Installation de Berkelley DB

Installation de Berkelley DB
Installation de db-4.1
Récuperer la source de db-4.1 sur le site de http://www.sleepycat.com/download/index.shtml
Après avoir télécharger la source faire un tar –xvzf db-4.1.25.NC.tar.gz
Faire en suite cd db-4.1.25.NC/dist
Ensuite lancer le script configure avec la commande ./configure
Faire un make puis un make install prefix=/usr/local/src/db-4.1
Copier tous les librairies de db 4.1 vers /usr/lib et tous les fichiers du répertoire include de db
vers le répertoire /usr/include
Compilation et Installation de openldap
Après l’archivage de la source de openldap, aller dans le répertoire openldap-2.1.14
Voici la commande de compilation propre à notre cas :
[[email protected]]./configure –prefix=/usr –exec-prefix=/usr –libexecdir=/usr/sbin –
libdir=/usr/lib –oldicludedir=/usr/include –localstatedir=/var/run –sysconfdir=/etc –enableshared --with-gnu-ld –enable-debug –with-sql –with-tls --with-threads –enable-crypt –enablecleartext –enable-crypt –enable-slapd –enable-slurpd –enable-bdb –enable-ldbm –enable-local –
enable-passwd –enable-static –enable-FEATURE –with-PACKAGE --enable-syslog –enableldap –enable-shell –with-readline –enable-shell-module=auto
puis faire
[[email protected]]make depend
[[email protected]]make
[[email protected]]cd tests
[root@tests]make
[root@tests]cd ..
[root @openldap-version]make install
Configuration de Openldap
Editer le fichier /etc/openldap/slapd.conf
Définir la base de donnée
Database bdb
Suffix “dc=trstech,dc=net”
Rootdn “cn=Manager,dc=trstech,dc=net”
Rootpw secret
Directory=/var/ldap
Démarrez slapd
Vérifier si le serveur fonctionne à l’aide de la commande:
Ldapsearch –x –b ‘ ’ –s base ‘dc=trstech,dc=net’ ‘(objectclass=*)’ namingContexts
Si tout fonctionne bien la requête précédente devait retourner le résultat suivant
Dn :
NamingContexts :dc=trstech,dc=net
Ajout de donnèes dans l’annuaire ldap
Insérez des entrées à votre annuaire, ceci étant on doit créer un fichier d’extension ldif,en voici
un exemple de notre cas
dn:dc=trstech,dc=net
objectclass:dcObject
objectclass:organization
o:TRS
dc:trstech
dn:cn=Manager,dc=trstech,dc=net
objectclass:organizationalRole
cn:Manager
dn:ou=DG,dc=trstech,dc=net
objectclass:organizationalUnit
ou:DG
dn:ou=DT,dc=trstech,dc=net
objectclass:organizationalUnit
ou:DT
dn:ou=DC,dc=trstech,dc=net
objectclass:organizationalUnit
ou:DC
dn:ou=client,dc=trstech,dc=net
objectclass:organizationalUnit
ou:client
dn:ou=fournisseur,dc=trstech,dc=net
objectclass:organizationalUnit
ou:fournisseur
dn:ou=formation,dc=trstech,dc=net
objectclass:organizationalUnit
ou:formation
cn=jacob sakpo,ou=client,dc=trstech,dc=net
sn:jacob
objectclass:organizationalPerson
objectclass:inetorgPerson
cn:jacob sakpo
mail:[email protected]
telephoneNumber:+2282546896
telexNumber:+24589631
postOfficeBox:Bp:381 Lome-TOGO
description:client potentiel à la btci
uid=steve,ou=formation,dc=trstech,dc=net
sn:crossover
objectclass:posixAccount
objectclass:inetorgPerson
objectclass:qmailUser
cn:aquerebourou steve
uid:steve
[email protected]
uidNumber:21
gidNumber:18
homeDirectory:/home/steve
loginShell:/bin/bash
mailMessageStore:/var/steve
mailQuota:2500
Pour ajouter les entrées contenues dans le fichier ldif exécuter la commande suivante
Ldapadd –x –D “cn=Manager,dc=trstech,dc=net” –W –f fichier-ldif
Définir les index que supporte la base
Index default pres,eq
Index objectclass,uidNumber,gidNumber eq
Index cn,mail,sn,uid pres,eq,sub
Spécifier les différents schéma de l’annuaire ldap
Définir les différents schéma que dois supporter l’annuaire
Include /etc/openldap/schema/core.schema
Include /etc/openldap/schema/cosine.schema
Include /etc/openldap/schema/inetorgperson.schema
Include /etc/openldap/schema/java.schema
Include /etc/openldap/schema/misc.schema
Include /etc/openldap/schema/qmail.schema
Les Contrôles d’accès
