FreeRADIUS VS Dovecot

FreeRADIUS WiFi authentication server

It needs to be supported at your edge switching. Most vendors support it. You usually just need some kind of RADIUS server. FreeRADIUS is one of the better options.

You can link it back to your Windows AD account with Windows NPS, or you can use some free Radius or TACACS software package like FreeRadius, https://freeradius.org/

In WorkSpaces, the only way to enable MFA is through a Radius server integrated either with an on-premises AD or an AWS Managed AD. This approach will allow you to use authentication apps like Google Authenticator to first authenticate the username and password against your Active Directory and the Radius Server will be responsible to authenticate the One-Time Password (OTP) generated by Google Authenticator. One of the open-source Radius software that can be used is FreeRadius.

I wonder why your sys admins didn't try FreeRADIUS. It ships with detailed config examples also for using LDAP for authentication.

You can setup an freeradius server(or 2) to handle the authentication requests (https://freeradius.org/)

The last I knew, the client server(s) were running Apache HTTPD on Fedora 35. We use a RADIUS server for centralized authentication for the web-based applications on those servers. I believe it is using FreeRADIUS but that is a complete guess.

Mail server using Postfix, Dovecot, and Rspamd

Eventually I will set up Dovecot as a local IMAP server, pointing to that Maildir. When I've done this before, I've set up a self-signed certificate so Apple Mail wouldn't complain.

You might want to use dovecot for this if I understandyou correctly

If you really want to try it (and keep it up to date for security fixes, check and handle any relay issues or possible spam attackers) then look at Dovecot or Kerio

An IMAP server. I have a strong preference for dovecot for this.

I'd do it with a local IMAP server in conjunction with a webmail client that connects to it. Dovecot is a fantastic and easy to use IMAP server. Webmail clients are a pretty personal thing, but the last time I used Roundcube it seemed pretty good.

For the record, I'm using dovecot (https://www.dovecot.org/) for IMAP and Haraka (https://haraka.github.io/) for SMTP.

self hosting mail is always a pain and can take up a lot of support time and you really need to know your stuff. I always use Plesk witch configures Dovecot. But if there is anyway you can push them to use an external service you should do that.

I run a mail server on DigitalOcean for a few domains using a fairly standard FreeBSD setup running dovecot and postfix. If you're set up your preferred stack on another hosting provider before, you're aware of all the pitfalls: