Search Site:

About

Linux

Printers?

Programming

Windows?

Download

Skins

Edit - To Do - AllRecentChanges

Recent Changes Printable View Page History Edit Page

This page is part of the EmailServer article.

Users

There are plenty of different ways to authenticate users for mail access.
By default though, Postfix, Dovecot and saslauthd -the services we use here- use the standard unix user accounts to validate users and find out their home directory.

Using LDAP, virtual users, MySQL databases, NIS, SMB or any other scheme is of course possible but in our case I wanted to keep things simple and allow this server to later become say a file server as well without too much hassle. Changing the authentication scheme can be necessary if you're managing virtual email accounts with lots of different domains (if you're and ISP for instance).
In our case, there was nothing much to gain.

Having said that, there are a few of drawbacks to using standard user accounts:

  • by default, these accounts are login accounts, meaning that users can log onto the machine at will. While they are not supposed to have enough credentials to wreak havoc in the system, it's still a potential security risk.
  • Whenever you create a new user account, its home directory is filled with local configuration files that we don't need (such as bash profiles, or emacs config files)
  • The default user account is created in /home but we want them in /mail instead.

I will assume that all our users will not need to login onto the machine by default. If you need such users, you can still override these settings.

Edit the /etc/default/useradd file:

# useradd defaults file
GROUP=100
HOME=/mail
INACTIVE=-1
EXPIRE=
SHELL=/bin/nologin
SKEL=/etc/skelmail
CREATE_MAIL_SPOOL=no

Note: set the Create Mail Spool to no otherwise the user inbox becomes a mbox file created under /var/spool/mail/ (which we don't want).

Now create the skeleton directory:

# mkdir -p /etc/skelmail/{cur,new,tmp}
# chmod 700 -R /etc/skelmail

Now, whenever we use the useradd command, the user will be added to the system without the ability to login and his mail directory will be automatically created.

Note: It's very important that the email folder is not world-accessible: Postfix will otherwise refuse to write any email in it as it would be a security hazard. That's why we set it to chmod 700.

Should you need to add normal login users accounts, you can override the default settings of adduser on the command line as such:

# adduser -m -k /etc/skel -s /bin/bash -d /home/susan susan

Will add the normal login user susan to the system.

< Preparation | EmailServer | Postfix >

Comments
EmilSunday 05 July 2009, at 16:12 GMT+8 [X]
This article help me very much ......
Enter your comment (no links allowed): Author:

Edit Page - Page History - Printable View - Recent Changes - WikiHelp - Search - RSS -
Page last modified on Thursday 22 January 2009, at 08:33 GMT+8 - Viewed 2992 times