Voici l’exemple de notre cas
Access to dn=“.*,ou=client,dc=trstech,dc=net”
By self write
By users read
By anonymous search
Access to dn=“.*,ou=fournisseur,dc=trstech,dc=net”
By self write
By users read
By anonymous search
Access to dn=“.*,dc=trstech,dc=net”
By self write
By users read
By anonymous read
Authentification des utilisateurs par bind
Access to attr=userPassword
By self write
By users compare
By anonymous auth
Authentification des utilisateurs par TLS/SSL
Configuration du client
ssl start_tls
tls_checkpeer yes
tls_cacertfile /etc/openldap/ca.crt
tls_cert /etc/openldap/ldap.crt
tls_key /etc/openldap/ldap.key
pam_password md5
tls hard
Configuration du serveur
TLSCACertificateFile /etc/openldap/ca.crt
TLSCertificateFile /etc/openldap/ldap.crt
TLSCertificateKeyFile /etc/openldap/ldap.key
Authentification par le module pam et nsswicht
Pour ce faire on modifie les fichiers /etc/pam.d/login , /etc/pam.d/passwd et le fichier /
etc/nsswicht.conf
Configuration de /etc/pam.d/login
#%PAM-1.0
auth
auth
auth
auth
account
account
password
password
password
session
#session
required
required
sufficient
required
sufficient
required
required
required
required
required
optional
/lib/security/pam_securetty.so
/lib/security/pam_nologin.so
/lib/security/pam_ldap.so
/lib/security/pam_unix_auth.so try_first_pass
/lib/security/pam_ldap.so
/lib/security/pam_unix_acct.so
/lib/security/pam_cracklib.so
/lib/security/pam_ldap.so
/lib/security/pam_pwdb.so use_first_pass
/lib/security/pam_unix_session.so
/lib/security/pam_console.so
Configuration de /etc/pam.d/passwd
#%PAM-1.0
auth
auth
account
account
password
password
password
sufficient
required
sufficient
required
required
sufficient
required
/lib/security/pam_ldap.so
/lib/security/pam_unix_auth.so use_first_pass
/lib/security/pam_ldap.so
/lib/security/pam_unix_acct.so
/lib/security/pam_cracklib.so retry=3
/lib/security/pam_ldap.so
/lib/security/pam_pwdb.so try_first_pass
Configuration de /etc/nsswicht.conf
Passwd :
Shadow :
Group :
files
files
files
ldap
ldap
ldap
Réplication de ldap
Configuration du serveur esclave
Updatedn "Manager,dc=trstech,dc=net"
Updateref host=172.18.0.25:389
Configuration du serveur maître
replica host=172.18.0.22:389
binddn="Manager,dc=trstech,dc=net"
bindmethod=simple
credentials=secret
replogfile /tmp/openldap/log
Après la configuration des deux serveurs on arrête leur processus slapd et on copie la base de
données qui stockent les informations sur le serveur maître vers le serveur esclave puis on
redémarre le processus slapd sur les deux serveurs. Ensuite il faut configurer les fichiers /
etc/hosts du maître et de l’esclave.
Configuration du fichier /etc/hosts
• Chez le maître
172.18.0.22 formation.trstech.net formation
• Chez l’escave
172.18.0.25 ldap.trstech.net
Fichier final du serveur maître LDAP
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.6 2003/02/26
15:17:50 kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include
/etc/openldap/schema/core.schema
include
/etc/openldap/schema/cosine.schema
include
/etc/openldap/schema/inetorgperson.schema
include
/etc/openldap/schema/nis.schema
include
/etc/openldap/schema/qmail.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral
ldap://root.openldap.org
pidfile
/var/run/slapd.pid
argsfile
/var/run/slapd.args
allow bind_v2
# Load dynamic backend modules:
# modulepath
/usr/sbin/openldap
# moduleload
back_bdb.la
# moduleload
back_ldap.la
# moduleload
back_ldbm.la
# moduleload
back_passwd.la
# moduleload
back_shell.la
# Sample security restrictions
#
#
Disallow clear text exchange of passwords
# disallow bind_simple_unprotected
#
#
Require integrity protection (prevent hijacking)
#
Require 112-bit (3DES or better) encryption for updates
#
Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
#
Root DSE: allow anyone to read it
#
Subschema (sub)entry DSE: allow anyone to read it
#
Other DSEs:
#
Allow self write access
#
Allow authenticated users read access
#
Allow anonymous users to authenticate
#
Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#
by self write
#
by users read
#
by anonymous auth
#
# if no access controls are present, the default policy is:
#
Allow read by all
#
# rootdn can always write!
access to attr=userPassword
by self write
by users compare
by anonymous auth
access to dn=".*,ou=client,dc=trstech,dc=net"
by self write
by users read
by anonymous search
access to dn=".*,ou=fournisseur,dc=trstech,dc=net"
by self write
by users read
by anonymous search
access to dn=".*,dc=trstech,dc=net"
by self write
by users read
by anonymous read
#######################################################################
# ldbm database definitions
#######################################################################
database
bdb
suffix
"dc=trstech,dc=net"
rootdn
"cn=Manager,dc=trstech,dc=net"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw
secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory
/var/openldap-data
# Indices to maintain
index default
pres,eq
index cn,sn,uid,mail
pres,eq,sub
index objectClass,uidNumber,gidNumber
eq
#
TLSCACertificateFile /etc/openldap/ca.crt
#TLSCACertificatePath
TLSCertificateFile /etc/openldap/ldap.crt
TLSCertificateKeyFile /etc/openldap/ldap.key
#TLSCipherSuite
#TLSRandfile /dev/urandom
#TLSVerifyclient allow
replica host=172.18.0.22:389
binddn="Manager,dc=trstech,dc=net"
bindmethod=simple
credentials=secret
replogfile /tmp/openldap/log
######################################################################
# Runtime configuration file for Exim #
######################################################################
ldap_default_servers= localhost::389 : 62.56.186.211::389
# This is a default configuration file which will operate correctly in
# uncomplicated installations. Please see the manual for a complete list
# of all the runtime configuration options that can be included in a
# configuration file. There are many more than are mentioned here. The
# manual is in the file doc/spec.txt in the Exim distribution as a plain
# ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available
# from the Exim ftp sites. The manual is also online at the Exim web sites.
#
#
#
#
This file is divided into several parts, all but the first of which are
headed by a line starting with the word "begin". Only those parts that
are required need to be present. Blank lines, and lines starting with #
are ignored.
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT
###########
# #
# Whenever you change Exim's configuration file, you *must* remember to #
# HUP the Exim daemon, because it will not pick up the new configuration #
# until you do. However, any other Exim processes that are started, for #
# example, a process started by an MUA in order to send a message, will #
# see the new configuration as soon as it is in place. #
# #
# You do not need to HUP the daemon for changes in auxiliary files that #
# are referenced from this file. They are read every time they are used. #
# #
# It is usually a good idea to test a new configuration for syntactic #
# correctness before installing it (for example, by running the command #
# "exim -C /config/file.new -bV"). #
# #
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT
###########
######################################################################
# MAIN CONFIGURATION SETTINGS #
######################################################################
# Specify your host's canonical name here. This should normally be the
fully
# qualified "official" name of your host. If this option is not set, the
# uname() function is called to obtain the name. In many cases this does
# the right thing and you need not set anything explicitly.
# primary_hostname =
# The next three settings create two lists of domains and one list of
hosts.
# These lists are referred to later in this configuration using the syntax
# +local_domains, +relay_to_domains, and +relay_from_hosts, respectively.
They
# are all colon-separated lists:
domainlist local_domains = @ : lab.trstech.net
domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1 : 62.56.186.210 : 62.56.186.211 :
62.56.186.208/28
# Most straightforward access control requirements can be obtained by
# appropriate settings of the above options. In more complicated
situations, you
# may need to modify the Access Control List (ACL) which appears later in
this
# file.
# The first setting specifies your local domains, for example:
#
# domainlist local_domains = my.first.domain : my.second.domain
#
# You can use "@" to mean "the name of the local host", as in the default
# setting above. This is the name that is specified by primary_hostname,
# as specified above (or defaulted). If you do not want to do any local
# deliveries, remove the "@" from the setting above. If you want to accept
mail
# addressed to your host's literal IP address, for example, mail addressed
to
# "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
# list. You also need to uncomment "allow_domain_literals" below. This is
not
# recommended for today's Internet.
# The second setting specifies domains for which your host is an incoming
relay.
# If you are not doing any relaying, you should leave the list empty.
However,
# if your host is an MX backup or gateway of some kind for some domains,
you
# must set relay_to_domains to match those domains. For example:
#
# domainlist relay_to_domains = *.myco.com : my.friend.org
#
# This will allow any host to relay through your host to those domains.
# See the section of the manual entitled "Control of relaying" for more
# information.
# The third setting specifies hosts that can use your host as an outgoing
relay
# to any other host on the Internet. Such a setting commonly refers to a
# complete local network as well as the localhost. For example:
#
# hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
#
# The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that
you
# have to include 127.0.0.1 if you want to allow processes on your host to
send
# SMTP mail by using the loopback address. A number of MUAs use this method
of
# sending mail.
# All three of these lists may contain many different kinds of item,
including
# wildcarded names, regular expressions, and file lookups. See the
reference
# manual for details. The lists above are used in the access control list
for
# incoming messages. The name of this ACL is defined here:
acl_smtp_rcpt = acl_check_rcpt
# You should not change that setting until you understand how ACLs work.
# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@"
character
# followed by a domain. For example, "[email protected]" is a fully
qualified
# address, but the string "caesar" (i.e. just a login name) is an
unqualified
# email address. Unqualified addresses are accepted only from local callers
by
# default. See the recipient_unqualified_hosts option if you want to permit
# unqualified addresses from remote sources. If this option is not set, the
# primary_hostname value is used for qualification.
# qualify_domain =
# If you want unqualified recipient addresses to be qualified with a
different
# domain to unqualified sender addresses, specify the recipient domain
here.
# If this option is not set, the qualify_domain value is used.
# qualify_recipient =
# The following line must be uncommented if you want Exim to recognize
# addresses of the form "user@[10.11.12.13]" that is, with a "domain
literal"
# (an IP address) instead of a named domain. The RFCs still require this
form,
# but it makes little sense to permit mail to be sent to specific hosts by
# their IP address in the modern Internet. This ancient format has been
used
# by those seeking to abuse hosts by using them for unwanted relaying. If
you
# really do want to support domain literals, uncomment the following line,
and
# see also the "domain_literal" router below.
# allow_domain_literals
# No deliveries will ever be run under the uids of these users (a colon# separated list). An attempt to do so causes a panic error to be logged,
and
# the delivery to be deferred. This is a paranoic safety catch. Note that
the
# default setting means you cannot deliver mail addressed to root as if it
# were a normal user. This isn't usually a problem, as most sites have an
alias
# for root that redirects such mail to a human administrator.
never_users = root
#
#
#
#
The setting below causes Exim to do a reverse DNS lookup on all incoming
IP calls, in order to get the true host name. If you feel this is too
expensive, you can specify the networks for which a lookup is done, or
remove the setting entirely.
host_lookup = *
# The settings below, which are actually the same as the defaults in the
# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
# calls. You can limit the hosts to which these calls are made, and/or
change
# the timeout that is used. If you set the timeout to zero, all RFC 1413
calls
# are disabled. RFC 1413 calls are cheap and can provide useful information
# for tracing problem messages, but some hosts and firewalls have problems
# with them. This can result in a timeout instead of an immediate refused
# connection, leading to delays on starting up an SMTP session.
rfc1413_hosts = *
rfc1413_query_timeout = 30s
# By default, Exim expects all envelope addresses to be fully qualified,
that
# is, they must contain both a local part and a domain. If you want to
accept
# unqualified addresses (just a local part) from certain hosts, you can
specify
# these hosts by setting one or both of
#
# sender_unqualified_hosts =
# recipient_unqualified_hosts =
#
# to control sender and recipient addresses, respectively. When this is
done,
# unqualified addresses are qualified using the settings of qualify_domain
# and/or qualify_recipient (see above).
# If you want Exim to support the "percent hack" for certain domains,
# uncomment the following line and provide a list of domains. The "percent
# hack" is the feature by which mail addressed to x%y@z (where z is one of
# the domains listed) is locally rerouted to x@y and sent on. If z is not
one
# of the "percent hack" domains, x%y is treated as an ordinary local part.
This
# hack is rarely needed nowadays; you should not enable it unless you are
sure
# that you really need it.
#
# percent_hack_domains =
#
# As well as setting this option you will also need to remove the test
# for local parts containing % in the ACL definition below.
# When Exim can neither deliver a message nor return it to sender, it
"freezes"
# the delivery error message (aka "bounce message"). There are also other
# circumstances in which messages get frozen. They will stay on the queue
for
# ever unless one of the following options is set.
# This option unfreezes frozen bounce messages after two days, tries
# once more to deliver them, and ignores any delivery failures.
ignore_bounce_errors_after = 2d
# This option cancels (removes) frozen messages that are older than a week.
timeout_frozen_after = 7d
######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
######################################################################
begin acl
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
acl_check_rcpt:
# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.
accept hosts = :
# Deny if the local part contains @ or % or / or | or !. These are rarely
# found in genuine local parts, but are often tried by people looking to
# circumvent relaying restrictions.
#
#
#
#
Also deny if the local part starts with a dot. Empty components aren't
strictly legal in RFC 2822, but Exim allows them because this is common.
However, actually starting with a dot may cause trouble if the local part
is used as a file name (e.g. for a mailing list).
deny local_parts = ^.*[@%!/|] : ^\\.
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept local_parts = postmaster
domains = +local_domains
# Deny unless the sender address can be verified.
require verify = sender
###########################################################################
##
# There are no checks on DNS "black" lists because the domains that contain
# these lists are changing all the time. However, here are two examples of
# how you could get Exim to perform a DNS black list lookup at this point.
# The first one denies, while the second just warns.
#
# deny message = rejected because $sender_host_address is in a black list
at $dnslist_domain\n$dnslist_text
# dnslists = black.list.example
#
# warn message = X-Warning: $sender_host_address is in a black list at
$dnslist_domain
# log_message = found in $dnslist_domain
# dnslists = black.list.example
###########################################################################
##
#
#
#
#
Accept if the address is in a local domain, but only if the recipient can
be verified. Otherwise deny. The "endpass" line is the border between
passing on to the next ACL statement (if tests above it fail) or denying
access (if tests below it fail).
accept domains = +local_domains
endpass
message = unknown user
verify = recipient
# Accept if the address is in a domain for which we are relaying, but
again,
# only if the recipient can be verified.
accept domains = +relay_to_domains
endpass
message = unrouteable address
verify = recipient
# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.
# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are dumb MUAs that don't cope well with SMTP error
# responses. If you are actually relaying out from MTAs, you should
probably
# add recipient verification here.
accept hosts = +relay_from_hosts
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.
accept authenticated = *
# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.
deny message = relay not permitted
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
######################################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
######################################################################
begin routers
#
#
#
#
#
#
#
#
This router routes to remote hosts over SMTP by explicit IP address,
when an email address is given in "domain literal" form, for example,
<user@[192.168.35.64]>. The RFCs require this facility. However, it is
little-known these days, and has been exploited by evil people seeking
to abuse SMTP relays. Consequently it is commented out in the default
configuration. If you uncomment this router, you also need to uncomment
allow_domain_literals above, so that Exim can recognize the syntax of
domain literal addresses.
#
#
#
#
domain_literal:
driver = ipliteral
domains = ! +local_domains
transport = remote_smtp
# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a
# loopback interface address (127.0.0.0/8) is treated as if it had no DNS
# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly
treated
# as the local host inside the network stack. It is not 0.0.0.0/0, the
default
# route. If the DNS lookup fails, no further routers are tried because of
# the no_more setting, and consequently the address is unrouteable.
dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more
# The remaining routers handle addresses in the local domain(s).
# This router handles aliasing using a linearly searched alias file with
the
# name /etc/aliases. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /
etc/aliases.
# If you install this configuration by hand, you need to specify the
correct
# path in the "data" setting below.
#
##### NB You must ensure that the alias file exists. It used to be the case
##### NB that every Unix had that file, because it was the Sendmail
default.
##### NB These days, there are systems that don't have it. Your aliases
##### NB file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively,
you
# can specify "user" on the transports that are used. Note that the
transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.
system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/aliases}}
#utilisateurs virtuels avec LDAP
Ldap_aliases:
driver = redirect
data = ${lookup ldap \
{user="cn=Manager,dc=trstech,dc=net" pass=secret \
ldap:///dc=trstech,dc=net?uid?sub? \
(uid=${quote_ldap:$local_part})}}
redirect_router = ldap_localuser
no_more
# ldap:///\
# uid=${quote_ldap:$local_part},dc=trstech,dc=net }}
# user = exim
file_transport = address_file
pipe_transport = address_pipe
# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a
forward
# file starts with the string "# Exim filter", uncomment the "allow_filter"
# option.
# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped
if
# Exim is processing an EXPN command.
#
#
#
#
The check_ancestor option means that if the forward file generates an
address that is an ancestor of the current one, the current one gets
passed on instead. This covers the case where A is aliased to B and B
has a .forward file pointing to A.
# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.
userforward:
driver = redirect
check_local_user
file = $home/.forward
no_verify
no_expn
check_ancestor
# allow_filter
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
# This router matches local user mailboxes.
#ldap_localuser:
# driver = accept
# transport= maildir_delivery
localuser:
driver = accept
check_local_user
transport = local_delivery
# ldap_local delivery
ldap_localuser:
driver = accept
transport= maildir_delivery
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################
# A transport is used only when referenced from a router that successfully
# handles an address.
begin transports
# This transport is used for delivering messages over SMTP connections.
remote_smtp:
driver = smtp
# This transport is used for local delivery to user mailboxes in
traditional
# BSD mailbox format. By default it will be run under the uid and gid of
the
# local user, and requires the sticky bit to be set on the /var/mail
directory.
