EmailServer.EmailServer HistoryHide minor edits - Show changes to markup Thursday 23 April 2009, at 04:52 GMT+8
by -
Deleted lines 23-25:
Todo
Thursday 23 April 2009, at 04:51 GMT+8
by -
Changed line 17 from:
to:
Sunday 08 March 2009, at 04:11 GMT+8
by -
Deleted lines 4-5:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED Sunday 08 March 2009, at 04:11 GMT+8
by -
Deleted line 17:
Friday 23 January 2009, at 03:34 GMT+8
by -
Added line 16:
Deleted line 18:
Thursday 04 December 2008, at 03:51 GMT+8
by -
Changed lines 6-7 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for CentOS 5.2 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED This setup will work on most -if not all- linux distributions without major change and the instructions should work out-of-the-box on all recent RedHat derived systems: RedHat Linux, CentOS and Fedora. Changed line 46 from:
to:
Thursday 04 December 2008, at 03:42 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for CentOS 5.2 Wednesday 03 December 2008, at 09:49 GMT+8
by -
Changed line 6 from:
%bgcolor=#FF0000;color=#FFFFFF% AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:49 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
%bgcolor=#FF0000;color=#FFFFFF% AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:49 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:48 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:48 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:47 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:47 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:47 GMT+8
by - Wednesday 03 December 2008, at 09:47 GMT+8
by -
Changed line 6 from:
white%AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:43 GMT+8
by -
Changed line 6 from:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 to:
white%AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Wednesday 03 December 2008, at 09:42 GMT+8
by -
Changed lines 6-10 from:
The original article written for Fedora Core 4 is available as a single long page. The update for Fedora Core 5 is available as a single long page. All articles below have being updated for Fedora Core 10 to:
AS OF 03DEC2008, the articles below ARE IN THE PROCESS OF BEING UPDATED for Fedora Core 10 Added lines 39-42:
Older versions
Changed lines 44-49 from:
to:
Wednesday 03 December 2008, at 09:22 GMT+8
by -
Changed lines 7-8 from:
All articles below have being updated for Fedora Core 5 to:
The update for Fedora Core 5 is available as a single long page. All articles below have being updated for Fedora Core 10 Sunday 29 July 2007, at 01:18 GMT+8
by -
Changed line 42 from:
to:
Monday 02 October 2006, at 02:06 GMT+8
by -
Changed lines 8-9 from:
All articles below are being updated for Fedora Core 5, starting 19JUN2006. This will take a few days to:
All articles below have being updated for Fedora Core 5 Tuesday 20 June 2006, at 11:31 GMT+8
by -
Changed line 16 from:
to:
Tuesday 20 June 2006, at 10:58 GMT+8
by -
Changed lines 8-9 from:
to:
All articles below are being updated for Fedora Core 5, starting 19JUN2006. This will take a few days Tuesday 20 June 2006, at 10:05 GMT+8
by -
Added lines 6-9:
The original article written for Fedora Core 4 is available as a single long page.
Wednesday 24 May 2006, at 11:02 GMT+8
by -
Added line 1:
(:description This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on security, mail retention and accessibility though IMAP and webmail :) Tuesday 23 May 2006, at 15:06 GMT+8
by -
Changed lines 34-35 from:
to:
Tuesday 23 May 2006, at 15:06 GMT+8
by -
Changed line 37 from:
to:
Tuesday 23 May 2006, at 15:04 GMT+8
by -
Added lines 16-17:
Added line 37:
Wednesday 21 December 2005, at 13:07 GMT+8
by - Setting up a high-retention email server with all the bells and whistles.
Added lines 35-36:
Friday 02 December 2005, at 02:59 GMT+8
by -
Added line 12:
Added lines 35-36:
Changed line 38 from:
to:
Wednesday 31 August 2005, at 00:47 GMT+8
by -
Changed lines 31-32 from:
to:
Friday 22 July 2005, at 17:17 GMT+8
by -
Changed lines 17-18 from:
to:
Changed line 34 from:
to:
Friday 22 July 2005, at 10:38 GMT+8
by -
Deleted line 15:
Changed lines 17-18 from:
to:
Todo
Changed lines 30-34 from:
to:
Thursday 14 July 2005, at 07:05 GMT+8
by -
Changed lines 27-28 from:
to:
Thursday 14 July 2005, at 07:04 GMT+8
by -
Added lines 27-28:
Thursday 14 July 2005, at 05:52 GMT+8
by -
Added lines 21-26:
ResourcesYou will find relevant resources in each article above. The following resources are more wide-ranging and are excellent articles to use as references.
