15.1 If There s No Users Database

15.1 If There's No Users Database

If you don't create a users database, qmail calls qmail-getpw, which implements a default mapping from login users to qmail users for each local delivery. It takes the local part, passed as its argument, and looks that up using the standard getpwnam( ) routine. If the user exists and meets some safety criteria (discussed in a moment), it returns user information for the user, uid, gid, and home directory from the password file, and null dash and extension. If the name is of the form user-extension and the username exists, it returns the user information with the dash being a literal dash and the extension the part of the local part after the dash. If the user doesn't exist, it falls back to the default user alias with the dash being a dash and the extension being the entire local part, so in that case the delivery is controlled by ~alias/.qmail- localpart.^[1]

^[1] You can replace the dash with another character by adjusting the contents of conf-break at the time you build qmail.

To avoid security problems, qmail-getpw only returns user information if a user account has a nonzero uid (isn't the super-user), and the account's home directory exists, is readable, and belongs to the user. It also ignores any account with capital letters in the name or with a name more than 32 characters long.

Do You Need a Users Database?

Experienced qmail users have widely varying opinions about whether to create a users database. I've always used one, but my system has only a handful of shell users and (mostly for historical reasons) many mail-only users with addresses in the same domain as the shell users. A more typical system either has a lot of shell users, nearly all of whom receive mail, or runs a system where all the addresses are in virtual domains controlled by a few dedicated user IDs. If the list of users in your passwd file is nearly the same as the list of addresses that should get mail, you may be happier with no users database so users can get mail as soon as they're added to the passwd file.

A setup with a users database is somewhat faster, because a lookup in the users CDB is faster than running qmail-getpw, and marginally more secure, because qmail-getpw depends on the system getpwnam( ) library routine, which can be complex and fragile. But unless you're trying to squeeze every bit of speed out of a mail server, the more compelling argument is what you find more convenient.