# Some systems use the alternative approach of running mail deliveries
under a
# particular group instead of using the sticky bit. The commented options
below
# show how this can be done.
local_delivery:
driver = appendfile
file = ${lookup ldapm \
{user="cn=Manager,dc=trstech,dc=net" pass=secret \
ldap:///dc=trstech,dc=net?mailMessageStore?sub? (uid=$
{quote_ldap:$local_part})}}/$local_part
# file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
user = exim
group =exim
# maildir_delivery transport
maildir_delivery:
driver = appendfile
directory = ${lookup ldapm \
{user="cn=Manager,dc=trstech,dc=net" pass=secret \
ldap:///dc=trstech,dc=net?mailMessageStore?sub? (uid=$
{quote_ldap:$local_part})}}/Maildir
maildir_format
delivery_date_add
envelope_to_add
return_path_add
user = exim
group = exim
quota =${lookup ldapm \
{user="cn=manager,dc=trstech,dc=net" pass=secret \
ldap:///dc=trstech,dc=net?mailQuota?sub? (uid=${quote_ldap:$local_part})}}
# group = mail
# mode = 0660
# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe
fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the
routers
# section above.
address_pipe:
driver = pipe
return_output
# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
# This transport is used for handling autoreplies generated by the
filtering
# option of the userforward router.
address_reply:
driver = autoreply
######################################################################
# RETRY CONFIGURATION #
######################################################################
begin retry
# This single retry rule applies to all domains and all errors. It
specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the
first
# failed delivery.
# Domain Error Retries
# ------ ----- ------* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
######################################################################
# REWRITE CONFIGURATION #
######################################################################
# There are no rewriting specifications in this default configuration file.
begin rewrite
######################################################################
# AUTHENTICATION CONFIGURATION #
######################################################################
# There are no authenticator specifications in this default configuration
file.
begin authenticators
######################################################################
# CONFIGURATION FOR local_scan() #
######################################################################
# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember
to
# uncomment the "begin" line. It is commented by default because it
provokes
# an error with Exim binaries that are not built with
LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.
# begin local_scan
# End of Exim configuration file
CONFIGURATION DE NFS
Niveau serveur
Avant tout assurer vous que le service nfs est fonctionnel sur votre système ensuite
veuillez bien suivre ces étapes :
o Créer le répertoire réseau à monter (mkdir /usr/mail)
o Changer le propriété du dit répertoire par l’utilisateur exim (# chown exim:exim
/usr/mail)
o Editer le fichier /etc/exports et y insérer la ligne suivante
/usr/mail
62.56.186.208/28 (rw)
o Editer le fichier /etc/hosts.allow et modifier cedernier par ceci :
Portmap : 62.56.186.208/255.255.255.240 : allow
o Portmap : ALL : deny
Créér un répertoire /mail sur lequel vous ferez un lien symbolique(mkdir /mail et ln –s /mail /
usr/mail )
o Enfin redémarrer votre serveur nfs
Niveau client
Montage des systèmes de fichiers nfs par fstab
o Créer le répertoire /mail
o Modifier le fichier /etc/fstab par cette ligne :
62.56.186.211:/usr/mail
/mail
nfs
defaults
0 0
o Redémarrer la machine pour la permettre de prendre en compte les changement
et monter manuellement le répertoire /mail
Montage des systèmes de fichiers nfs par autofs
o éditer le fichier /etc/auto.master et y insérer la ligne suivante
/auto /etc/auto.misc
o éditer le fichier /etc/auto.misc et y ajouter la ligne suivante
mail -rw,soft,intr,rsize=8192,wsize=8192
62.56.186.211:/usr/mail
o enfin rédemarrer le service autofs
o
Finalement pour permettre au client et au serveur nfs d’avoir le même mailMessageStore il
faudra alors faire ces deux opérations :
Créer le répertoire /auto sur le serveur nfs
Ensuite faire un lien symbolique de /auto/mail vers /usr/mail(ln –s /usr/mail /auto/mail)
CONFIGURATION de Courier-imap avec LDAP
Avant tout il faudra installer le courier imap pour cette raison il nous faudra récupérer le fichier
source sur http://www.courier-mta.org/download.php#imap.
