Using Lightweight Directory Access Protocol

---

LDAP provides distributed access to simple, non-relational databases. It's commonly used to store information about people (users, employees, members), places (buildings, rooms), and things (computers, printers, equipment).

LDAP is primarily used by large facilities with many users and multiple servers that need access to information about those users, such as username, home directory location, password, e-mail address, login shell preference, and so on.

You can use LDAP with qmail in two ways: via an LDAP Pluggable Authentication Module (PAM) and with the qmail-ldap patch set. Both of these methods require the administrator to know how to use and configure the LDAP service, which is beyond the scope of this book.

LDAP PAM

PAM is a mechanism for supporting alternative user-authentication methods on Unix systems. Traditionally, Unix users are authenticated via the usernames and password hashes stored in /etc/passwd and sometimes a shadow password file such as /etc/shadow. This requires all authentication information to be stored on each system in one or two files.

Using PAM with an LDAP module, user authentication can be done using LDAP to access usernames and passwords stored in centralized databases.

PAM is not yet supported on all Unix and Unix-like systems, but it is available for Linux, Solaris, HP-UX, and some Berkeley Software Distribution (BSD) variants.

Additional information about LDAP PAM modules is available on the Web (http://www.padl.com/pam_ldap.html).

qmail-ldap

qmail-ldap is a set of extensive patches to qmail 1.03 that tightly integrate qmail with LDAP. With these patches installed, qmail uses LDAP to look up all user information, including username, password, user ID (UID), group ID (GID), and home directory. It also supports virtual users and routing mail to the mail host specified with each user's account information—making it well suited to scalable mail systems with user accounts spread across multiple servers. The qmail-ldap patches are available from the Web (http://www.nrg4u.com/).

Henning Brauer has written a comprehensive guide to installing and using qmail-ldap called "Life With qmail-ldap." It's available from the Web (http://www.lifewithqmail.org/ldap/).

qmail-ldap substantially changes the way many things work, and not all of the changes are related to LDAP. For example, it includes support for mail quotas, logging in qmail-smtpd and qmail-pop3d, additional junk mail controls, and automatic maildir mailbox creation.

---