Skip to content

scripts: disallow alias = account#3270

Merged
georglauterbach merged 3 commits intomasterfrom
scripts/aliases-as-users-equals-no
Apr 17, 2023
Merged

scripts: disallow alias = account#3270
georglauterbach merged 3 commits intomasterfrom
scripts/aliases-as-users-equals-no

Conversation

@georglauterbach
Copy link
Copy Markdown
Member

@georglauterbach georglauterbach commented Apr 17, 2023

Description

We do not support aliases that are accounts at the same time. This commit provides a guard that checks the condition.

@bibiak1 made us aware of the fact that we allow creating aliases as users (and vice versa). I think we do not support this, and at least to me, it does not make a lot of sense.

Fixes #3262
Closes #3259

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • If necessary I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

We do not support aliases that are accounts at the same time. This
commit provides a guard that checks the condition.
@georglauterbach georglauterbach added area/scripts kind/bug/fix A fix (PR) for a confirmed bug labels Apr 17, 2023
@georglauterbach georglauterbach added this to the v12.1.0 milestone Apr 17, 2023
@georglauterbach georglauterbach self-assigned this Apr 17, 2023
@georglauterbach
Copy link
Copy Markdown
Member Author

@polarathene I am not 100% certain whether we should disallow both directions, but to me that makes sense.

Comment thread target/scripts/helpers/database/manage/postfix-accounts.sh Outdated
Comment thread target/scripts/helpers/database/manage/postfix-virtual.sh Outdated
Copy link
Copy Markdown
Member

@polarathene polarathene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 😀

Preventing either DB adding a key that belongs to the other makes sense to me 👍

@georglauterbach georglauterbach merged commit 3f22cbc into master Apr 17, 2023
@georglauterbach georglauterbach deleted the scripts/aliases-as-users-equals-no branch April 17, 2023 17:22
function _account_should_not_exist_yet
{
__account_already_exists && _exit_with_error "'${MAIL_ACCOUNT}' already exists"
if grep -q "^${MAIL_ACCOUNT}" "${DATABASE_VIRTUAL}"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember, that we had a similar issue in the past:

postfix-virtual.cf looks like:

The grep statement above would also match on:

[email protected]

Adding a space for example should fix it:

if grep -q "^${MAIL_ACCOUNT} " "${DATABASE_VIRTUAL}"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That should be handled in both lookups then? But for accounts table, instead of space a |?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right.

@KevinBrogan
Copy link
Copy Markdown

If you don't support it, then emit a warning. Call it an advanced option. something other than a pointless block.
The server software supports it without issue.
Now I'm just going to go delete this line from the container I'm hosting.

@polarathene
Copy link
Copy Markdown
Member

If you don't support it, then emit a warning. Call it an advanced option. something other than a pointless block.

I'm fine with a change to allow it with a warning emitted, or a prompt for confirmation before continuing.

You're welcome to open a PR if the other maintainers are comfortable with the change. It should include test coverage that avoids errors like this one.

FWIW we do make this concern more prominent in our docs from DMS v15 onwards:

image


The server software supports it without issue.

Yes but DMS is another layer on top of that.

Virtual aliases by default will be used to create dummy accounts in Dovecot. A side-effect is you can login with that (and some users do this), even though that is unintentional and not supported, it's the only option we have for Dovecot Quota support to work without writing and maintaining our own policy check service for Postfix.

Could you please add some context to why you need an alias to your mailbox account with the same address? We enforced this block due to various bug reports caused by misconfigurations (more context here).

It's also possible you are dealing with an XY problem where you are dismissing our decision to forbid aliases sharing mailbox addresses to solve a problem that would be better supported by other features from Postfix. If so your concern is more for the lack of official support via DMS for such, but even if we had that in place you may have only been familiar with aliases and not considered it?

The valid use-cases that I'm aware of are:

  • Wildcard catch-all alias has precedence as aliases are resolved before mailbox addresses. The workaround for that is to have an alias with the mailbox address which will have precedence over the wildcard, be a no-op and send to the same address as the alias, handing over to Dovecot for local delivery.
  • Forwarding mail to an external mail server, but still retaining a copy locally. DMS doesn't officially support multiple recipients for an alias however (the Dovecot Quotas workaround isn't compatible for example).

Invalid use-cases tend to be forwarding to an external mail server, often @gmail.com.

@georglauterbach
Copy link
Copy Markdown
Member Author

If you don't support it, then emit a warning. Call it an advanced option. something other than a pointless block. The server software supports it without issue. Now I'm just going to go delete this line from the container I'm hosting.

Thank you for chiming into this closed issue. I also appreciate the kindness with which this command comment has been put forward. As a consequence, I'm eagerly awaiting your well-tested contribution to this FOSS project, which is maintained by individuals in their spare time.


@polarathene was too kind when he gave a friendly answer here. But I have zero tolerance when it comes to impoliteness. Formulate what you want in a direct, precise, and friendly manner. You are not entitled to demand changes to this project, you can ask for them nicely. At the risk of repeating myself: This project is free, open-source, and maintained by individuals in their spare time. This happens again, and you'll be posting nowhere on this whole project, @KevinBrogan. I've made myself clear here, no discussion necessary anymore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/scripts kind/bug/fix A fix (PR) for a confirmed bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug report: alias code for group mail aliases

4 participants