Après archivage et installation de la source en suivant convenablement les instructions dans le
fichier INSTALL de courier-imap il convient de tester pour voir si le courier-imap fonctionne
normal et ceci à l’aide ceci « /usr/courier-imap-2.0.0/libexec/pop3d.rc start il faut faire un telnet
sur la machine en question précisément sur le port 110. Après ceci il devient important de
configuirer le fichier d’authentification de ldap c’est à dire le fichier authldaprc
Voici notre exemple :
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
Copyright 2000-2001 Double Precision, Inc.
distribution information.
See COPYING for
Do not alter lines that begin with ##, they are used when upgrading
this configuration.
authldaprc created from authldaprc.dist by sysconftool
DO NOT INSTALL THIS FILE with world read permissions.
might contain the LDAP admin password!
This file
This configuration file specifies LDAP authentication parameters
The format of this file must be as follows:
field[spaces|tabs]value
That is, the name of the field, followed by spaces or tabs, followed by
field value. No trailing spaces.
Here are the fields:
##NAME: LOCATION:0
#
# Location of your LDAP server:
LDAP_SERVER
#LDAP_SERVER
LDAP_PORT
#LDAP_SERVER
#LDAP_PORT
62.56.186.211
62.56.186.210
389
ldap.example.com
389
##NAME: LDAP_BASEDN:0
#
# Look for authentication here:
LDAP_BASEDN
#LDAP_BASEDN
dc=trstech, dc=net
o=example, c=net
##NAME: LDAP_BINDDN:0
#
# You may or may not need to specify the following. Because you've got
# a password here, authldaprc should not be world-readable!!!
LDAP_BINDDN
LDAP_BINDPW
#LDAP_BINDDN
cn=Manager, dc=trstech, dc=net
secret
cn=administrator, o=example, c=com
#LDAP_BINDPW
toto
##NAME: LDAP_TIMEOUT:0
#
# Timeout for LDAP search
LDAP_TIMEOUT
5
##NAME: LDAP_AUTHBIND:0
#
# Define this to have the ldap server authenticate passwords. If
LDAP_AUTHBIND
# the password is validated by rebinding with the supplied userid and
password.
# If rebind succeeds, this is considered to be an authenticated request.
This
# does not support CRAM-MD5 authentication, which requires userPassword.
#
# LDAP_AUTHBIND
1
LDAP_AUTHBIND
1
##NAME: LDAP_MAIL:0
#
# Here's the field on which we query
#LDAP_MAIL
#LDAP_MAIL
LDAP_MAIL
mailMessageStore
mail
mail
##NAME: LDAP_FILTER:0
#
# This LDAP filter will be ANDed with the query for the field defined above
# in LDAP_MAIL. So if you are querying for mail, and you have LDAP_FILTER
# defined to be "(objectClass=CourierMailAccount)" the query that is
performed
# will be "(&(objectClass=CourierMailAccount)(mail=<someAccount>))"
#
# LDAP_FILTER
(objectClass=CourierMailAccount)
LDAP_FILTER
(objectClass=qmailUser)
#LDAP_FILTER
(&(objectClass=qmailUser)(mail=<posixAccount>))
#LDAP_FILTER
(&(objectClass=posixAccount)
(mailMessageStore=qmailUser))
#LDAP_FILTER
(&(objectClass=shadowAccount)(mail=posixAccount))
##NAME: LDAP_DOMAIN:0
#
# The following default domain will be appended, if not explicitly
specified.
