POSTFIX-NON-BDB(1)

💖 postfix-non-bdb — the migration glow-up 💖

okay bestie, so this is a page from the General Commands Manual, section 1 (POSTFIX-NON-BDB(1)). yes it's a real manual page. yes it's about Berkeley DB. stay with me, it's gonna be cute AND useful. 🎀

---

🌸 NAME 🌸

postfix-non-bdb — the Postfix non-Berkeley-DB migration. it's giving "moving on from your ex (berkeley db) to something better". ✨

---

🦋 SYNOPSIS 🦋

postfix non-bdb subcommand

---

💅 DESCRIPTION 💅

so the "postfix non-bdb subcommand" feature edits main.cf and master.cf, and its whole job is managing the migration of an existing Postfix config that's using Berkeley DB type hash: or btree: tables — which, ngl, are no longer supported on some OS distributions 😭 — over to supported types like cdb: or lmdb:. glow up for your tables, periodt. 👑

here are the subcommands, bestie:

• status — reports the non-Berkeley-DB migration status. that's it. no changes, no edits, just vibes and information. 🫶
• disable — edits main.cf and master.cf to turn off the enable-redirect and enable-reindex features.

⚠️ heads up: this will break integration with other software, like mailman versions from before May 2025, when they want to use postmap hash:/path/to/file — for example, to update a mailman-maintained table. 💀

• enable-redirect (aliasing) — edits main.cf and master.cf to enable redirection (aliasing) from the Berkeley DB types "hash" and "btree" to the non-Berkeley-DB types specified with $default_database_type and $default_cache_db_type. custom redirection? you can configure that with non_bdb_custom_mapping. slay. ✨

so real talk: this configuration will not automatically create non-Berkeley-DB indexed database files. instead, Postfix programs will log an error as they fail to open an indexed database file, and they'll leave it to the system administrator to run postmap(1) or postalias(1) to create that file. you gotta do it yourself, babe. 🙈

this will fix integration with other software, like mailman versions from before May 2025, when they want to use postmap hash:/path/to/file — for example, to update a mailman-maintained table.

and also: this subcommand will not make any changes when default_database_type or default_cache_db_type specify a hash: or btree: type. it's like, "not my problem bestie". 💅

• enable-reindex — edits main.cf and master.cf to implement enable-redirect, and to automatically create a non-Berkeley-DB indexed database file when a daemon program wants to access a file that doesn't exist yet. this uses the nbdb_reindexd(8) daemon to run postmap(1) or postalias(1) as described down in SECURITY. main character energy fr fr. 👑

this subcommand immediately generates non-Berkeley-DB indexed files for unprivileged command-line programs that cannot send requests to the nbdb_reindexd(8) daemon server. that involves "hash:" and "btree:" tables that are used by postqueue(1) and sendmail(1) as specified in authorized_flush_users and authorized_mailq_users, and by sendmail(1) and postdrop(1) as specified in authorized_submit_users and local_login_sender_maps. so many lists, so much power. 🔥

and same as before: this subcommand will not make any changes when default_database_type or default_cache_db_type specify a hash: or btree: type.

🚨 NOTE: enable-reindex should be used only temporarily to generate most of the non-Berkeley-DB indexed files that Postfix needs. leaving this enabled may expose the system to privilege-escalation attacks. 😭 bestie please turn it off. good news tho: there are no security concerns for using enable-redirect. 🫶

---

🔥 SECURITY 🔥

the nbdb_reindexd(8) daemon automatically generates a non-Berkeley-DB indexed file only if the database pathname matches the directory prefixes specified with non_bdb_migration_allow_root_prefixes (for files that must be owned by root), or with non_bdb_migration_allow_user_prefixes (for files that must be owned by a non-root user). extra restrictions on file and directory ownership and permissions are documented in nbdb_reindexd(8). like, it checks IDs at the door. no vip list, no entry. 🚫🎀

---

⭐ CONFIGURATION PARAMETERS ⭐

the "postfix non-bdb subcommand" feature updates this following configuration parameter:

• non_bdb_migration_level (disable) — the non-Berkeley-DB migration service level.

and here are the other relevant parameters, bestie:

• non_bdb_custom_mapping (empty) — when non-Berkeley-DB migration is enabled, an optional mapping from a hash: or btree: type to a non-Berkeley-DB type.
• non_bdb_migration_allow_root_prefixes (see postconf -d non_bdb_migration_allow_root_prefixes output) — a list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service (nbdb_reindexd(8)) needs to run postmap(1) or postalias(1) commands with "root" privilege.
• non_bdb_migration_allow_user_prefixes (see postconf -d non_bdb_migration_allow_user_prefixes output) — a list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service (nbdb_reindexd(8)) needs to run postmap(1) or postalias(1) commands with non-root privilege.

---

👀 SEE ALSO 👀

• nbdb_reindexd(8) — reindexing service 💖

---

🌈 README FILES 🌈

use "postconf readme_directory" or "postconf html_directory" to locate this information.

• NON_BERKELEYDB_README — migration guide 🧚

---

💜 LICENSE 💜

the Secure Mailer license must be distributed with this software. periodt. 🎀

---

🦄 HISTORY 🦄

the "postfix non-bdb" command was introduced with Postfix version 3.11. iconic behavior. ⭐

---

👑 AUTHOR(S) 👑

• Wietse Venema
• porcupine.org

---

okay that's the whole page bestie, we ate 💅✨

🌸 cute lil sign-off: this was the POSTFIX-NON-BDB(1) page from the General Commands Manual — that's the manual name: postfix-non-bdb, section 1, "General Commands Manual". 🦋 go forth and migrate your tables, you got this. 🫶