Using Perdition With ISPMan
Updated: January 14, 2004
by Tony Wasson (wasson at azxws.com)
As an ISPMan administrator, you'll use Perdition to let users login with user@domain.com or user_domain_com. You can also use it to append a domain name onto a username. You can also use Perdition as a “traffic directory” during email migration, however that is outside the scope of this document.
1) If running ISPMan 1.0 or higher, skip this step..
Older releases did not support the 2 UIDs (userids) for all users by default. You need to run "ispman.fixUsers" to create both UIDs. You need to make sure all new users have 2 UIDs also, so you can either make “ispman.fixUsers” a cron job . On 0.9.7 you can patch ISPMan to do this for all new users by changing users.ldif.template like so:
After the 1st UID line, add this:
uid: join '@', ($r->param("userid"), $r->param("ispmanDomain"))
2) Make sure you have access to your LDAP server(s)
You may have to edit tcpwrappers (/etc/hosts.allow), iptables/ipchains or other firewall rules depending on your security setup.
ldapsearch -xvu -h 127.0.0.1 -LLL -b "o=ispman" ispmanVar=*
3) Verify the LDAP server is reachable, something like this works well
4) Install perdition
You can use packages for your distribution, or compile from source available from: http://www.vergenet.net/linux/perdition/download/
#apt-get install perdition perdition-ldap
5) Configure Perdition
Keep in mind that your map_libary file may be in a different location.When you “go live” you should have multiple LDAP servers. As long as they are all on standard ports, set these up on the map_library_opt line.
A basic /etc/perdition/perdition.conf looks like so:
map_library /usr/lib/libperditiondb_ldap.so.0 map_library_opt "ldap://127.0.0.1/o=ispman?mailroutingaddress?sub?(uid=%25s)" server_ok_line username_from_database
A single domain setup config file will probably look more like
map_library /usr/lib/libperditiondb_ldap.so.0 # The following map_library_opt line needs to be on a single line # Customize the @azxws.com to match your domain. map_library_opt “ldap://127.0.0.1//o=ispman?mailroutingaddress?sub?(uid=%25s@azxws.com)" server_ok_line username_from_database
A multi-LDAP server config file will probably look more like :
map_library /usr/lib/libperditiondb_ldap.so.0 # The following map_library_opt line needs to be on a single line map_library_opt “ldap://127.0.0.1 192.168.2.10 192.168.3.10 \ /o=ispman?mailroutingaddress?sub?(uid=%25s)" server_ok_line username_from_database
6) Make sure Perdition starts on bootup and start it manually now
/etc/init.d/perdition start
7) Verify the account and password are correct by logging in directly
against the mail server. I usually do something like this on the mail server:
telnet localhost 110 USER user_domain_com PASS thepassword
Then I repeat these steps using my new Perdition proxy. If it fails, check the logs (perdition uses syslog). You may also use a system debugger (like strace) and a network sniffer to verify LDAP is functioning. I have also had good success setting an outgoing_server in perdition.conf as a debugging measure
Once you have underscore names working, use the user@domain.com name through Perdition. Voila! It works...
On a side note, you'll most likely want to setup postfix to do SMTP authentication. It's pretty easy to get PLAIN and LOGIN working. If you want other mechanisms, you'll need to work harder. Remember, since there are two UIDs, either user@domain.com and user_domain_com works.
Q: I got this error: perdition[10905]: dlopen of "/usr/lib/libperditiondb_ldap.so.0" failed, what should I check?
A: This is usually a configuration problem. First verify that your map_library_opt line is correct and has no word wrap. Next check your config file like so:
grep -v '^#' /etc/perdition/perdition.conf
If you have a small installation and want this on the same machine as Cyrus 2.1, you can set it up like so perdition listens on the outside IP and Cyrus listens on localhost. Note that you will need to make sure any webmail programs point to the external IP address so that users can login with their email address as their username.
In /etc/cyrus.conf edit these two lines and restart cyrus:
imap cmd="imapd -U 30" listen="localhost:imap" prefork=0 maxchild=100 pop3 cmd="pop3d -U 30" listen="localhost:pop3" prefork=0 maxchild=50
In /etc/perdition/perdition.conf add these lines and restart perdition:
bind_address XXX.XXX.XXX.XXX <--- Must be outside IP outgoing_server 127.0.0.1
Ensure that your hostname resolves to 127.0.0.1.
This prevents Perdition from connecting back to itself in a loop.
NOTE: I've also seen people setup cyrus to listen on alternate pop and imap ports. This can work too, the choice is up to you.
1) Read the Perdition man pages.
2) Visit the Perdition website
http://www.vergenet.net/linux/perdition/
3) Read Configuring Perdition Proxy Software to Use an Existing LDAP Server
http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf