[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Two-part question



On Sat, 2004-06-26 at 03:50, Darik Horn wrote:
>  > I hoped to solve this problem by using pam_mkhomedir.so as a session
>  > module for Courier, but it seems to be disregarding it.
> 
> IIRC, Courier tries to change into the home directory before calling the 
> pam_mkhomedir.so module.  (Or somesuch.)

I found the offending line of code (or so I believe), which was in the
authlib/success.c source file. Basically, a function is called during
the authentication process (for any of the courier auth modules) that
sets up environment varaibles and other housekeeping items). As part of
this, it attempts to change into the user's home directory. I tried a
patch, but it did not seem to work. I'm still looking into it.

>  > Does anyone have a suggestion for where I can go from here? It looks
>  > like I may be running out of options.
> 
> I looked at the Courier code, and decided to script home directory 
> creation with a cron job instead of fixing the PAM routines.

A cron job? That seems rather inefficient, as well as tough, since you
would have to poll the entire list of users every (hour|day), and check
it against current home directories.

> Alternatively, you could wrap your local delivery agent with a script 
> like this:
> 
>    #!/bin/ash
>    if [ ! -e "$HOME" ]
>    then
>      # With an appropriate sudo configuration...
>      sudo cp -r /etc/skel "$HOME"
>      maildirmake "$HOME/Maildir"
>    fi
>    exec MyLDA "$@"
>    # eof
> 
> If you use a lightweight shell like ash, then the overhead will be 
> tolerable.  YMMV.

True. Unfortunately, with reasonably high volume, won't this end up
forking thousands of ash threads? Or would ash only have one copy
residing in memory? If that's true, there could be extremely little of a
performance hit, since it would never leave from resident memory, and
never be forced to be loaded back in.

-- 
Stephen Touset <stephen@touset.org>

Attachment: signature.asc
Description: This is a digitally signed message part


Reply to: