- ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
-- LDAP_START_TLS=yes
-- ACCOUNT_PROVISIONER=LDAP
-- LDAP_SERVER_HOST=ldap.example.org
-- LDAP_SEARCH_BASE=dc=example,dc=org"
-- LDAP_BIND_DN=cn=admin,dc=example,dc=org
-- LDAP_BIND_PW=mypassword
-- SPOOF_PROTECTION=1
+- ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
+- LDAP_START_TLS=yes
+- ACCOUNT_PROVISIONER=LDAP
+- LDAP_SERVER_HOST=ldap.example.org
+- LDAP_SEARCH_BASE=dc=example,dc=org"
+- LDAP_BIND_DN=cn=admin,dc=example,dc=org
+- LDAP_BIND_PW=mypassword
+- SPOOF_PROTECTION=1
-- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
-- LDAP_QUERY_FILTER_USER=(mail=%s)
-- LDAP_QUERY_FILTER_ALIAS=(|) # doesn't match anything
-- LDAP_QUERY_FILTER_GROUP=(|) # doesn't match anything
-- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(mail=admin@*))
+- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
+- LDAP_QUERY_FILTER_USER=(mail=%s)
+- LDAP_QUERY_FILTER_ALIAS=(|) # doesn't match anything
+- LDAP_QUERY_FILTER_GROUP=(|) # doesn't match anything
+- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(mail=admin@*))
@@ -1711,8 +1713,8 @@
DOVECOT_PASS_FILTER
is used to get the password information of the user, and is in pretty much all cases identical to DOVECOT_USER_FILTER
(which is the default behaviour if left away).
If your directory doesn't have the postfix-book schema installed, then you must change the internal attribute handling for dovecot. For this you have to change the pass_attr
and the user_attr
mapping, as shown in the example below:
-- DOVECOT_PASS_ATTRS=<YOUR_USER_IDENTIFIER_ATTRIBUTE>=user,<YOUR_USER_PASSWORD_ATTRIBUTE>=password
-- DOVECOT_USER_ATTRS=<YOUR_USER_HOME_DIRECTORY_ATTRIBUTE>=home,<YOUR_USER_MAILSTORE_ATTRIBUTE>=mail,<YOUR_USER_MAIL_UID_ATTRIBUTE>=uid,<YOUR_USER_MAIL_GID_ATTRIBUTE>=gid
+- DOVECOT_PASS_ATTRS=<YOUR_USER_IDENTIFIER_ATTRIBUTE>=user,<YOUR_USER_PASSWORD_ATTRIBUTE>=password
+- DOVECOT_USER_ATTRS=<YOUR_USER_HOME_DIRECTORY_ATTRIBUTE>=home,<YOUR_USER_MAILSTORE_ATTRIBUTE>=mail,<YOUR_USER_MAIL_UID_ATTRIBUTE>=uid,<YOUR_USER_MAIL_GID_ATTRIBUTE>=gid
Note
@@ -1721,17 +1723,17 @@
Defaults
-- DOVECOT_USER_ATTRS=mailHomeDirectory=home,mailUidNumber=uid,mailGidNumber=gid,mailStorageDirectory=mail
-- DOVECOT_PASS_ATTRS=uniqueIdentifier=user,userPassword=password
-- DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))
+- DOVECOT_USER_ATTRS=mailHomeDirectory=home,mailUidNumber=uid,mailGidNumber=gid,mailStorageDirectory=mail
+- DOVECOT_PASS_ATTRS=uniqueIdentifier=user,userPassword=password
+- DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))
Example
Setup for a directory that has the qmail-schema installed and uses uid
:
-- DOVECOT_PASS_ATTRS=uid=user,userPassword=password
-- DOVECOT_USER_ATTRS=homeDirectory=home,qmailUID=uid,qmailGID=gid,mailMessageStore=mail
-- DOVECOT_USER_FILTER=(&(objectClass=qmailUser)(uid=%u)(accountStatus=active))
+- DOVECOT_PASS_ATTRS=uid=user,userPassword=password
+- DOVECOT_USER_ATTRS=homeDirectory=home,qmailUID=uid,qmailGID=gid,mailMessageStore=mail
+- DOVECOT_USER_FILTER=(&(objectClass=qmailUser)(uid=%u)(accountStatus=active))
The LDAP server configuration for dovecot will be taken mostly from postfix, other options can be found in the environment section in the docs.
@@ -1747,17 +1749,17 @@
Configure LDAP with saslauthd
-- ENABLE_SASLAUTHD=1
-- SASLAUTHD_MECHANISMS=ldap
-- SASLAUTHD_LDAP_FILTER=(mail=%U@example.org)
+- ENABLE_SASLAUTHD=1
+- SASLAUTHD_MECHANISMS=ldap
+- SASLAUTHD_LDAP_FILTER=(mail=%U@example.org)
To enable LDAPS, all you need to do is to add the protocol to LDAP_SERVER_HOST
, for example ldaps://example.org:636
.
To enable LDAP over StartTLS (on port 389), you need to set the following environment variables instead (the protocol must not be ldaps://
in this case!):
-- LDAP_START_TLS=yes
-- DOVECOT_TLS=yes
-- SASLAUTHD_LDAP_START_TLS=yes
+- LDAP_START_TLS=yes
+- DOVECOT_TLS=yes
+- SASLAUTHD_LDAP_START_TLS=yes
In addition to LDAP explanation above, when Docker Mailserver is intended to be used with Active Directory (or the equivalent implementations like Samba4 AD DC) the following points should be taken into consideration:
@@ -1772,8 +1774,8 @@
# user-patches.sh
...
-grep -q '^leaf_result_attribute = mail$' /etc/postfix/ldap-groups.cf || echo "leaf_result_attribute = mail" >> /etc/postfix/ldap-groups.cf
-grep -q '^special_result_attribute = member$' /etc/postfix/ldap-groups.cf || echo "special_result_attribute = member" >> /etc/postfix/ldap-groups.cf
+grep -q '^leaf_result_attribute = mail$' /etc/postfix/ldap-groups.cf || echo "leaf_result_attribute = mail" >> /etc/postfix/ldap-groups.cf
+grep -q '^special_result_attribute = member$' /etc/postfix/ldap-groups.cf || echo "special_result_attribute = member" >> /etc/postfix/ldap-groups.cf
...
@@ -1782,203 +1784,172 @@ grep -q '^special_result_attribute = member$' /e
# user-patches.sh
...
-cp /MOUNTED_FOLDER/ca.crt /usr/local/share/ca-certificates/
+cp /MOUNTED_FOLDER/ca.crt /usr/local/share/ca-certificates/
update-ca-certificates
...
The changes on the configurations necessary to work with Active Directory (only changes are listed, the rest of the LDAP configuration can be taken from the other examples shown in this documentation):
-# If StartTLS is the chosen method to establish a secure connection with Active Directory.
-- LDAP_START_TLS=yes
-- SASLAUTHD_LDAP_START_TLS=yes
-- DOVECOT_TLS=yes
+# If StartTLS is the chosen method to establish a secure connection with Active Directory.
+- LDAP_START_TLS=yes
+- SASLAUTHD_LDAP_START_TLS=yes
+- DOVECOT_TLS=yes
-- LDAP_QUERY_FILTER_USER=(&(objectclass=person)(mail=%s))
-- LDAP_QUERY_FILTER_ALIAS=(&(objectclass=person)(proxyAddresses=smtp:%s))
-# Filters Active Directory groups (mail lists). Additional changes on ldap-groups.cf are also required as shown above.
-- LDAP_QUERY_FILTER_GROUP=(&(objectClass=group)(mail=%s))
-- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
-# Allows only Domain admins to send any sender email address, otherwise the sender address must match the LDAP attribute `mail`.
-- SPOOF_PROTECTION=1
-- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(proxyAddresses=smtp:%s)(memberOf=cn=Domain Admins,cn=Users,dc=*))
+- LDAP_QUERY_FILTER_USER=(&(objectclass=person)(mail=%s))
+- LDAP_QUERY_FILTER_ALIAS=(&(objectclass=person)(proxyAddresses=smtp:%s))
+# Filters Active Directory groups (mail lists). Additional changes on ldap-groups.cf are also required as shown above.
+- LDAP_QUERY_FILTER_GROUP=(&(objectClass=group)(mail=%s))
+- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
+# Allows only Domain admins to send any sender email address, otherwise the sender address must match the LDAP attribute `mail`.
+- SPOOF_PROTECTION=1
+- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(proxyAddresses=smtp:%s)(memberOf=cn=Domain Admins,cn=Users,dc=*))
-- DOVECOT_USER_FILTER=(&(objectclass=person)(sAMAccountName=%n))
-# At the moment to be able to use %{ldap:uidNumber}, a manual bug fix as described above must be used. Otherwise %{ldap:uidNumber} %{ldap:uidNumber} must be replaced by the hard-coded value 5000.
-- DOVECOT_USER_ATTRS==uid=%{ldap:uidNumber},=gid=5000,=home=/var/mail/%Ln,=mail=maildir:~/Maildir
-- DOVECOT_PASS_ATTRS=sAMAccountName=user,userPassword=password
-- SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
+- DOVECOT_USER_FILTER=(&(objectclass=person)(sAMAccountName=%n))
+# At the moment to be able to use %{ldap:uidNumber}, a manual bug fix as described above must be used. Otherwise %{ldap:uidNumber} %{ldap:uidNumber} must be replaced by the hard-coded value 5000.
+- DOVECOT_USER_ATTRS==uid=%{ldap:uidNumber},=gid=5000,=home=/var/mail/%Ln,=mail=maildir:~/Maildir
+- DOVECOT_PASS_ATTRS=sAMAccountName=user,userPassword=password
+- SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
Basic Setup
-services:
- mailserver:
- image: docker.io/mailserver/docker-mailserver:latest
- container_name: mailserver
- hostname: mail.example.com
+services:
+ mailserver:
+ image: ghcr.io/docker-mailserver/docker-mailserver:latest
+ container_name: mailserver
+ hostname: mail.example.com
- ports:
- - "25:25"
- - "143:143"
- - "587:587"
- - "993:993"
+ ports:
+ - "25:25"
+ - "143:143"
+ - "587:587"
+ - "993:993"
- volumes:
- - ./docker-data/dms/mail-data/:/var/mail/
- - ./docker-data/dms/mail-state/:/var/mail-state/
- - ./docker-data/dms/mail-logs/:/var/log/mail/
- - ./docker-data/dms/config/:/tmp/docker-mailserver/
- - /etc/localtime:/etc/localtime:ro
+ volumes:
+ - ./docker-data/dms/mail-data/:/var/mail/
+ - ./docker-data/dms/mail-state/:/var/mail-state/
+ - ./docker-data/dms/mail-logs/:/var/log/mail/
+ - ./docker-data/dms/config/:/tmp/docker-mailserver/
+ - /etc/localtime:/etc/localtime:ro
- environment:
- - ENABLE_SPAMASSASSIN=1
- - ENABLE_CLAMAV=1
- - ENABLE_FAIL2BAN=1
- - ENABLE_POSTGREY=1
+ environment:
+ - ENABLE_SPAMASSASSIN=1
+ - ENABLE_CLAMAV=1
+ - ENABLE_FAIL2BAN=1
+ - ENABLE_POSTGREY=1
- # >>> Postfix LDAP Integration
- - ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
- - ACCOUNT_PROVISIONER=LDAP
- - LDAP_SERVER_HOST=ldap.example.org
- - LDAP_BIND_DN=cn=admin,ou=users,dc=example,dc=org
- - LDAP_BIND_PW=mypassword
- - LDAP_SEARCH_BASE=dc=example,dc=org
- - LDAP_QUERY_FILTER_DOMAIN=(|(mail=*@%s)(mailAlias=*@%s)(mailGroupMember=*@%s))
- - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(mail=%s))
- - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(mailAlias=%s))
- - LDAP_QUERY_FILTER_GROUP=(&(objectClass=inetOrgPerson)(mailGroupMember=%s))
- - LDAP_QUERY_FILTER_SENDERS=(&(objectClass=inetOrgPerson)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))
- - SPOOF_PROTECTION=1
- # <<< Postfix LDAP Integration
+ # >>> Postfix LDAP Integration
+ - ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
+ - ACCOUNT_PROVISIONER=LDAP
+ - LDAP_SERVER_HOST=ldap.example.org
+ - LDAP_BIND_DN=cn=admin,ou=users,dc=example,dc=org
+ - LDAP_BIND_PW=mypassword
+ - LDAP_SEARCH_BASE=dc=example,dc=org
+ - LDAP_QUERY_FILTER_DOMAIN=(|(mail=*@%s)(mailAlias=*@%s)(mailGroupMember=*@%s))
+ - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(mail=%s))
+ - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(mailAlias=%s))
+ - LDAP_QUERY_FILTER_GROUP=(&(objectClass=inetOrgPerson)(mailGroupMember=%s))
+ - LDAP_QUERY_FILTER_SENDERS=(&(objectClass=inetOrgPerson)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))
+ - SPOOF_PROTECTION=1
+ # <<< Postfix LDAP Integration
- # >>> Dovecot LDAP Integration
- - DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))
- - DOVECOT_PASS_ATTRS=uid=user,userPassword=password
- - DOVECOT_USER_ATTRS==home=/var/mail/%{ldap:uid},=mail=maildir:~/Maildir,uidNumber=uid,gidNumber=gid
- # <<< Dovecot LDAP Integration
+ # >>> Dovecot LDAP Integration
+ - DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))
+ - DOVECOT_PASS_ATTRS=uid=user,userPassword=password
+ - DOVECOT_USER_ATTRS==home=/var/mail/%{ldap:uid},=mail=maildir:~/Maildir,uidNumber=uid,gidNumber=gid
+ # <<< Dovecot LDAP Integration
- # >>> SASL LDAP Authentication
- - ENABLE_SASLAUTHD=1
- - SASLAUTHD_MECHANISMS=ldap
- - SASLAUTHD_LDAP_FILTER=(&(mail=%U@example.org)(objectClass=inetOrgPerson))
- # <<< SASL LDAP Authentication
+ # >>> SASL LDAP Authentication
+ - ENABLE_SASLAUTHD=1
+ - SASLAUTHD_MECHANISMS=ldap
+ - SASLAUTHD_LDAP_FILTER=(&(mail=%U@example.org)(objectClass=inetOrgPerson))
+ # <<< SASL LDAP Authentication
- - SSL_TYPE=letsencrypt
- - PERMIT_DOCKER=host
+ - SSL_TYPE=letsencrypt
+ - PERMIT_DOCKER=host
- cap_add:
- - NET_ADMIN
+ cap_add:
+ - NET_ADMIN
Kopano / Zarafa
-services:
- mailserver:
- image: docker.io/mailserver/docker-mailserver:latest
- container_name: mailserver
- hostname: mail.example.com
+services:
+ mailserver:
+ image: ghcr.io/docker-mailserver/docker-mailserver:latest
+ container_name: mailserver
+ hostname: mail.example.com
- ports:
- - "25:25"
- - "143:143"
- - "587:587"
- - "993:993"
+ ports:
+ - "25:25"
+ - "143:143"
+ - "587:587"
+ - "993:993"
- volumes:
- - ./docker-data/dms/mail-data/:/var/mail/
- - ./docker-data/dms/mail-state/:/var/mail-state/
- - ./docker-data/dms/config/:/tmp/docker-mailserver/
+ volumes:
+ - ./docker-data/dms/mail-data/:/var/mail/
+ - ./docker-data/dms/mail-state/:/var/mail-state/
+ - ./docker-data/dms/config/:/tmp/docker-mailserver/
- environment:
- # We are not using dovecot here
- - SMTP_ONLY=1
- - ENABLE_SPAMASSASSIN=1
- - ENABLE_CLAMAV=1
- - ENABLE_FAIL2BAN=1
- - ENABLE_POSTGREY=1
- - SASLAUTHD_PASSWD=
+ environment:
+ # We are not using dovecot here
+ - SMTP_ONLY=1
+ - ENABLE_SPAMASSASSIN=1
+ - ENABLE_CLAMAV=1
+ - ENABLE_FAIL2BAN=1
+ - ENABLE_POSTGREY=1
+ - SASLAUTHD_PASSWD=
- # >>> SASL Authentication
- - ENABLE_SASLAUTHD=1
- - SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
- - SASLAUTHD_MECHANISMS=ldap
- # <<< SASL Authentication
+ # >>> SASL Authentication
+ - ENABLE_SASLAUTHD=1
+ - SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
+ - SASLAUTHD_MECHANISMS=ldap
+ # <<< SASL Authentication
- # >>> Postfix Ldap Integration
- - ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
- - ACCOUNT_PROVISIONER=LDAP
- - LDAP_SERVER_HOST=<yourLdapContainer/yourLdapServer>
- - LDAP_SEARCH_BASE=dc=mydomain,dc=loc
- - LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=loc
- - LDAP_BIND_PW=mypassword
- - LDAP_QUERY_FILTER_USER=(&(objectClass=user)(mail=%s))
- - LDAP_QUERY_FILTER_GROUP=(&(objectclass=group)(mail=%s))
- - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=user)(otherMailbox=%s))
- - LDAP_QUERY_FILTER_DOMAIN=(&(|(mail=*@%s)(mailalias=*@%s)(mailGroupMember=*@%s))(mailEnabled=TRUE))
- # <<< Postfix Ldap Integration
+ # >>> Postfix Ldap Integration
+ - ENABLE_LDAP=1 # with the :edge tag, use ACCOUNT_PROVISIONER
+ - ACCOUNT_PROVISIONER=LDAP
+ - LDAP_SERVER_HOST=<yourLdapContainer/yourLdapServer>
+ - LDAP_SEARCH_BASE=dc=mydomain,dc=loc
+ - LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=loc
+ - LDAP_BIND_PW=mypassword
+ - LDAP_QUERY_FILTER_USER=(&(objectClass=user)(mail=%s))
+ - LDAP_QUERY_FILTER_GROUP=(&(objectclass=group)(mail=%s))
+ - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=user)(otherMailbox=%s))
+ - LDAP_QUERY_FILTER_DOMAIN=(&(|(mail=*@%s)(mailalias=*@%s)(mailGroupMember=*@%s))(mailEnabled=TRUE))
+ # <<< Postfix Ldap Integration
- # >>> Kopano Integration
- - POSTFIX_DAGENT=lmtp:kopano:2003
- # <<< Kopano Integration
+ # >>> Kopano Integration
+ - POSTFIX_DAGENT=lmtp:kopano:2003
+ # <<< Kopano Integration
- - SSL_TYPE=letsencrypt
- - PERMIT_DOCKER=host
+ - SSL_TYPE=letsencrypt
+ - PERMIT_DOCKER=host
- cap_add:
- - NET_ADMIN
+ cap_add:
+ - NET_ADMIN
-
-
-
-
+
+
+
+
+
+
+
+
+
-
+
+