POSTFIX-NON-BDB(1) General Commands Manual POSTFIX-NON-BDB(1) # [NAME](#NAME) postfix-non-bdb - Postfix non-Berkeley-DB migration # [SYNOPSIS](#SYNOPSIS) ``` postfix non-bdb subcommand ``` # [DESCRIPTION](#DESCRIPTION) The "**postfix non-bdb subcommand**" feature edits main.cf and master.cf, to manage the migration of an existing Postfix configuration that uses Berkeley DB type "hash:" or "btree:" tables (which are no longer supported on some OS distributions), to supported types such as "cdb:" or "lmdb:". The following subcommands are available: [**status**](#status) Reports the non-Berkeley-DB migration status, without making any changes. [**disable**](#disable) Edits main.cf and master.cf, to turn off the **enable-redirect** and **enable-reindex** features. This will break integration with other software such as mailman versions from before May 2025 when they want to use "postmap hash:/path/to/file", for example, to update a mailman-maintained table. [**enable-redirect** (aliasing)](#enable) Edits main.cf and master.cf, to enable redirection (aliasing) from Berkeley DB types "hash" and "btree" to the non-Berkeley-DB types specified with $default\_database\_type and $default\_cache\_db\_type. Custom redirection may be configured with non\_bdb\_custom\_mapping. This configuration will not automatically create non-Berkeley-DB indexed database files. Instead, Postfix programs will log an error as they fail to open an indexed database file, and will leave it to the system administrator to run [postmap(1)](/man/os/postfix/postmap.1) or [postalias(1)](/man/os/postfix/postalias.1) to create that file. This will fix integration with other software such as mailman versions from before May 2025 when they want to use "postmap hash:/path/to/file", for example, to update a mailman-maintained table. This subcommand will not make any changes when default\_database\_type or default\_cache\_db\_type specify a hash: or btree: type. [**enable-reindex**](#enable~2) Edits main.cf and master.cf, to implement **enable-redirect**, and to automatically create a non-Berkeley-DB indexed database file when a daemon program wants to access a file that does not yet exist. This uses the [nbdb\_reindexd(8)](/man/os/postfix/nbdb_reindexd.8) daemon to run [postmap(1)](/man/os/postfix/postmap.1) or [postalias(1)](/man/os/postfix/postalias.1) as described in "SECURITY" below. This subcommand immediately generates non-Berkeley-DB indexed files for unprivileged command-line programs that cannot send requests to the [nbdb\_reindexd(8)](/man/os/postfix/nbdb_reindexd.8) daemon server. This involves "hash:" and "btree:" tables that are used by [postqueue(1)](/man/os/postfix/postqueue.1) and [sendmail(1)](/man/os/postfix/sendmail.1) as specified in authorized\_flush\_users and authorized\_mailq\_users, and by [sendmail(1)](/man/os/postfix/sendmail.1) and [postdrop(1)](/man/os/postfix/postdrop.1) as specified in authorized\_submit\_users and local\_login\_sender\_maps. This subcommand will not make any changes when default\_database\_type or default\_cache\_db\_type specify a hash: or btree: type. *NOTE: enable-reindex should be used only temporarily* *to generate most of the non-Berkeley-DB indexed files that Postfix* *needs. Leaving this enabled may expose the system to* *privilege-escalation attacks. There are no security* *concerns for using enable-redirect*. # [SECURITY](#SECURITY) ``` ``` The [nbdb\_reindexd(8)](/man/os/postfix/nbdb_reindexd.8) daemon automatically generates a non-Berkeley-DB indexed file only if the database pathname matches the directory prefixes specified with non\_bdb\_migration\_allow\_root\_prefixes (for files that must be owned by root), or with non\_bdb\_migration\_allow\_user\_prefixes (for files that must be owned by a non-root user). Additional restrictions on file and directory ownership and permissions are documented in [nbdb\_reindexd(8)](/man/os/postfix/nbdb_reindexd.8). # [CONFIGURATION PARAMETERS](#CONFIGURATION_PARAMETERS) ``` ``` The "**postfix non-bdb subcommand**" feature updates the following configuration parameter: [**non\_bdb\_migration\_level (disable)**](#non_bdb_migration_level) The non-Berkeley-DB migration service level. Other relevant parameters: [**non\_bdb\_custom\_mapping (empty)**](#non_bdb_custom_mapping) When non-Berkeley-DB migration is enabled, an optional mapping from a hash: or btree: type to a non-Berkeley-DB type. [**non\_bdb\_migration\_allow\_root\_prefixes (see 'postconf -d non\_bdb\_migration\_allow\_root\_prefixes' output)**](#non_bdb_migration_allow_root_prefixes) A list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service ([**nbdb\_reindexd**(8)](/man/os/postfix/nbdb_reindexd.8)) needs to run [**postmap**(1)](/man/os/postfix/postmap.1) or [**postalias**(1)](/man/os/postfix/postalias.1) commands with "root" privilege. [**non\_bdb\_migration\_allow\_user\_prefixes (see 'postconf -d non\_bdb\_migration\_allow\_user\_prefixes' output)**](#non_bdb_migration_allow_user_prefixes) A list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service ([**nbdb\_reindexd**(8)](/man/os/postfix/nbdb_reindexd.8)) needs to run [**postmap**(1)](/man/os/postfix/postmap.1) or [**postalias**(1)](/man/os/postfix/postalias.1) commands with non-root privilege. # [SEE ALSO](#SEE_ALSO) ``` nbdb_reindexd(8) reindexing service ``` # [README FILES](#README_FILES) ``` ``` Use "**postconf readme\_directory**" or "**postconf html\_directory**" to locate this information. ``` NON_BERKELEYDB_README, migration guide ``` # [LICENSE](#LICENSE) ``` ``` The Secure Mailer license must be distributed with this software. # [HISTORY](#HISTORY) The "**postfix non-bdb**" command was introduced with Postfix version 3.11. # [AUTHOR(S)](#AUTHOR%28S%29) ``` Wietse Venema porcupine.org ``` --- Document: postfix-non-bdb(1) from postfix 3.11.7-r1 (Chainguard OS) Source: https://github.com/vdukhovni/postfix