---
name: "postfix-non-bdb"
section: "1"
platform: "linux"
package: "postfix"
version: "3.11.7-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/postfix-non-bdb"
---

# postfix-non-bdb(1)

Postfix non-Berkeley-DB migration

## NAME

postfix-non-bdb - Postfix non-Berkeley-DB migration

## SYNOPSIS

```
postfix non-bdb subcommand
```

## DESCRIPTION

The "**postfix non-bdb** *subcommand*" feature edits main.cf and master.cf, to manage the migration of an existing Postfix configuration that uses Berkeley DB type "hash:" or "btree:" tables (which are no longer supported on some OS distributions), to supported types such as "cdb:" or "lmdb:".

The following subcommands are available:

- **status**

  Reports the non-Berkeley-DB migration status, without making any changes.

- **disable**

  Edits main.cf and master.cf, to turn off the **enable-redirect** and **enable-reindex** features.

  This will break integration with other software such as mailman versions from before May 2025 when they want to use "postmap hash:/path/to/file", for example, to update a mailman-maintained table.

- **enable-redirect** (aliasing)

  Edits main.cf and master.cf, to enable redirection (aliasing) from Berkeley DB types "hash" and "btree" to the non-Berkeley-DB types specified with $default\_database\_type and $default\_cache\_db\_type. Custom redirection may be configured with non\_bdb\_custom\_mapping.

  This configuration will not automatically create non-Berkeley-DB indexed database files. Instead, Postfix programs will log an error as they fail to open an indexed database file, and will leave it to the system administrator to run [postmap(1)](/postmap/1.md) or [postalias(1)](/postalias/1.md) to create that file.

  This will fix integration with other software such as mailman versions from before May 2025 when they want to use "postmap hash:/path/to/file", for example, to update a mailman-maintained table.

  This subcommand will not make any changes when default\_database\_type or default\_cache\_db\_type specify a hash: or btree: type.

- **enable-reindex**

  Edits main.cf and master.cf, to implement **enable-redirect**, and to automatically create a non-Berkeley-DB indexed database file when a daemon program wants to access a file that does not yet exist. This uses the [nbdb\_reindexd(8)](/nbdb_reindexd/8.md) daemon to run [postmap(1)](/postmap/1.md) or [postalias(1)](/postalias/1.md) as described in "SECURITY" below.

  This subcommand immediately generates non-Berkeley-DB indexed files for unprivileged command-line programs that cannot send requests to the [nbdb\_reindexd(8)](/nbdb_reindexd/8.md) daemon server. This involves "hash:" and "btree:" tables that are used by [postqueue(1)](/postqueue/1.md) and [sendmail(1)](/sendmail/1.md) as specified in authorized\_flush\_users and authorized\_mailq\_users, and by [sendmail(1)](/sendmail/1.md) and [postdrop(1)](/postdrop/1.md) as specified in authorized\_submit\_users and local\_login\_sender\_maps.

  This subcommand will not make any changes when default\_database\_type or default\_cache\_db\_type specify a hash: or btree: type.

  *NOTE:* **enable-reindex** *should be used only temporarily* *to generate most of the non-Berkeley-DB indexed files that Postfix* *needs. Leaving this enabled may expose the system to* *privilege-escalation attacks. There are no security* *concerns for using* **enable-redirect**.

## SECURITY

```

```

The [nbdb\_reindexd(8)](/nbdb_reindexd/8.md) daemon automatically generates a non-Berkeley-DB indexed file only if the database pathname matches the directory prefixes specified with non\_bdb\_migration\_allow\_root\_prefixes (for files that must be owned by root), or with non\_bdb\_migration\_allow\_user\_prefixes (for files that must be owned by a non-root user). Additional restrictions on file and directory ownership and permissions are documented in [nbdb\_reindexd(8)](/nbdb_reindexd/8.md).

## CONFIGURATION PARAMETERS

```

```

The "**postfix non-bdb** *subcommand*" feature updates the following configuration parameter:

- **non\_bdb\_migration\_level (disable)**

  The non-Berkeley-DB migration service level.

Other relevant parameters:

- **non\_bdb\_custom\_mapping (empty)**

  When non-Berkeley-DB migration is enabled, an optional mapping from a hash: or btree: type to a non-Berkeley-DB type.

- **non\_bdb\_migration\_allow\_root\_prefixes (see 'postconf -d non\_bdb\_migration\_allow\_root\_prefixes' output)**

  A list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service ([**nbdb\_reindexd**(8)](/nbdb_reindexd/8.md)) needs to run [**postmap**(1)](/postmap/1.md) or [**postalias**(1)](/postalias/1.md) commands with "root" privilege.

- **non\_bdb\_migration\_allow\_user\_prefixes (see 'postconf -d non\_bdb\_migration\_allow\_user\_prefixes' output)**

  A list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service ([**nbdb\_reindexd**(8)](/nbdb_reindexd/8.md)) needs to run [**postmap**(1)](/postmap/1.md) or [**postalias**(1)](/postalias/1.md) commands with non-root privilege.

## SEE ALSO

```
nbdb_reindexd(8) reindexing service
```

## README FILES

```

```

Use "**postconf readme\_directory**" or "**postconf html\_directory**" to locate this information.

```
NON_BERKELEYDB_README, migration guide
```

## LICENSE

```

```

The Secure Mailer license must be distributed with this software.

## HISTORY

The "**postfix non-bdb**" command was introduced with Postfix version 3.11.

## AUTHOR(S)

```
Wietse Venema
porcupine.org
```