[763] in Info-AFS_Redistribution
Re: mail & afs
daemon@ATHENA.MIT.EDU (Stig Ostholm)
Mon May 11 06:01:13 1992
Date: Mon, 11 May 92 08:13:40 GMT
From: Stig Ostholm <ostholm@ce.chalmers.se>
To: Info-AFS@transarc.com
We here at Chalmers University have been running an AFS based mail system
for a couple of years now.
The situation at Chalmers is somewhat complicated due to the fact that
the AFS client machines belongs to different departments and may contain
local or NFS-mounted users that may have the same name as an existing AFS
user. AFS users may also be removed from the passwd file on some machines
due to some department policy. The result is that no consistency can be
guranteed between accounts on various machines.
This problem was fixed by moving the mailbox from "/usr/spool/mail" to a
subdirectory, ".mailbox" in the recipient home directory. On all machines
where the recipenit account is present, the mailbox is also present.
The AFS protection on ".mailbox" does only allows the recipient and a special
user, "postman", to modify it's contentse. A machine local account does only
allow the recipient and the group "daemon" to manipulate the mailbox.
The old mail delivery program, binmail, has been replaced with a new one that
authenticates as "postman" to AFS and runs setgid "daemon" to the local file
system.
The old mailbox directory, "/usr/spool/mail" contains symbolics link to the
new location. There is a AFS global "/usr/spool/mail" for `pure' AFS machines.
Other machines must have a local "/usr/spool/mail" that also reflects the
local accounts.
This system has worked well and has not required any other changes to the
mail system other than modifying some mail-programs to follow the AFS
semantics on flock: the file must be closed and opened again before retrying
flock.
Another problem is that some of the departments want's all their mail to be
delivered to another system than the AFS based. This causes a problem since
the sender address of the users may not cause a delivery on AFS machine even
if the user did send a letter from an AFS machine.
This could be solved by using ".forward" or aliases that points to the actual
delivery machine. It would, hovewer, give a multitude of sender addresses for
a user. The solution finaly used was to create a shadow file to /etc/passwd
that contains an individual domain address fore each user (the default is to
use the machine domain address), and adding a lookup function to sendmail.
The result is that each account has an one sender address independent of
which system he is using (AFS based or department local).
_
Stig Ostholm
