Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PostFix forwarder - LDAP lookup

    Scheduled Pinned Locked Moved pfSense Packages
    36 Posts 6 Posters 16.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      r4iden
      last edited by

      I still had trouble getting this to work - thankfully marcelloc was able to point me in the right direction :)

      For reference:
      At the time of writing, you have to modify line 1 in the file /usr/local/etc/postfix/adexport.pl and change it to

      #!/usr/local/bin/perl5.12.4 -w
      

      You can then manually run

      /usr/local/bin/php -q /usr/local/www/postfix_recipients.php
      

      to see if it works.

      More references as to why it is needed can be found here http://forum.pfsense.org/index.php/topic,45143.msg235361.html#msg235361

      Tested OK on Windows Server 2008 R2

      1 Reply Last reply Reply Quote 0
      • D
        DQM
        last edited by

        @marcelloc:

        you can try to fetch from here

        i386
        pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

        amd64
        pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

        Dear marcelloc,

        I have downloaded your tbz file, but I got some errors when install. Please see the lines below:

        [2.0.1-RELEASE][root@pfsense02.abc.com]/root(2): pkg_add p5-perl-ldap-0.4300.tbz
        pkg_add: could not find package p5-XML-NamespaceSupport-1.11 !
        pkg_add: could not find package p5-XML-SAX-0.96 !
        pkg_add: could not find package p5-XML-Filter-BufferText-1.01 !
        pkg_add: could not find package p5-XML-SAX-Writer-0.53 !
        pkg_add: could not find package p5-GSSAPI-0.28 !
        pkg_add: could not find package p5-Net-SSLeay-1.42 !
        pkg_add: could not find package p5-IO-Socket-SSL-1.53 !
        pkg_add: could not find package p5-URI-1.59 !
        pkg_add: could not find package p5-Digest-HMAC-1.03 !
        pkg_add: could not find package p5-Authen-SASL-2.15 !
        pkg_add: could not find package p5-Convert-ASN1-0.22 !

        Could you please help to solve it? I did not have experience with FeeBSD.
        May I know when does PfSense team release the p5-perl-ldap package that we can install online?

        Many thanks for your support,
        DQM

        1 Reply Last reply Reply Quote 0
        • D
          DQM
          last edited by

          @r4iden:

          Awesome thanks - it installed.

          Does the function have a log/indicator somewhere to see it is working?

          Dear r4iden,

          Could you please share your experiences about installation here?

          Thanks a lot,
          DQM

          1 Reply Last reply Reply Quote 0
          • D
            DQM
            last edited by

            Dear all,

            I have just installed p5-perl-ldap on the link above of Marcelloc successful. I am going to configure it and feedback the result soon.

            Thank you,
            DQM

            1 Reply Last reply Reply Quote 0
            • D
              DQM
              last edited by

              Dear all,

              I have configured the Postfix Forwarder to export account from AD (Windows 2003) on following:

              hostname: server01.abc.com
              domain: dc=abc,dc=com
              username: cn=antispam,cn=abc (abc is OU which antispam account is placed)

              But when I run command to test, I did not get any account from AD, pls see the error below:

              extracting from server01.abc.com…(0)
              Total ldap recipients:0 unique:0

              Any advise to great with Postfix Forwarder?

              Many thanks,
              DQM

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @DQM:

                Any advise to great with Postfix Forwarder?

                It looks fine, can you try with a user at cn Users?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • D
                  DQM
                  last edited by

                  @marcelloc:

                  @DQM:

                  Any advise to great with Postfix Forwarder?

                  It looks fine, can you try with a user at cn Users?

                  Same result, marcelloc !  >:( Any advise?

                  Thanks,
                  DQM

                  1 Reply Last reply Reply Quote 0
                  • L
                    louis-m
                    last edited by

                    I've just had a bash at this with pfsense 2.1_x64 and windows 2008 r2 and it works fine. wouldn't work with some username though eg Administrator etc

                    Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @louis-m:

                      Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

                      It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @DQM:

                        Same result, marcelloc ! Any advise?

                        Are you sure your password is correct? Is there special characters on it?

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • D
                          DQM
                          last edited by

                          @marcelloc:

                          @DQM:

                          Same result, marcelloc ! Any advise?

                          Are you sure your password is correct? Is there special characters on it?

                          Dear marcelloc,

                          I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

                          Thanks,

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @DQM:

                            I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

                            The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

                            att,
                            Marcello Coutinho

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • V
                              voona
                              last edited by

                              Having the same issues binding to LDAP. Any ideas guys? 2008 R2 Domain Controller

                              Thanks

                              1 Reply Last reply Reply Quote 0
                              • D
                                DQM
                                last edited by

                                @marcelloc:

                                @DQM:

                                I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

                                The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

                                att,
                                Marcello Coutinho

                                Hi Marcello,

                                After installing Exchange server, it is working well now. But another issue is SPF feature does not work.
                                I have created TXT record for abc.com(PfSense was able to resolve TXT record of abc.com). After that, I telnet to send mail by smtp command (user1@abc.com send to user1@abc.com), and I can push phishing emails to Postfix Forwarder.

                                Any advise?

                                Thanks,
                                DQM

                                1 Reply Last reply Reply Quote 0
                                • D
                                  DQM
                                  last edited by

                                  Dear Marcello,

                                  I'd like to mention the list of task that I did on the Postfix Forwarder on following:

                                  • I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?
                                  • SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
                                  • Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

                                  Could you please help to explain in more details?

                                  Thank you,
                                  DQM

                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    voona
                                    last edited by

                                    ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

                                    can anyone share their configs etc - 2008 R2 Domain Controller.

                                    Is the a guide or document to set this up?

                                    Thanks

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      DQM
                                      last edited by

                                      @voona:

                                      ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

                                      can anyone share their configs etc - 2008 R2 Domain Controller.

                                      Is the a guide or document to set this up?

                                      Thanks

                                      Hi voona,

                                      Please follow up the guide below:

                                      Step 1: Install p5-perl-ldap by run command below

                                      i386
                                      pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

                                      amd64
                                      pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

                                      Step 2: Modify adexport.pl file at /usr/local/etc/postfix/adexport.pl

                                      Change the first line of this file to #!/usr/local/bin/perl5.12.4 -w

                                      Step 3: Run command below for testing result
                                      /usr/local/bin/php -q /usr/local/www/postfix_recipients.php

                                      If you get number of recipient from LDAP, then it is working well

                                      P/S: Make sure that Exchange server or any Mail server which is able to public email address attribute of users to LDAP server was installed on your system.

                                      GL,
                                      DQM

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        voona
                                        last edited by

                                        Ok LDAP is working now i had a space in the username and it didn't like it.

                                        Still seem to be errors when installing the mailscanner package.. clamav doesnt install properly can someone point me in the right direction

                                        Cheers

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          RobinGill
                                          last edited by

                                          @louis-m:

                                          Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

                                          @marcelloc:

                                          It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.

                                          In addition this feature is very valuable as it prevents backscatter.

                                          Backscatter is when a spammer sends emails to an invalid address at your domain with a spoofed sender address. The intended result of this is to spam the intended recipient i.e the spoofed sender with NDR's from your mail server.

                                          If postfix is configured without this check, it will relay every email it receives that passes other enabled checks to your mail server. When your mail server realises it does not know of a valid recipient/mailbox to deliver the mail to, it should send an NDR to the spoofed sender.

                                          NDR's can be disabled, but this is against RFC2821.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @DQM:

                                            I'd like to mention the list of task that I did on the Postfix Forwarder on following:

                                            • I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?

                                            Did you tried to include this option on postfix custom options field on gui?

                                            @DQM:

                                            • SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
                                            • Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

                                            I have strong header set and it looks like spf is working, do you have any error message or log you detected it.
                                            If it's a bug during package save settings, I can fix next week.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.