Re: Postfix relay_hosts with regexp

2005-08-15, 13:40 -0500, Keith T. Garner wrote:
> > 1, (fixed) When large amount of mail were received via SMTP, the
> > OpenLDAP software didn't manage to keep up and as a result we got an
> > equally large amount of "could not be delivered"-mail (the sender was a
> > sattelite system, with sender account belonging in the same
> > JAM-installation as the recipient). The resolution to this was simply to
> > make postfix not except mail as fast as the default installation made it
> > (debian unstable).
> 
> What exactly did you tweak?  I'm having a similar problem.  (Also,
> what version of OpenLDAP?)  I'm having a similar problem, but I can't
> believe the load is too high.  I'm going to try upgrading to the
> latest OpenLDAP and switching backends to see if that helps.

ii  db4.2-util     4.2.52-17      Berkeley v4.2 Database Utilities
ii  ldap-utils     2.1.30-3       OpenLDAP utilities
ii  libdb1-compat  2.1.3-7        The Berkeley database routines [glibc 2.0/2.
ii  libdb2         2.7.7.0-9      The Berkeley database routines (run-time fil
ii  libdb3         3.2.9-20       Berkeley v3 Database Libraries [runtime]
ii  libdb4.0       4.0.14-2       Berkeley v4.0 Database Libraries [runtime]
ii  libdb4.1       4.1.25-17      Berkeley v4.1 Database Libraries [runtime]
ii  libdb4.2       4.2.52-17      Berkeley v4.2 Database Libraries [runtime]
ii  libgdbm3       1.8.3-2        GNU dbm database routines (runtime version)
ii  libgdbmg1      1.7.3-28       GNU dbm database routines (runtime version)
ii  libldap2       2.1.30-3       OpenLDAP libraries
ii  postfix        2.1.5-3        A high-performance mail transport agent
ii  postfix-ldap   2.1.5-3        LDAP map support for Postfix
ii  postfix-tls    2.1.5-3        TLS and SASL support for Postfix
ii  sasl2-bin      2.1.19-1.5     Programs for manipulating the SASL users dat
ii  slapd          2.1.30-3       OpenLDAP server (slapd)

Debian packages from the current unstable "release".

Jamm is version 0.9.6.

Postfix config (essential parts), master.cf: 
<<
local_destination_concurrency_limit = 4
default_destination_concurrency_limit = 20
in_flow_delay=2

##########################
# STMP + SASL + AUTH + SSL
# See http://www.securitysage.com/antispam/sasltls.html
# See http://www.thecabal.org/~devin/postfix/smtp-auth.txt
# Remember to start saslauthd with -r (or the domain will be cut off)

# SASL2
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = yes
#smtpd_tls_auth_only = no
smtpd_sasl_local_domain =

# TLS
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/certs/secure.linknet.se.key
smtpd_tls_cert_file = /etc/certs/secure.linknet.se.crt
smtpd_tls_CAfile = /etc/certs/UTN.cer
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

# STMP + SASL + AUTH + SSL
##########################

##########################
# JAMM
# See section 4.2.2 in
# http://jamm.sourceforge.net/howto/single-html/mailserver.html

# domains, must be accountActive and delete==false
domains_server_host = localhost
domains_search_base = o=jamm,dc=linknet,dc=se
domains_query_filter = (&(objectClass=JammVirtualDomain)(jvd=%s)(accountActive=TRUE)(delete=FALSE))
domains_result_attribute = jvd
domains_bind = no
domains_scope = one

# aliases, must be accountActive (aliases are deleted instantaneously)
aliases_server_host = localhost
aliases_search_base = o=jamm,dc=linknet,dc=se
aliases_query_filter = (&(objectClass=JammMailAlias)(mail=%s)(accountActive=TRUE))
aliases_result_attribute = maildrop
aliases_bind = no

#
accounts_server_host = localhost
accounts_search_base = o=jamm,dc=linknet,dc=se
accounts_query_filter = (&(objectClass=JammMailAccount)(mail=%s)(accountActive=TRUE)(delete=FALSE))
accounts_result_attribute = mailbox
accounts_bind = no

# needed for CATCH_ALL
accountsmap_server_host = localhost
accountsmap_search_base = o=jamm,dc=linknet,dc=se
accountsmap_query_filter = (&(objectClass=JammMailAccount)(mail=%s)(accountActive=TRUE)(delete=FALSE))
accountsmap_result_attribute = mail
accountsmap_bind = no

# make postfix use the sources above
virtual_alias_maps = ldap:accountsmap, ldap:aliases, regexp:/etc/postfix/regexp_alias_maps
virtual_mailbox_domains = ldap:domains

# and now for the virtual mail boxes
virtual_transport = virtual
virtual_mailbox_base = /var/vmail/domains
virtual_mailbox_maps = ldap:accounts
virtual_minimum_uid = 10000
virtual_uid_maps = static:10000
virtual_gid_maps = static:10000

# JAMM
##########################
>>

And in postfix' main.cf, the smtp line is now limited to 10 processes:

smtp      inet  n       -       -       -       10      smtpd -o content_filter=filter:

This has, since the config change, only lead to one single "Temporary
lookup failure"-message, which is acceptable. The amount of mail
received which caused troubles was some 2000 in an hour. As you see from
the main.cf-line above, we do some processing (virus, spam, misc extra)
on each mail delivered which slows down the delivery for every mail
somewhat. Perhaps postfix locks up a connection to ldap until it's
completely done?


> > 2, (not fixed) I use the oftenly seen "regexp_table" solution to rewrite
> > 16 domains to 1. [...]
> > relay_domains setting [...] a similar regexp for this setting.
> > 
> > Is this possible?
> 
> I don't know of a better method than that, sorry.

Ok. We'll survive. :)

I'll be happy to supply more information if you need any.


Fredrik Wendt
wendt.se



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf