PostFix forwarder - LDAP lookup

r4iden

Firstly marcelloc - kudos on a great package, and I'm quite excited about your mailscanner work

As the topic states, I would like to use the ldap lookup function to keep a up to date list of accepted email addresses. When I try to fetch the package as stated in the hint, I get the following -

 /usr/sbin/pkg_add -r p5-perl-ldap
Error: Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/p5-perl-ldap.tbz: File unavailable (e.g., file not found, no access)
pkg_add: unable to fetch 'ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/p5-perl-ldap.tbz' by URL

Any idea what I can do? (I did browse the ftp manually - no 'packages-8.1-release' directory)

marcelloc

you can try to fetch from here

i386
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

amd64
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

r4iden

Awesome thanks - it installed.

Does the function have a log/indicator somewhere to see it is working?

marcelloc

Go on view configurarion files and click valid recipients.

r4iden

I still had trouble getting this to work - thankfully marcelloc was able to point me in the right direction :)

For reference:
At the time of writing, you have to modify line 1 in the file /usr/local/etc/postfix/adexport.pl and change it to

#!/usr/local/bin/perl5.12.4 -w

You can then manually run

/usr/local/bin/php -q /usr/local/www/postfix_recipients.php

to see if it works.

More references as to why it is needed can be found here http://forum.pfsense.org/index.php/topic,45143.msg235361.html#msg235361

Tested OK on Windows Server 2008 R2

DQM

@marcelloc:

you can try to fetch from here

i386
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

amd64
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

Dear marcelloc,

I have downloaded your tbz file, but I got some errors when install. Please see the lines below:

[2.0.1-RELEASE][root@pfsense02.abc.com]/root(2): pkg_add p5-perl-ldap-0.4300.tbz
pkg_add: could not find package p5-XML-NamespaceSupport-1.11 !
pkg_add: could not find package p5-XML-SAX-0.96 !
pkg_add: could not find package p5-XML-Filter-BufferText-1.01 !
pkg_add: could not find package p5-XML-SAX-Writer-0.53 !
pkg_add: could not find package p5-GSSAPI-0.28 !
pkg_add: could not find package p5-Net-SSLeay-1.42 !
pkg_add: could not find package p5-IO-Socket-SSL-1.53 !
pkg_add: could not find package p5-URI-1.59 !
pkg_add: could not find package p5-Digest-HMAC-1.03 !
pkg_add: could not find package p5-Authen-SASL-2.15 !
pkg_add: could not find package p5-Convert-ASN1-0.22 !

Could you please help to solve it? I did not have experience with FeeBSD.
May I know when does PfSense team release the p5-perl-ldap package that we can install online?

Many thanks for your support,
DQM

DQM

@r4iden:

Awesome thanks - it installed.

Does the function have a log/indicator somewhere to see it is working?

Dear r4iden,

Could you please share your experiences about installation here?

Thanks a lot,
DQM

DQM

Dear all,

I have just installed p5-perl-ldap on the link above of Marcelloc successful. I am going to configure it and feedback the result soon.

Thank you,
DQM

DQM

Dear all,

I have configured the Postfix Forwarder to export account from AD (Windows 2003) on following:

hostname: server01.abc.com
domain: dc=abc,dc=com
username: cn=antispam,cn=abc (abc is OU which antispam account is placed)

But when I run command to test, I did not get any account from AD, pls see the error below:

extracting from server01.abc.com…(0)
Total ldap recipients:0 unique:0

Any advise to great with Postfix Forwarder?

Many thanks,
DQM

marcelloc

@DQM:

Any advise to great with Postfix Forwarder?

It looks fine, can you try with a user at cn Users?

DQM

@marcelloc:

@DQM:

Any advise to great with Postfix Forwarder?

It looks fine, can you try with a user at cn Users?

Same result, marcelloc ! >:( Any advise?

Thanks,
DQM

louis-m

I've just had a bash at this with pfsense 2.1_x64 and windows 2008 r2 and it works fine. wouldn't work with some username though eg Administrator etc

Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

marcelloc

@louis-m:

Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.

marcelloc

@DQM:

Same result, marcelloc ! Any advise?

Are you sure your password is correct? Is there special characters on it?

DQM

@marcelloc:

@DQM:

Same result, marcelloc ! Any advise?

Are you sure your password is correct? Is there special characters on it?

Dear marcelloc,

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

Thanks,

marcelloc

@DQM:

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

att,
Marcello Coutinho

voona

Having the same issues binding to LDAP. Any ideas guys? 2008 R2 Domain Controller

Thanks

DQM

@marcelloc:

@DQM:

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

att,
Marcello Coutinho

Hi Marcello,

After installing Exchange server, it is working well now. But another issue is SPF feature does not work.
I have created TXT record for abc.com(PfSense was able to resolve TXT record of abc.com). After that, I telnet to send mail by smtp command (user1@abc.com send to user1@abc.com), and I can push phishing emails to Postfix Forwarder.

Any advise?

Thanks,
DQM

DQM

Dear Marcello,

I'd like to mention the list of task that I did on the Postfix Forwarder on following:

I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?
SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

Could you please help to explain in more details?

Thank you,
DQM

voona

ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

can anyone share their configs etc - 2008 R2 Domain Controller.

Is the a guide or document to set this up?

Thanks