Problem using Postfix with LDAP using STARTTLS

2 msg	hash table not matching subdomains
18 msg	Non-delivery problem
3 msg	tracing mail
5 msg	different SMTP ip sender in one instance of pos...
18 msg	Three Postfix Errors
10 msg	Conditional relay to a barracuda spam filter
2 msg	Postfix as honeypot
3 msg	postqueue -p
17 msg	Patch to pas all the recipients of a mail to th...
5 msg	Postfix DBD Help
4 msg	Send and receive mail on different ports?
3 msg	postfix behind a router
1 msg	postfix to access mail from external host.
4 msg	Three installation/configuration issues
9 msg	Reject SMTP connection if two RBL match
3 msg	Holding Large Emails
9 msg	Monitor Relaying
7 msg	Sender address rejected when sending messages t...

Problem using Postfix with LDAP using STARTTLS
\ Martijn Brekhof (15 Nov 2007)

7 msg	resources for 'only virtual domains'

Subject:	Problem using Postfix with LDAP using STARTTLS
Group:	Postfix-users
From:	Martijn Brekhof
Date:	15 Nov 2007

Hi,

I got a problem using virtual_domain_domains with openLDAP and TLS. I use
postfix version 2.3.8 and openLDAP 2.3.30 on Debian Etch.

I am using alias_maps with LDAP for which the connection is set through
STARTTLS. Now I am also using LDAP for virtual_mailbox_domains, it works
when not using STARTTLS, however it fails to connect when using STARTTLS.
Log shows the following warnings when debuglevel is set to -1 (see
http://pastebin.org/8254 for a long version with smtpd set verbose (-v)):

Nov 15 14:43:12 vm0002 postfix/master[2594]: warning: process
/usr/lib/postfix/trivial-rewrite pid 2603 exit status 2
Nov 15 14:43:12 vm0002 postfix/smtpd[2601]: warning: premature end-of-input
on private/rewrite socket while reading input attribute name
Nov 15 14:43:13 vm0002 postfix/smtpd[2601]: warning: premature end-of-input
on private/rewrite socket while reading input attribute name
Nov 15 14:43:13 vm0002 postfix/smtpd[2601]: warning: problem talking to
service rewrite: Success
Nov 15 14:43:13 vm0002 postfix/master[2594]: warning: process
/usr/lib/postfix/trivial-rewrite pid 2604 exit status 2
Nov 15 14:43:13 vm0002 postfix/master[2594]: warning:
/usr/lib/postfix/trivial-rewrite: bad command startup -- throttling

As alias_maps works I do not believe it is a problem on the side of
openLDAP. Can anyone tell me what I might be doing wrong?

Thanks,

Martijn

The following are my configuration settings for the aliases and virtual
domains:
---
postconf -h

alias_maps = ldap:/etc/postfix/ldap-aliases.cf
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
content_filter = amavis:127.0.0.1:10025
inet_interfaces = all
local_recipient_maps =
mailbox_size_limit = 0
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
myhostname = vm0002.vm.kern.nl
mynetworks = 127.0.0.0/8 172.18.18.0/24 172.18.19.0/24 172.20.0.0/16
myorigin = /etc/mailname
receive_override_options = no_address_mappings
recipient_delimiter = +
relay_domains =
relayhost =
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_helo_restrictions = reject_invalid_helo_hostname
reject_non_fqdn_helo_hostname reject_unknown_helo_hostname
smtpd_recipient_restrictions = permit_sasl_authenticated
reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = smtpd
smtpd_tls_always_issue_session_ids = no
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/vm0002.vm.kern.nl.pem
smtpd_tls_key_file = /etc/ssl/private/vm0002.vm.kern.nl.priv.key.pem
smtpd_tls_mandatory_protocols = TLSv1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/mail/vhosts/
virtual_mailbox_domains = ldap:/etc/postfix/ldap-vdomains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf
virtual_minimum_uid = 100
virtual_transport = virtual
virtual_uid_maps = static:5000

---

---
Snippet from /etc/postfix/main.cf:

#Virtual domains
virtual_transport = virtual
virtual_mailbox_domains = ldap:/etc/postfix/ldap-vdomains.cf
virtual_mailbox_base = /var/mail/vhosts/
#virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

alias_maps = ldap:/etc/postfix/ldap-aliases.cf
#alias_database = hash:/etc/aliases
---

---
/etc/postfix/ldap-vdomains.cf:

server_host = vm0002.vm.kern.nl
search_base = dc=vm,dc=kern,dc=nl
start_tls = yes
version = 3
bind = no
tls_ca_cert_file = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_cert = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_key = /etc/ssl/private/vm0002.vm.kern.nl.key
tls_cipher_suite = TLSv1+HIGH
query_filter = (&(objectClass=JammVirtualDomain)(jvd=%s))
result_attribute = jvd
scope = one
debuglevel = -1
---

---
/etc/postfix/ldap-accounts.cf

server_host = vm0002.vm.kern.nl
search_base = dc=vm,dc=kern,dc=nl
start_tls = yes
version = 3
bind = no
tls_ca_cert_file = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_cert = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_key = /etc/ssl/private/vm0002.vm.kern.nl.key
tls_cipher_suite = TLSv1+HIGH
query_filter = (&(objectClass=JammMailAccount)(mail=%s))
result_attribute = mailbox
debuglevel = -1
---'

---
/etc/postfix/ldap-aliases.cf:

server_host = vm0002.vm.kern.nl
search_base = dc=vm,dc=kern,dc=nl
start_tls = yes
version = 3
bind = no
tls_ca_cert_file = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_cert = /etc/ssl/certs/vm0002.vm.kern.nl.crt
tls_key = /etc/ssl/private/vm0002.vm.kern.nl.key
tls_cipher_suite = TLSv1+HIGH
query_filter = (&(objectClass=JammMailAlias)(mail=%s))
result_attribute = maildrop
debuglevel = -1
---