LDAP Support in deepOfix

deepOfix is one of the first (and few) GNU/Linux operating systems that ship with built-in and pre-integrated support for LDAP. LDAP support in deepOfix goes beyond installation - in deepOfix LDAP is not just installed, but also configured as the default store for user account data and password information. LDAP support not only enables deepOfix to be highly scalable, but also ensure a large group of features that would otherwise have been impossible.

What is LDAP?

LDAP stands for Lightweight Directory Access Protocol (LDAP). LDAP is a networking protocol for querying and modifying directory services. A directory is a set of information with similar attributes organized in a logical and hierarchical manner. The most common example is the telephone directory, which consists of a series of names (either of a person or organization) organized alphabetically, with an address and phone number attached. A directory service is a software application that allows you query, access and modify information stored in a directory. (Source: wikipedia.org)

Directory services are very popularly employed in servers to store all sorts of user information and server configuration as well.

How does deepOfix use LDAP?

The deepOfix Mail Server is completely built around LDAP. We have endeavoured to use a LDAP-based directory for almost everything that deserves to be stored and could be stored in the directory.

deepOfix uses LDAP to store and access the following information:

• User information
  • All user attributes such as the user's ID, home directory path, full name and display name
  • Authentication and password information for email services, system services and domain and file sharing services for Microsoft Windows networks
  • Data related to password expiry and change
• Group information
  • All groups (in Linux terminology), email distribution lists and mailing lists in deepOfix are also stored in LDAP
  • Information about group members (both local and external), group moderators and those allowed to send emails to the group is also stored in LDAP
• Email related info
  • All users' email IDs - primary email IDs as well as aliases
  • Users' email forwarding and auto-response information
  • Per-user / mailbox level mail archiving information
  • Information about the location of a user's mailbox - both on the server as well as about which server (in case of clustered mail servers)
  • Size of users' mailboxes
• Contact information and Address books
  • Contact information about users within the server
  • Address books for storing contact information of external contacts

User benefits of using LDAP inside deepOfix

LDAP impacts deepOfix in many ways:

• High scalability: deepOfix can host thousands of mailboxes on a single server depending upon the server's hardware configuration
• High performance: deepOfix can effortlessly handle hunderds of thousands of emails per day (again based on the server's hardware configuration)
• Clusterable: LDAP-based directories are easy to replicate and hence deepOfix can be configured to host a larger numbers of mailboxes in a special clustering configuration.
• Simpler security model: The use of LDAP in deepOfix enables simpler ways to control access to who can query and modify what sort of information from the directory using LDAP. This enables users to change their own passwords, update their own contact information, configure their own email forwarding and auto-response and so much more!
• High Speed: LDAP lookups are typically much faster than lookups against plain text files or other databases. This is because LDAP-based directory servers are optimised to handle a high number of reads than writes. This enables deepOfix to do user lookups faster and hence consume less resources in the server.

How do we do it?

deepOfix uses the excellent and free / open source OpenLDAP software to provide directory services. Additionally tools like qmail with LDAP patches (qmail-ldap) (for email delivery services) and Samba (for MS Windows domain and file sharing services) now support LDAP to enable such functionality to be developed and used.

Intelligent Account Management

Superior account management is one of the most important features of deepOfix:

• How else would you modify the mailbox quotas and passwords of 250 users at the same time?
• How else would you query the server to see which users haven't changed their passwords in the recent past (or are supposed to change them in a few days). Similarly, how else would you effectively and effortlessly remind users to change their passwords reguarly and enforce some sort of password policy server-wide?
• How effortlessly can you copy all emails of a user being deleted to another?

Account management challenges

Account management is one of the most common and recurring server management tasks! It covers responsibilities such as creating accounts, tracking account usage (disk usage, account misuse etc.), configuring (and tracking) password expiry settings, disabling or deleting accounts, changing user account settings, applying or changing the same setting across multiple users and so on.

A lot of these tasks can be very repetitive in the absence of good reporting and management tools. It could sometimes involve writing complicated scripts and programs to automate such tasks. The actual complexity of these tasks, in turn, depends upon the complexity and diversity of underlying technology used for account management.

How complicated do you think it would be to:

• modify the mailbox quotas and passwords of 250 users at the same time?
• query the server to see which users haven't changed their passwords in the recent past (or are supposed to change them in a few days) or remind users to change their passwords reguarly?
• copy all emails of a user being deleted to another?

By default, there are no Free / Open Source Software tools that would enable you to do this automagically on a server - much less on a server which uses LDAP for account management! Most of the tasks above would involve scripting and programming of some apart from very detailed knowledge of how the operating system work and operates.

deepOfix simplifies account management challenges

The EasyPush Server Manager, an integrated server management system for deepOfix, provides multiple tools to ease account management:

All user account properties and attributes in one place

In spite of using multiple components to manage and apply account properties and attributes in the system, deepOfix provides you with facilities to manage all user-related information in one place.

EasyPush is the first Free / Open Source Software tool that provides you with cross-component integration for account management. Unlike other systems (mostly command line oriented but some web-based as well) EasyPush does not make you use multiple user interfaces to configure and manage properties related to user accounts.

A single window to query account information

EasyPush is one of the first server management systems that give you the ability to get a list of all user accounts along with their corresponding email addresses, full names and disk usage and quota information in one place. You can even download all this information in a CSV file for further processing and reporting!

Additionally, the query interface allows you to search users based on specific criteria, such as: group membership, disk usage, email address or full name or user name content and password last or next change dates.

Ability to apply the same setting across multiple accounts

EasyPush solves the classic problem of repetitive account management tasks. It provides you a very simple mechanism to apply the same change or setting across multiple users!

Not only can you change all users' passwords at one time, you can also set (or unset) mailbox quotas, group memberships and password expiry settings for everyone at the click of a button.

Two ways to do group memberships

You can think about group memberships as a user belonging to multiple groups or a group having multiple users as members. No matter how you want to look at group memberships, EasyPush will let you apply group memberships.

Ability to operate on user or group data before deleting it

Deleting a user is no longer as simple as deleting the user's complete mailbox and data! Most people today want to make a backup of the user's mailbox and data, copy the user's email to another user, forward all future emails to another user and so on. Tasks like this can also become fairly complicated - requiring server administrators to turn to shell scripting or programming to automate the tasks.

However, EasyPush provides you with a simple interface to do this in a jiffy!

... and many more under development
The EasyPush Server Manager's account management system is only getting better, simpler and more capable. Our next few features include built-in and web-based mass user creation and migration tools...

Centralised LDAP-based Address books

LDAP-based addressbooks can really change the way you look at centralised contact management in your organisation:

• Build a neatly-categorised organisation-wide addressbook of common contacts

• Ensure that information is always fresh because it is managed centrally

• A single addressbook serves contact information about local users & groups and other contacts