sending out different certs cyrus and sendmail over multiple gateways.

x0000000009 · 04-06-2010, 01:54 PM

I'm hosting a Sendmail Cyrus-Imap server on fedora 12. I recently installed a second NIC on a second internet gateway and successfully configured source based routing.

Clients are able to connect over the mail.domain.com received from the gateway 192.168.0.1 to the interface 192.168.0.254. ETH0

Clients are also able to connect from pop3.domain.com and smtp.domain.com from the second gateway 192.168.1.1 to the interface 192.168.1.254. ETH1

I have cyrus-imap certs configured for the mail.domain.com and a Sendmial cert configured for mail.domain.com.

My question is how would I tell sendmail and cyrus that the mail.domain.com goes out the ETH0 but deliver the second and third cert (eg cyrus sends pop3.domain.com and sendmail sends smtp.domain.com) to clients connected on ETH1?

beadyallen · 04-08-2010, 06:09 AM

For cyrus, you can have multiple 'imap' or 'imaps' entries in /etc/cyrus.conf, each with a different config file. So you could have (for example):

Code:

SERVICES {                                                   
  imaps          cmd="imapd -s -C /etc/imapd-eth0.conf" listen="imap2" prefork=0                
  imaps          cmd="imapd -s -C /etc/imapd-eth1.conf" listen="144" prefork=0

This would mean that two (or more) imapd processes would start, one on the default imap2 port (143), and one on port 144, using different config files (and therefore different certificates etc). A bit of port redirection using iptables and you can have imap connections from eth1 redirected to the second imapd process. You'd have to be careful that each imapd.conf file FULLY specified separate directories for spool, lib etc (using defaults would cause problems I imagine as they might overwrite each other's databases etc), but on the face of it this should do what you want.

I haven't tested this thoroughly but it seems to work (at least two imapd daemons start and you can connect to both and have different mailstores presented).

Sorry, can't help with sendmail as I use exim, but I'd have thought you could do something similar. Afterall, all you're really doing above is starting two daemons and using port redirection to make them transparent.

Good luck.