form user@domain, until sasl 
2.1.15 this was standard behaviour, then it changed without warning (on 
debian), it was a real pain, and at first I had to fetch a patch from 
cvs to get the -r parameter, I've upgraded to sasl 2.1.19 two days ago 
and the patch has been merged into sasl2 code

Courier:

- courier /etc/courier/authdaemonrc
authmodulelist="authldap authpam"
so again it see both unix (pam) and ldap accounts

- courier authldaprc point to the o=example part of the ldap tree

One last note: I didn't want to have mail accounts for my main domain 
(midhgard.it) separate from unix accounts, but still I wanted to have 
midhgard.it integrated in jamm

I found this one last trick: midhgard.it is a virtual mail domain into 
jamm, it has some virtual mail accounts (no unix user)
When I want to give the mailbox to a real unix user I create an alias 
into jamm and make it point to the unix user name (no domain)
Since postfix and courier both see unix (pam) users, all results to be 
integrated.
I just have to "remember" that for this kind of users I've both to 
create the unix/samba users and the alias into jamm, but this is just 
because I want to manage one domain a "special" way.

If somebody can be interested (not jamm related): I've integrated the 
login into apache too, using apache pam auth module
Then I had another problem: pam can read from ldap but can't read from 
shadow (unless you give apache permission to read shadow, not advisable)
I bypassed pam_unix and used pam_imap: this way apache auth is 
integrated with both ldap and "real" unix users.

Hope this helps you and it's not too off-topic for the list

Massimiliano

-- 

Massimiliano Ferrero
Midhgard s.r.l.
C/so Re Umberto 23
10128 - Torino
tel. +39-0112301400 - fax +39-0112301422
e-mail: [email protected]
sito web: http://www.midhgard.it


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/