Wednesday 13 July 2005, at 03:37 GMT+8
by -
Changed lines 2-3 from:
ARTICLE WILL BE COMPLETED BY 12JULY2005 to:
Changed line 16 from:
to:
Sunday 10 July 2005, at 07:07 GMT+8
by -
Changed lines 4-5 from:
This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on secutiry, mail retention and accessibility though IMAP and webmail. to:
This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on security, mail retention and accessibility though IMAP and webmail. Sunday 10 July 2005, at 07:06 GMT+8
by -
Changed lines 4-5 from:
This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on mail retention and accessibility though IMAP. to:
This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on secutiry, mail retention and accessibility though IMAP and webmail. Sunday 10 July 2005, at 07:05 GMT+8
by -
Changed line 17 from:
to:
Sunday 10 July 2005, at 06:21 GMT+8
by -
Added line 17:
Added line 20:
Sunday 10 July 2005, at 06:12 GMT+8
by -
Changed lines 4-421 from:
Setting Up a high performance IMAP serverThe aim of this article is to describe how to configure a reliable and high performance email server for a 5-100 employees company. The constraint here is not to send/receive millions of messages a day but to allow users to keep their emails on the server and use IMAP to retrieve them from wherever they are, and for however long they want to keep them. This type of server is particularly suited for companies whose employees deal with a lot of emails, such as an Engineering, Project Management or a Law firm. ObjectivesThe main objectives are:
AssumptionsIn this document, the FQDN? (Fully Qualified Domain Name) of the server is also its hostname mail.example.com and its domain name is thus example.com. I assume that you have setup a MX DNS record for mail.example.com and that mail sent to joe@example.com will be attempted to be delivered to the server we're setting up. Note: if you need to setup your domain name and take control of your email, I suggest that you take an account with ZoneEdit: the first 5 zones are free, and extra services are quite cheap. You have total control over you domains, subdomains, and can of course create Mail eXchange records. They also have a service to buffer your email should your server be offline. when things return to normal, any email they kept will be delivered as usual. InstallationThe initial installation process is not critical here. Simply avoid installing too much stuff that you don't need (like X, Gnome or KDE and anything graphical) and limit the number of services that run on the server. It's easy enough to add missing packages afterwards. Buy your hard-drives in double or triple and mount your partitions as RAID1 or RAID5 arrays: this is quite critical as it means that you won't lose everything if one of the drives fails. I won't discuss backup solutions for this system, but you should have one. In the future, I plan to describe a mail to database solution that could be used as a specific mail backup/archiving/retrieval system. When deciding your disk partitions, allow a rather large one that you will mount as During the installation process, make sure that you choose After you've rebooted, use Check partition indexesBy default, Fedora Core 4 uses indexes when creating Why are indexes so important you ask? It doesn't hurt to double check that our partition supports indexes. Let's suppose that your (:source lang=Bash:)
tune2fs -l /dev/hda3 | grep features
(:sourcend:)
You should see a reference to UsersThere are plenty of different ways to authenticate users for mail access. Using LDAP, virtual users, MySQL databases, NIS, SMB or any other scheme is of course possible but in our case I wanted to keep things simple and allow this server to later become say a file server as well without too much hassle. Changing the authentication scheme can be necessary if you're managing virtual email accounts with lots of different domains (if you're and ISP for instance). Having said that, there are a few of drawbacks to using standard user accounts:
I will assume that all our users will not need to login onto the machine by default. If you need such users, you can still override these settings. Edit the
GROUP=100
HOME=/mail
INACTIVE=-1
EXPIRE=
SHELL=/bin/nologin
SKEL=/etc/skelmail
(:sourcend:)
Note: the normal way of doing this is to use Now create the skeleton directory: (:source lang=:)
(:sourcend:) Now, whenever we use the Note: It's very important that the email folder is not world-accessible: Postfix will otherwise refuse to write any email in it as it would be a security hazard. That's why we set it to Should you need to add normal login users accounts, you can override the default settings of
(:sourcend:) Will add the normal login user susan to the system. Switch to PostfixNow that your system is nice and clean, let's switch from the default To switch, do the following:
