Re: [AMaViS-user] : @local_domains_maps and LDAP

2009-02-16 Thread Quanah Gibson-Mount 
--On Thursday, February 12, 2009 4:23 PM +0100 Mark Martinec 
 wrote:

> No need to have a static @local_domain_maps prepared from data in LDAP.

Thanks, we've worked out a solution that doesn't involve using 
@local_domain_maps.

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] @local_domains_maps and LDAP

2009-02-12 Thread Michael Hall 
On Mon, Feb 02, 2009 at 11:50:46AM -0800, Quanah Gibson-Mount wrote:

> --On Monday, February 02, 2009 9:40 AM -0800 Quanah Gibson-Mount 
>  wrote:
> 
> > The question comes from our desire to not put X-SPAM headers on local
> > domains, usually listed in @local_domains_maps.  This becomes a problem,
> > however, in an environment where you're hosting thousands of domains, as
> > having to continually modify and update a static list of domains becomes
> > quite ugly.  What is desired is to instead have amavis populate what it
> > considers to be the members of @local_domain_maps from LDAP instead.  So,
> > is that possible? ;)
> 
> Well, really all amavis needs to do is be able to query whether or not a 
> given domain should be considered local, rather than having a stored list 
> of domains.

Amavis already does exactly that with LDAP, the stored list is basically
unused. I guess its not clear in the docs, but README.ldap, particulary
section "Special handling of the optional LDAP attribute 'amavisLocal'".
In essence if the recipient address (or domain) is found, and 'amavisLocal'
is not set or is set to 'true' it is considered local, you explicity have
to set 'amavisLocal' to 'false' to override being considered local.

We use:

@local_domains_maps =
( read_hash('/usr/local/etc/postfix/virtual_mailbox_domains') );

and amavis gets stopped/started at least once a day, which is good
enough for us as its not generally needed or used.

Unless the above behavior is not desireable or I'm misunderstanding
something I believe amavis already does the right thing and using LDAP
to populate a list/file doesn't achieve the final goal of who is local
or not.

--
Don't tell fish stories where the people know you, but
particularly, don't tell them where they know the fish.
   -- Mark Twain

Mike Hall
San Juan Island, WA

System Admin - Rock Island Technology Solutions 
System Admin - riverside.org, ssdd.org  

--
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] : @local_domains_maps and LDAP

2009-02-12 Thread Mark Martinec 
Quanah,

> The question has to do with the having @local_domains_maps being populated
> from LDAP instead of hard coded. That's what I don't see being possible
> with Amavis in its current state.

Populating @local_domains_maps is a wrong question, and represents
a non-database approach. The question amavisd lookups need to answer
is whether a given e-mail address (or its domain) is local or not.
A database approach is: query on a domain, and obtain a true/false reply.
A non-database approach is: load the list of local domains into memory
and then search it, which becomes impractical with a large number
of local domains.

> filter="(&(objectClass=amavisAccount)(|([email protected])
>   ([email protected])([email protected])([email protected])(ma...@.)))" 
> As you can see, the very first thing that happens is that the query is
> isolated only to items containing amavisAccount (i.e., an account object).
> Second, the query is limited to the mail=xxx attribute.

query_filter is configurable, match it to your schema.
The (&(objectClass=amavisAccount)(mail=%m)) is just its default.

> The question comes from our desire to not put X-SPAM headers on local
> domains, usually listed in @local_domains_maps.  This becomes a problem,
> however, in an environment where you're hosting thousands of domains, as
> having to continually modify and update a static list of domains becomes
> quite ugly.  What is desired is to instead have amavis populate what it
> considers to be the members of @local_domain_maps from LDAP instead.  So,
> is that possible? ;)

Yes and no - @local_domain_maps can't be populated from LDAP (but that
is not needed), and yes, obtaining yes/no answers from LDAP to a
question 'is this domain local' is possible, which is all that amavisd
cares about.

> So, is there any chance that amavis will be reworked to
> more realistically support sites with large domains?

I fail to see a need to this.

> Well, really all amavis needs to do is be able to query whether or not a 
> given domain should be considered local, rather than having a stored list 
> of domains.

This is already how it works.

See also a section
  Special handling of optional LDAP attribute 'amavisLocal'
in README.ldap.

> Thanks, although the point I'm trying to get at here, is to avoid doing
> things exactly like what you are doing.  I.e., Amavis understands and uses
> LDAP.  Therefore, one should be able to configure it to use the data
> already stored in LDAP, rather than to do things like write a script
> that'll stop amavis, edit it to update the domain list, and then restart
> it, every 15 minutes.

No need to have a static @local_domain_maps prepared from data in LDAP.

  Mark

--
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] : @local_domains_maps and LDAP

2009-02-11 Thread Quanah Gibson-Mount 


--On February 3, 2009 12:57:46 PM -0800 Quanah Gibson-Mount 
 wrote:

> Thanks, although the point I'm trying to get at here, is to avoid doing
> things exactly like what you are doing.  I.e., Amavis understands and
> uses  LDAP.  Therefore, one should be able to configure it to use the
> data  already stored in LDAP, rather than to do things like write a
> script  that'll stop amavis, edit it to update the domain list, and then
> restart  it, every 15 minutes.

Crickets again...  So, is there any chance that amavis will be reworked to 
more realistically support sites with large domains?

Thanks!

--Quanah


--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] : @local_domains_maps and LDAP

2009-02-03 Thread Quanah Gibson-Mount 
--On Tuesday, February 03, 2009 12:43 PM -0800 "Hugo Slabbert (i-worx)" 
 wrote:

> Hi Quanah,
>
> I don't have a solid answer for you, as I've not implemented this for
> amavisd-new, but maybe I can point you in the right direction. I modified
> some existing Perl scripts that were originally intended to poll AD for a
> list of accepted e-mail aliases to also get a list of accepted domains
> for Exchange. Exchange stores a lot of its config in AD, so this wasn't
> too tough.

Thanks, although the point I'm trying to get at here, is to avoid doing 
things exactly like what you are doing.  I.e., Amavis understands and uses 
LDAP.  Therefore, one should be able to configure it to use the data 
already stored in LDAP, rather than to do things like write a script 
that'll stop amavis, edit it to update the domain list, and then restart 
it, every 15 minutes.

--Quanah


--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] : @local_domains_maps and LDAP

2009-02-03 Thread Hugo Slabbert (i-worx) 
Hi Quanah,

I don't have a solid answer for you, as I've not implemented this for 
amavisd-new, but maybe I can point you in the right direction. I modified some 
existing Perl scripts that were originally intended to poll AD for a list of 
accepted e-mail aliases to also get a list of accepted domains for Exchange. 
Exchange stores a lot of its config in AD, so this wasn't too tough.

The list of accepted domains in an Exchange environment (at least for 2007) is 
found at "CN=Accepted Domains,CN=Transport Settings,CN=[your exchange org 
name],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=i-worx,DC=ca". The 
accepted domain object has an objectCategory of " msExchAcceptedDomain" and the 
actual domain name is stored in the "msExchAcceptedDomainName" attribute of 
that object. 

For our Postfix purposes we pull the complete list of accepted domains 
(extracting only their "msExchAcceptedDomainName" value, print that into a 
file, postmap it, and give it to Postfix as its accepted domains list. The perl 
script is cron'd to run every 15 minutes, as we don't want to bounce stuff 
that's already being accepted on the Exchange side just because Postfix had not 
yet been updated.

I don't know if that's useful to you as you were referring just to LDAP in 
general rather than to an Exchange environment in particular, but hopefully 
it's of some use.

Date: Mon, 02 Feb 2009 11:50:46 -0800
From: Quanah Gibson-Mount 
Subject: Re: [AMaViS-user] @local_domains_maps and LDAP
To: Mark Martinec ,
[email protected]
Message-ID: 
Content-Type: text/plain; charset=us-ascii; format=flowed

--On Monday, February 02, 2009 9:40 AM -0800 Quanah Gibson-Mount 
 wrote:

> The question comes from our desire to not put X-SPAM headers on local
> domains, usually listed in @local_domains_maps.  This becomes a problem,
> however, in an environment where you're hosting thousands of domains, as
> having to continually modify and update a static list of domains becomes
> quite ugly.  What is desired is to instead have amavis populate what it
> considers to be the members of @local_domain_maps from LDAP instead.  So,
> is that possible? ;)

Well, really all amavis needs to do is be able to query whether or not a 
given domain should be considered local, rather than having a stored list 
of domains.

--Quanah



Hugo Slabbert



--
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] @local_domains_maps and LDAP

2009-02-02 Thread Quanah Gibson-Mount 
--On Monday, February 02, 2009 9:40 AM -0800 Quanah Gibson-Mount 
 wrote:

> The question comes from our desire to not put X-SPAM headers on local
> domains, usually listed in @local_domains_maps.  This becomes a problem,
> however, in an environment where you're hosting thousands of domains, as
> having to continually modify and update a static list of domains becomes
> quite ugly.  What is desired is to instead have amavis populate what it
> considers to be the members of @local_domain_maps from LDAP instead.  So,
> is that possible? ;)

Well, really all amavis needs to do is be able to query whether or not a 
given domain should be considered local, rather than having a stored list 
of domains.

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] @local_domains_maps and LDAP

2009-02-02 Thread Quanah Gibson-Mount 
--On Saturday, January 31, 2009 5:06 PM +0100 Mark Martinec 
 wrote:

> Quanah,
>
>> I would like to have amavis query the list of domains from our LDAP
>> server.  However, after reading over README.lookups and README.ldap, I
>> don't see an  obvious way to do this.  The amavis schema
>> () is geared toward
>> individual account objects, doesn't have a domain attribute, and
>> LDAP-wise,  storing all the domains on each account would be somewhat
>> silly.
>
> The LDAP query keys follow closely the SQL approach, and is similar
> to hash-type lookups, i.e. the following queries are tried in that order
> (README.lookups), until one succeeds, i.e. the first match wins:


The question has to do with the having @local_domains_maps being populated 
from LDAP instead of hard coded. That's what I don't see being possible 
with Amavis in its current state.  The queries that amavis forms are along 
the lines of:

Feb  2 09:24:48 dogfood slapd[31382]: conn=383233 op=55 SRCH base="" 
scope=2 deref=2 
filter="(&(objectClass=amavisAccount)(|([email protected])([email protected])([email protected])([email protected])(ma...@.)))"

As you can see, the very first thing that happens is that the query is 
isolated only to items containing amavisAccount (i.e., an account object). 
Second, the query is limited to the mail=xxx attribute.

The question comes from our desire to not put X-SPAM headers on local 
domains, usually listed in @local_domains_maps.  This becomes a problem, 
however, in an environment where you're hosting thousands of domains, as 
having to continually modify and update a static list of domains becomes 
quite ugly.  What is desired is to instead have amavis populate what it 
considers to be the members of @local_domain_maps from LDAP instead.  So, 
is that possible? ;)

Thanks!

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] @local_domains_maps and LDAP

2009-01-31 Thread Mark Martinec 
Quanah,

> I would like to have amavis query the list of domains from our LDAP
> server.  However, after reading over README.lookups and README.ldap, I
> don't see an  obvious way to do this.  The amavis schema
> () is geared toward
> individual account objects, doesn't have a domain attribute, and
> LDAP-wise,  storing all the domains on each account would be somewhat
> silly.

The LDAP query keys follow closely the SQL approach, and is similar
to hash-type lookups, i.e. the following queries are tried in that order
(README.lookups), until one succeeds, i.e. the first match wins:

 - lookup for [email protected]
 - lookup for [email protected] (only if $recipient_delimiter is '+')
 - lookup for user+foo (only if domain part is local)
 - lookup for user (only local; only if $recipient_delimiter is '+')
 - lookup for @example.com
 - lookup for @.example.com
 - lookup for @.com
 - lookup for @.   (catchall)

With the introduction of the $ldap_lookups_no_at_means_domain setting,
you get a choice between lists of query keys:

  $ldap_lookups_no_at_means_domain = 0;  # default
[email protected], user, @example.com, @.example.com, @.com, @.

  $ldap_lookups_no_at_means_domain = 1;
[email protected], user@, example.com, .example.com, .com, .

> Neither lookup_ldap() or lookup_ldap_attr() seem geared towards this type
> of query, as they both key off email ID.

The mail address gets stripped of its parts repeatedly. A LDAP database
can hold any keys it wants, either full email addresses with a local part,
or just domains or even a wildcard, or any mix. Normaly there would be
an entry for each local domain with its default attributes, plus individual
user overrides if necessary,

The first query giving a result provides a value. You should have key/value
pairs for all your local domains, each providing a amavisLocal=True,
which fully specifies the set of local domains in LDAP. If necessary other
per-domain attributes can be provided at the domain level too.

> I've seen that people have asked how to do this in the past, as well, and
> gotten no response.
>
> So:
>
> (a) Is it even possible to do what I want
> and
> (b) Is there any documentation that exists, or can someone provide some
> useful examples, if it is possible? :)

Is the above what you are asking for (which I assumed you already know),
or did I misunderstand the question?

  Mark

--
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] @local_domains_maps and LDAP

2009-01-30 Thread Quanah Gibson-Mount 
--On Tuesday, December 18, 2007 11:26 AM -0800 Quanah Gibson-Mount 
 wrote:

> I would like to have amavis query the list of domains from our LDAP
> server.  However, after reading over README.lookups and README.ldap, I
> don't see an  obvious way to do this.  The amavis schema
> () is geared toward
> individual account objects, doesn't have a domain attribute, and
> LDAP-wise,  storing all the domains on each account would be somewhat
> silly.
>
> Neither lookup_ldap() or lookup_ldap_attr() seem geared towards this type
> of query, as they both key off email ID.
>
> I've seen that people have asked how to do this in the past, as well, and
> gotten no response.
>
> So:
>
> (a) Is it even possible to do what I want
> and
> (b) Is there any documentation that exists, or can someone provide some
> useful examples, if it is possible? :)


I sent this over a year ago, and the silence was deafening... So I'll send 
it again to see if anyone's hearing has improved. :P

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

--
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
___
AMaViS-user mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/

[AMaViS-user] @local_domains_maps and LDAP

2007-12-18 Thread Quanah Gibson-Mount 
I would like to have amavis query the list of domains from our LDAP server. 
However, after reading over README.lookups and README.ldap, I don't see an 
obvious way to do this.  The amavis schema 
() is geared toward 
individual account objects, doesn't have a domain attribute, and LDAP-wise, 
storing all the domains on each account would be somewhat silly.

Neither lookup_ldap() or lookup_ldap_attr() seem geared towards this type 
of query, as they both key off email ID.

I've seen that people have asked how to do this in the past, as well, and 
gotten no response.

So:

(a) Is it even possible to do what I want
and
(b) Is there any documentation that exists, or can someone provide some 
useful examples, if it is possible? :)

Thanks!

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc

Zimbra ::  the leader in open source messaging and collaboration

-
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
___
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/