Using Perdition With ISPMan

Updated: January 14, 2004

by Tony Wasson (wasson at azxws.com)



As an ISPMan administrator, you'll use Perdition to let users login with user@domain.com or user_domain_com. You can also use it to append a domain name onto a username. You can also use Perdition as a “traffic directory” during email migration, however that is outside the scope of this document.

Setting Up Perdition

1) If running ISPMan 1.0 or higher, skip this step..

Older releases did not support the 2 UIDs (userids) for all users by default. You need to run "ispman.fixUsers" to create both UIDs. You need to make sure all new users have 2 UIDs also, so you can either make “ispman.fixUsers” a cron job . On 0.9.7 you can patch ISPMan to do this for all new users by changing users.ldif.template like so:

After the 1st UID line, add this:

uid: join '@', ($r->param("userid"), $r->param("ispmanDomain"))


2) Make sure you have access to your LDAP server(s)

You may have to edit tcpwrappers (/etc/hosts.allow), iptables/ipchains or other firewall rules depending on your security setup.

ldapsearch -xvu -h 127.0.0.1 -LLL -b "o=ispman" ispmanVar=*

3) Verify the LDAP server is reachable, something like this works well


4) Install perdition

You can use packages for your distribution, or compile from source available from: http://www.vergenet.net/linux/perdition/download/

#apt-get install perdition perdition-ldap


5) Configure Perdition

    Keep in mind that your map_libary file may be in a different location.When you “go live” you should have multiple LDAP servers. As long as they are all on standard ports, set these up on the map_library_opt line.


A basic /etc/perdition/perdition.conf looks like so:

map_library /usr/lib/libperditiondb_ldap.so.0
map_library_opt "ldap://127.0.0.1/o=ispman?mailroutingaddress?sub?(uid=%25s)"
server_ok_line
username_from_database

A single domain setup config file will probably look more like

map_library /usr/lib/libperditiondb_ldap.so.0
# The following map_library_opt line needs to be on a single line
# Customize the @azxws.com to match your domain.
map_library_opt “ldap://127.0.0.1//o=ispman?mailroutingaddress?sub?(uid=%25s@azxws.com)"
server_ok_line
username_from_database


A multi-LDAP server config file will probably look more like :

map_library /usr/lib/libperditiondb_ldap.so.0
# The following map_library_opt line needs to be on a single line
map_library_opt “ldap://127.0.0.1 192.168.2.10 192.168.3.10 \
/o=ispman?mailroutingaddress?sub?(uid=%25s)"
server_ok_line
username_from_database

6) Make sure Perdition starts on bootup and start it manually now

/etc/init.d/perdition start


7) Verify the account and password are correct by logging in directly

against the mail server. I usually do something like this on the mail server:


  telnet localhost 110
  USER user_domain_com
  PASS thepassword

Then I repeat these steps using my new Perdition proxy. If it fails, check the logs (perdition uses syslog). You may also use a system debugger (like strace) and a network sniffer to verify LDAP is functioning. I have also had good success setting an outgoing_server in perdition.conf as a debugging measure


Once you have underscore names working, use the user@domain.com name through Perdition. Voila! It works...

On a side note, you'll most likely want to setup postfix to do SMTP authentication. It's pretty easy to get PLAIN and LOGIN working. If you want other mechanisms, you'll need to work harder. Remember, since there are two UIDs, either user@domain.com and user_domain_com works.


FAQ:


Q: I got this error: perdition[10905]: dlopen of "/usr/lib/libperditiondb_ldap.so.0" failed, what should I check?

A: This is usually a configuration problem. First verify that your map_library_opt line is correct and has no word wrap. Next check your config file like so:

grep -v '^#' /etc/perdition/perdition.conf



Single Server Perdition Trick

If you have a small installation and want this on the same machine as Cyrus 2.1, you can set it up like so perdition listens on the outside IP and Cyrus listens on localhost. Note that you will need to make sure any webmail programs point to the external IP address so that users can login with their email address as their username.


In /etc/cyrus.conf edit these two lines and restart cyrus:

imap   cmd="imapd -U 30" listen="localhost:imap" prefork=0 maxchild=100
pop3   cmd="pop3d -U 30" listen="localhost:pop3" prefork=0 maxchild=50

In /etc/perdition/perdition.conf add these lines and restart perdition:

bind_address XXX.XXX.XXX.XXX  <--- Must be outside IP
outgoing_server 127.0.0.1

Ensure that your hostname resolves to 127.0.0.1.

This prevents Perdition from connecting back to itself in a loop.


NOTE: I've also seen people setup cyrus to listen on alternate pop and imap ports. This can work too, the choice is up to you.

For More Information:


1) Read the Perdition man pages.


2) Visit the Perdition website

http://www.vergenet.net/linux/perdition/


3) Read Configuring Perdition Proxy Software to Use an Existing LDAP Server

http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf