快速新增網域ldap通訊錄(outlook 2016)

以前要新增ldap通訊錄,非常麻煩, 一堆設定, 昨天找了一些資源, 包括想要從registry方面下手都失敗, 好險有人寫了一個超方便的程式, 可以快速新增ldap 通訊錄, 感謝啊!

https://github.com/andreighita/MAPIToolkit

官網很詳細寫了說明, 我也整理了一下給大家下載

安裝roundcube心得

前陣子弄了docker image postfixad , 可以快速與網域主控站整合
既然有了mail server 通常還要提供roundcube這類的webmail ,

但是問題來了

登入webmail的帳號與email不相同時, 就很麻煩, 例如:
登入的帳號是 001 , 可是emai卻l變成 001@kafeiou.pw
這困擾我很久, 甚至想要自己寫一個roundcube的plugin , 想要登入的時候, 改寫email,

後來發現roundcube有個plugin很好用, 就是 new_user_dialog , 啟用後,第一次登入,會強迫設定名字與email就好啦, 哈

以下列出docker 安裝roundcube方式

docker run -e ROUNDCUBEMAIL_DEFAULT_HOST=tls://<郵件主機> -e ROUNDCUBEMAIL_SMTP_SERVER=tls://<郵件主機> -p 8080:80 -d roundcube/roundcubemail


postfix+dovecot+sasl+activate direcotory (centos 6)

1. vi /etc/dovecot/conf.d/10-auth.conf
uncommand the following setting
#!include auth-ldap.conf.ext
as
!include auth-ldap.conf.ext

2.  vi  /etc/dovecot/conf.d/auth-ldap.conf.ext
auth_username_format = %Lu

passdb ldap {
args = /etc/dovecot/dovecot-ldap.conf.ext

}

userdb static {
args = uid=501 gid=501 home=/home/vmail/%u
}
3. vi /etc/dovecot/dovecot-ldap.conf.ext
hosts = ad_server_ip
base = dc=test,dc=com,dc=tw
ldap_version = 3
auth_bind = yes
ldap_version = 3
auth_bind_userdn = test%u
pass_filter = (&(objectclass=person)(uid=%u))

ps. uid and gid must the same with postfix  and directory in linux server
ex: create one user "vmail"
user id is 501 , gid is 501

4. postfix's main.cf
virtual_mailbox_domains = $mydomain
virtual_mailbox_base = /home/vmail/
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf
virtual_uid_maps = static:501
virtual_gid_maps = static:501
virtual_alias_maps = hash:/etc/aliases,ldap:/etc/postfix/ldap-aliases-inner.cf
#smtp auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
#additional param
message_size_limit = 40960000
smtpd_helo_required = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 1d
data_directory = /var/db/postfix
header_checks = regexp:/etc/postfix/header_checks
smtp_host_lookup = native, dns
...
5. vi /etc/postfix/ldap-users.cf
server_host = ad_server_ip
search_base = dc=test,dc=com,dc=tw
version = 3
query_filter = (&(objectclass=*)(mail=%s))
result_attribute = samaccountname #Account from DC
result_format = %s/Maildir/
bind = yes
bind_dn = cn=ldap,cn=Users,dc=test,dc=com,dc=tw
bind_pw = ldappassword

6. vi //etc/sysconfig/saslauthd
# Directory in which to place saslauthd's listening socket, pid file, and so
# on. This directory must already exist.
SOCKETDIR=/var/run/saslauthd

# Mechanism to use when checking passwords. Run "saslauthd -v" to get a list
# of which mechanism your installation was compiled with the ablity to use.
#MECH=pam
MECH=ldap

# Additional flags to pass to saslauthd on the command line. See saslauthd(8)
# for the list of accepted flags.
FLAGS="-O /etc/postfix/saslauthd.conf -c -r"

7. vi /etc/postfix/saslauthd.conf
ldap_servers: ldap://ad_server_ip:389/
ldap_search_base: dc=test,dc=com,dc=tw
ldap_auth_method: bind
ldap_version: 3
ldap_bind_dn: cn=ldap,cn=Users,dc=test,dc=com,dc=tw
ldap_bind_pw: ldappassword
ldap_filter: (sAMAccountName=%u)

8. vi /etc/postfix/ldap-aliases-inner.cf
server_host = ad_server_ip
search_base = dc=test,dc=com,dc=tw
#scope = sub
query_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=%s,OU=aliases_inner,DC=test,DC=com,DC=tw)
result_attribute = mail
result_format = %s
version = 3
bind = yes
bind_dn = cn=ldap,cn=Users,dc=test,dc=com,dc=tw
bind_pw = ldappassword


			
		

Linux 整合AD登入認證

公司ERP(tiptop) 使用 linux 系統(RHEL5)
因此登入的時候若能整合AD
將是再好不過了.
初期網路上找一找,很快就能使用AD帳號登入
http://www.linuxmail.info/active-directory-linux/

但是若公司有多個網域怎麼辦呢?
這個我試了很多次都失敗
後來將samba升級成3.5.x,就可以完成了.
以下是簡單步驟

1. 網域須互相信任(互相信任時,須提供共用帳號與密碼)
2. samba升級成3.5.x
3. 在linux上使用上述互相信任的帳號,執行加入網域指令
net rpc join  -U <信任帳號>
net ads join  -U <信任帳號>
4. 重開winbind
5. 檢查是否成功
getent passwd
若出現多網域使用者訊息,即代表成功.
6. 開心登入囉, 登入時帳號格式:  "domain alias""account"
ex:
yahoouserwilliam

ps. 重點在於rhel 5.5 的samba只能更新到3.0.x, 必須另外找方式升級到3.5.x
我的環境:
rhel 5.5
samba 3.5.x

--
後記

當這樣做的時候,可能會造成原本passwd上面帳號認證的錯誤
請修改/etc/pam.d/system-auth
將uid500改成passwd上最大的uid號碼即可