Now that you have successfully compiled and installed authmkhome, you need to
So, let's start from the first step...
Before anything else, you should open courier-imap and courier-pop3 configuration files (on my system, /etc/courier/imapd and /etc/courier/pop3d).
Look for a line like
AUTHMODULES="authdaemon"
or
AUTHMODULES="any_fancy_authentication_module"
and change it in
AUTHMODULES="authdaemon authmkhome"
or
AUTHMODULES="any_fancy_authentication_module authmkhome"
Beware! authmkhome relies on other modules authenticating the users. Thus, it must
be called as the last authentication module (unless you want to see funny things happening to
your system).
Watch out that once courier is configured to use authmkhome, any authenticated user whose home directory does not exist won't be allowed in in case authmkhome can't find a valid maildir-creator script.
By default, authmkhome will look for a script in /usr/sbin/authmkhome-creator. It will call this script with the name of the user as the first argument and the directory to create as the second argument. Many other parameters may be available through the environment but you shouldn't rely on them too much since they may change from version to version of courier.
Anyway, you can specify a different homedir creator with the parameter ``MAILDIR_CREATOR''. You can put it in any of courier-imap or pop3 configuration files, as long as the script is executable. Actually, if you put this parameter in pop3d you should modify the init script in order to force the variable to be exported. In this case, you may want to modify your /etc/init.d/courier-pop3 to look like:
/usr/bin/env - MAILDIR_CREATOR="$MAILDIR_CREATOR" PATH="...
while the original should be quite similar to:
/usr/bin/env - PATH="$PATH" SHELL="$SHELL" POP3AUTH="$POP3AUTH" \
$TCPD -pid=$PIDFILE -stderrlogger=${sbindir}/courierlogger \
-maxprocs=$MAXDAEMONS -maxperip=$MAXPERIP \
$TCPDOPTS -address=$ADDRESS $PORT \
${prefix}/lib/courier/courier/courierpop3login $AUTHMODULELIST \
${prefix}/lib/courier/courier/courierpop3d Maildir
If you want to, although useless in most cases, you can also specify two different
creators, one for the pop3 daemon and one for the imap daemon. Just put a different
``MAILDIR_CREATOR'' in the correct configuration files. Make sure to
read the following sections on how to write a creator since it can be quite tricky.
Beware! The creator script is called with a simple exec. Thus, they cannot be ``inlined'' bash scripts. Example:
THIS IS BAD: MAILDIR_CREATOR="mkdir $(echo 'SELECT * FROM ...'|cut -f); chmod..."
There are few things to keep in mind when writing the mailcreator script:
drwxrwx--- root mailgrp /home/mail drwx------ usr1 mailgrp /home/mail/usr1 drwx------ usr2 mailgrp /home/mail/usr2Using this scheme, no user would be able to read somebody else mails, no user would be able to remove anybody else maildirs, however, any mailgrp user could be able to create any number of directories inside /home/mail without giving the right to courier to write in there leading to a denial of service. This method is thus suggested to those of you who don't give shell accounts to their mail users.
Other better solutions probably exist, but keep in mind that authmkhome runs with user privileges.
set >> /tmp/state.logHere is an incomplete list of variables available in courier-0.36.0 and their values (most of them are just crap from our point of view):
ADDRESS=0
AUTHADDR=ccontavalli@localhost # Mail address of the logged in user
AUTHARGC=4 # See man authlib
AUTHARGV0=/usr/lib/courier/courier/imaplogin
AUTHARGV1=/usr/lib/courier/authlib/authdaemon
AUTHARGV2=/usr/bin/imapd
AUTHARGV3=Maildir
AUTHENTICATED=ccontavalli@localhost # Username
AUTHEXPIRE=1009760251
AUTHFULLNAME='Carlo Contavalli' # Full name of the user (if provided by the db)
AUTHMODULES=authdaemon
AUTHMODULES_ORIG=authdaemon
AUTHUSER=/usr/lib/courier/courier/imaplogin
EUID=1051 # Effective user id of the process
# (provided by your system)
GROUPS=() # Additional groups (provided by your system)
HOSTNAME=caronte # Hostname (provided by your system)
IMAPDSTART=YES
IMAPLOGINTAG=001
IMAP_CAPABILITY='IMAP4rev1 CHILDREN NAMESPACE \
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT'
IMAP_CAPABILITY_ORIG='IMAP4rev1 CHILDREN NAMESPACE \
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT \
AUTH=CRAM-MD5 AUTH=CRAM-SHA1 IDLE'
IMAP_CAPABILITY_TLS='IMAP4rev1 CHILDREN NAMESPACE \
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT AUTH=PLAIN'
IMAP_CAPABILITY_TLS_ORIG='IMAP4rev1 CHILDREN NAMESPACE \
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT AUTH=CRAM-MD5 \
AUTH=CRAM-SHA1 IDLE AUTH=PLAIN'
IMAP_CHECK_ALL_FOLDERS=0
IMAP_DISABLETHREADSORT=0
IMAP_EMPTYTRASH=Trash:7
IMAP_IDLE_TIMEOUT=60
IMAP_MOVE_EXPUNGE_TO_TRASH=0
IMAP_OBSOLETE_CLIENT=0
IMAP_STARTTLS=NO
IMAP_ULIMITD=65536
IMAP_USELOCKS=0
MAILDIR=1051/
MAXDAEMONS=40
MAXPERIP=4
OPTERR=1
OPTIND=1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PIDFILE=/var/run/courier/imapd.pid
PIPESTATUS=([0]="0")
PORT=143
PPID=668
TCPDOPTS='-nodnslookup -noidentlookup'
TCPLOCALIP=::ffff:127.0.0.1
TCPLOCALPORT=143
TCPREMOTEIP=::ffff:127.0.0.1
TCPREMOTEPORT=1030
UID=1051
Finally, here is an example of maildir creator that uses the provided environment variables and the suggested
scheme of ownerships and rights:
#!/bin/bash username=$1 maildir=$2 maildirmake /home/mail/$maildir chown -R $UID:mailgrp /home/mail/$maildir logger -p auth.notice -t courier Automagically created homedir "$maildir"\ for uid "$UID" aka "$username".