#
# LDAP_DOMAIN
example.com
LDAP_DOMAIN
lab.trstech.net
##NAME: LDAP_GLOB_IDS:0
#
# The following two variables can be used to set everybody's uid and gid.
# This is convenient if your LDAP specifies a bunch of virtual mail
accounts
# The values can be usernames or userids:
#
# LDAP_GLOB_UID
vmail
# LDAP_GLOB_GID
vmail
LDAP_GLOB_UID
LDAP_GLOB_GID
exim
exim
##NAME: LDAP_HOMEDIR:0
#
# We will retrieve the following attributes
#
# The HOMEDIR attribute MUST exist, and we MUST be able to chdir to it
LDAP_HOMEDIR
#LDAP_HOMEDIR
mailMessageStore
homeDirectory
##NAME: LDAP_MAILROOT:0
#
# If homeDirectory is not an absolute path, define the root of the
# relative paths in LDAP_MAILROOT
#
# LDAP_MAILROOT
/var/mail
##NAME: LDAP_MAILDIR:0
#
# The MAILDIR attribute is OPTIONAL, and specifies the location of the
# mail directory. If not specified, ./Maildir will be used
LDAP_MAILDIR
#LDAP_MAILDIR
#LDAP_MAILDIR
mailMessageStore
./Maildir
mailbox
##NAME: LDAP_DEFAULTDELIVERY:0
#
# Courier mail server only: optional attribute specifies custom mail
delivery
# instructions for this account (if defined) -- essentially overrides
# DEFAULTDELIVERY from ${sysconfdir}/courierd
LDAP_DEFAULTDELIVERY
defaultDelivery
##NAME: LDAP_MAILDIRQUOTA:0
#
# The following variable, if defined, specifies the field containing the
# maildir quota, see README.maildirquota for more information
#
# LDAP_MAILDIRQUOTA
quota
##NAME: LDAP_FULLNAME:0
#
# FULLNAME is optional, specifies the user's full name
LDAP_FULLNAME
cn
##NAME: LDAP_PW:0
#
# CLEARPW is the clear text password. CRYPT is the crypted password.
# ONE OF THESE TWO ATTRIBUTES IS REQUIRED. If CLEARPW is provided, and
# libhmac.a is available, CRAM authentication will be possible!
#LDAP_CLEARPW
LDAP_CRYPTPW
clearPassword
userPassword
##NAME: LDAP_IDS:0
#
# Uncomment the following, and modify as appropriate, if your LDAP database
# stores individual userids and groupids. Otherwise, you must uncomment
# LDAP_GLOB_UID and LDAP_GLOB_GID above. LDAP_GLOB_UID and LDAP_GLOB_GID
# specify a uid/gid for everyone. Otherwise, LDAP_UID and LDAP_GID must
# be defined as attributes for everyone.
#
# LDAP_UID
uidNumber
# LDAP_GID
gidNumber
##NAME: LDAP_DEREF:0
#
# Determines how aliases are handled during a search. This option is
available
# only with OpenLDAP 2.0
#
# LDAP_DEREF can be one of the following values:
# never, searching, finding, always. If not specified, aliases are
# never dereferenced.
LDAP_DEREF
never
##NAME: LDAP_TLS:0
#
# Set LDAP_TLS to 1 to enable LDAP over SSL/TLS.
# Requires OpenLDAP 2.0
#
LDAP_TLS
Experimental setting.
0
##NAME: LDAP_EMAILMAP:0
#
# The following optional settings, if enabled, result in an extra LDAP
# lookup to first locate a handle for an E-mail address, then a second
lookup
# on that handle to get the actual authentication record. You'll need
# to uncomment these settings to enable an email handle lookup.
#
# The E-mail address must be of the form user@realm, and this is plugged
# into the following search string. "@user@" and "@realm@" are
placeholders
# for the user and the realm portions of the login ID.
#
# LDAP_EMAILMAP
(&(userid=@user@)(realm=@realm@))
##NAME: LDAP_EMAILMAP_BASEDN:0
#
# Specify the basedn for the email lookup.
#
# LDAP_EMAILMAP_BASEDN o=emailmap, c=com
The default is LDAP_BASEDN.
##NAME: LDAP_EMAILMAP_ATTRIBUTE:0
#
# The attribute which holds the handle. The contents of this attribute
# are then plugged into the regular authentication lookup, and you must set
# LDAP_EMAILMAP_MAIL to the name of this attribute in the authentication
# records (which may be the same as LDAP_MAIL).
# You MUST also leave LDAP_DOMAIN undefined. This enables authenticating
# by handles only.
#
# Here's an example:
#
# dn: userid=john, realm=example.com, o=emailmap, c=com #
LDAP_EMAILMAP_BASEDN
# userid: john
# LDAP_EMAILMAP search
# realm: example.com
# LDAP_EMAILMAP search
# handle: cc223344
# LDAP_EMAILMAP_ATTRIBUTE
#
#
# dn: controlHandle=cc223344, o=example, c=com
# LDAP_BASEDN
# controlHandle: cc223344
# LDAP_EMAILMAP_MAIL set to
"controlHandle"
# uid: ...
# gid: ...
# [ etc... ]
#
# LDAP_EMAILMAP_ATTRIBUTE handle
##NAME: LDAP_EMAILMAP_MAIL:0
#
# After reading LDAP_EMAIL_ATTRIBUTE, the second query will go against
# LDAP_BASEDN, but will key against LDAP_EMAILMAP_MAIL instead of
LDAP_MAIL.
#
# LDAP_EMAILMAP_MAIL mail
Liste des RFC
rfc2254
rfc3377
rfc2255
rfc2253
rfc2255
rfc2830
rfc2256
rfc2829
rfc2307
rfc2252
rfc2251