PostFix forwarder - LDAP lookup

r4iden · Jan 11, 2012, 10:32 AM

Awesome thanks - it installed.

Does the function have a log/indicator somewhere to see it is working?

marcelloc · Jan 11, 2012, 11:47 AM

Go on view configurarion files and click valid recipients.

r4iden · Feb 3, 2012, 10:55 AM

I still had trouble getting this to work - thankfully marcelloc was able to point me in the right direction :)

For reference:
At the time of writing, you have to modify line 1 in the file /usr/local/etc/postfix/adexport.pl and change it to

#!/usr/local/bin/perl5.12.4 -w

You can then manually run

/usr/local/bin/php -q /usr/local/www/postfix_recipients.php

to see if it works.

More references as to why it is needed can be found here http://forum.pfsense.org/index.php/topic,45143.msg235361.html#msg235361

Tested OK on Windows Server 2008 R2

DQM · Aug 17, 2012, 3:54 PM

@marcelloc:

you can try to fetch from here

i386
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

amd64
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

Dear marcelloc,

I have downloaded your tbz file, but I got some errors when install. Please see the lines below:

[2.0.1-RELEASE][root@pfsense02.abc.com]/root(2): pkg_add p5-perl-ldap-0.4300.tbz
pkg_add: could not find package p5-XML-NamespaceSupport-1.11 !
pkg_add: could not find package p5-XML-SAX-0.96 !
pkg_add: could not find package p5-XML-Filter-BufferText-1.01 !
pkg_add: could not find package p5-XML-SAX-Writer-0.53 !
pkg_add: could not find package p5-GSSAPI-0.28 !
pkg_add: could not find package p5-Net-SSLeay-1.42 !
pkg_add: could not find package p5-IO-Socket-SSL-1.53 !
pkg_add: could not find package p5-URI-1.59 !
pkg_add: could not find package p5-Digest-HMAC-1.03 !
pkg_add: could not find package p5-Authen-SASL-2.15 !
pkg_add: could not find package p5-Convert-ASN1-0.22 !

Could you please help to solve it? I did not have experience with FeeBSD.
May I know when does PfSense team release the p5-perl-ldap package that we can install online?

Many thanks for your support,
DQM

DQM · Aug 17, 2012, 3:58 PM

@r4iden:

Awesome thanks - it installed.

Does the function have a log/indicator somewhere to see it is working?

Dear r4iden,

Could you please share your experiences about installation here?

Thanks a lot,
DQM

DQM · Aug 18, 2012, 2:49 PM

Dear all,

I have just installed p5-perl-ldap on the link above of Marcelloc successful. I am going to configure it and feedback the result soon.

Thank you,
DQM

DQM · Aug 19, 2012, 3:43 PM

Dear all,

I have configured the Postfix Forwarder to export account from AD (Windows 2003) on following:

hostname: server01.abc.com
domain: dc=abc,dc=com
username: cn=antispam,cn=abc (abc is OU which antispam account is placed)

But when I run command to test, I did not get any account from AD, pls see the error below:

extracting from server01.abc.com…(0)
Total ldap recipients:0 unique:0

Any advise to great with Postfix Forwarder?

Many thanks,
DQM

marcelloc · Aug 20, 2012, 4:16 PM

@DQM:

Any advise to great with Postfix Forwarder?

It looks fine, can you try with a user at cn Users?

DQM · Aug 21, 2012, 4:52 AM

@marcelloc:

@DQM:

Any advise to great with Postfix Forwarder?

It looks fine, can you try with a user at cn Users?

Same result, marcelloc ! >:( Any advise?

Thanks,
DQM

louis-m · Aug 21, 2012, 11:19 AM

I've just had a bash at this with pfsense 2.1_x64 and windows 2008 r2 and it works fine. wouldn't work with some username though eg Administrator etc

Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

marcelloc · Aug 21, 2012, 2:38 PM

@louis-m:

Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.

marcelloc · Aug 21, 2012, 2:40 PM

@DQM:

Same result, marcelloc ! Any advise?

Are you sure your password is correct? Is there special characters on it?

DQM · Aug 21, 2012, 3:38 PM

@marcelloc:

@DQM:

Same result, marcelloc ! Any advise?

Are you sure your password is correct? Is there special characters on it?

Dear marcelloc,

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

Thanks,

marcelloc · Aug 21, 2012, 4:26 PM

@DQM:

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

att,
Marcello Coutinho

voona · Aug 22, 2012, 9:15 AM

Having the same issues binding to LDAP. Any ideas guys? 2008 R2 Domain Controller

Thanks

DQM · Aug 22, 2012, 9:45 AM

@marcelloc:

@DQM:

I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

att,
Marcello Coutinho

Hi Marcello,

After installing Exchange server, it is working well now. But another issue is SPF feature does not work.
I have created TXT record for abc.com(PfSense was able to resolve TXT record of abc.com). After that, I telnet to send mail by smtp command (user1@abc.com send to user1@abc.com), and I can push phishing emails to Postfix Forwarder.

Any advise?

Thanks,
DQM

DQM · Aug 22, 2012, 1:50 PM

Dear Marcello,

I'd like to mention the list of task that I did on the Postfix Forwarder on following:

I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?
SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

Could you please help to explain in more details?

Thank you,
DQM

voona · Aug 23, 2012, 5:42 AM

ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

can anyone share their configs etc - 2008 R2 Domain Controller.

Is the a guide or document to set this up?

Thanks

DQM · Aug 23, 2012, 9:10 AM

@voona:

ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

can anyone share their configs etc - 2008 R2 Domain Controller.

Is the a guide or document to set this up?

Thanks

Hi voona,

Please follow up the guide below:

Step 1: Install p5-perl-ldap by run command below

i386
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

amd64
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

Step 2: Modify adexport.pl file at /usr/local/etc/postfix/adexport.pl

Change the first line of this file to #!/usr/local/bin/perl5.12.4 -w

Step 3: Run command below for testing result
/usr/local/bin/php -q /usr/local/www/postfix_recipients.php

If you get number of recipient from LDAP, then it is working well

P/S: Make sure that Exchange server or any Mail server which is able to public email address attribute of users to LDAP server was installed on your system.

GL,
DQM

voona · Aug 23, 2012, 1:32 PM

Ok LDAP is working now i had a space in the username and it didn't like it.

Still seem to be errors when installing the mailscanner package.. clamav doesnt install properly can someone point me in the right direction

Cheers