(:source lang=Bash:)
yum install postfix
yum install system-switch-mail
/usr/sbin/system-switch-mail
(:sourcend:)
The first 2 You will be presented with a choice on screen, go for Configuring Postfix
Let's first make a backup copy of these config files, just in case: (:source lang=Bash:) cp master.cf master.cf.ORIGINAL cp main.cf main.cf.ORIGINAL (:sourcend:) main.cf parametersNow, edit the (:source lang=Bash:) myorigin = $mydomain (:sourcend:) This says that mail sent from your server will take the form xxx@example.com. Note that by default, $myhostname and $mydomain are automatically derived from your machine's name. This name should be a Fully Qualified Domain Name (FQDM) like mail.example.com. (:source lang=Bash:) mydestination = $myhostname localhost.$mydomain localhost $mydomain (:sourcend:) Defines which domains you want to receive mail for. We should always allow the variations of localhost so the server can accept mail sent to itself, and $myhostname and $mydomain ensure that you will get mail sent to both mail.example.com and example.com. (:source lang=Bash:) mynetworks_style = subnet (:sourcend:) Allows people on the local network to be able to use the server to relay their emails. People from outside the subnet (outside of the IP addresses defined by your network's netmask, such as 255.255.255.0) will not be able to use the server to send email. This is safe, you never want unknown people from the Internet to be able to relay their mail through your server: it would only take a few minutes for your machine to become a spam hub. (:source lang=Bash:) relay_domains = $mydestination (:sourcend:) Authorises people from the outside to send email that is supposed to be for us. (:source lang=Bash:) notify_classes = resource, software (:sourcend:) Defines what sort of information should be sent to the postmaster when there is a problem. There are more options to that, but using too many could flood your mailbox. (:source lang=Bash:) relayhost = (:sourcend:) Confirms we're not using any external relays as we want the server to deliver our emails directly to other servers. If your ISP doesn't let you send emails by yourself (some block port 25), then you can put their own email server there [mail.isp.com] (including the brackets). Any mail you sent through your server will be given to your ISP's email server for delivery. Note that this is not very reliable as ISP have usually no guarantee that your email will be delivered to its destination: you're in effect sending your mail through a black hole. (:source lang=Bash:) proxy_interfaces = 1.2.3.4 (:sourcend:) Is only needed if your server is not directly connected to the Internet but is for instance behind a firewall that uses Port Forwarding to redirect traffic to it on a local subnet (for instance, your server address is 192.168.0.1 or another reserved LAN IP Class). In that case, you have to tell Postfix what is the outside address of the mail server (replace 1.2.3.4 by whatever is your real IP). Note though that if you don't have a fixed IP, this can be a bit annoying and you may be better off with connecting the server directly to the Internet and using iptables as a good internal firewall. (:source lang=Bash:) inet_interfaces = all (:sourcend:) Makes Postfix listen to all interfaces for email. (:source lang=Bash:) message_size_limit = 20971520 (:sourcend:) Limits the size of emails. Here we set it to 20MB which should be more than enough for most systems. It's a good idea to set a limit. I've have users trying to send 150MB emails to people who only had a dial-up connection (since delivery to the server from the local network is fast, people tend not to notice much the size of the emails they send). (:source lang=Bash:) masquerade_domains = $mydomain (:sourcend:) Ensures that mail from other hosts being sent through the server gets rewritten with our domain name correctly appended. this means that if elise@accounts.example.com sends an email through the server, it will be rewritten as elise@example.com. (:source lang=Bash:) mail_name = MyOwnPostOffice (:sourcend:) Optional and replaces the default name returned by Postfix. It's not a bad idea to replace the default string as it is par of the messages exchanged every time an email is being delivered. Potentially, it could allow someone to use that information to exploit a known security hole (the default string contains the full version number of Postfix). (:source lang=Bash:)
home_mailbox = email/
(:sourcend:)
If that directive is present, it will tell Postfix to deliver messages to the Note: you do not need to create the directories: Postfix will do that for you if they don't exist. SASL AuthenticationAs we've discussed before, ensuring that your server is locked down is vital if you don't want to become the next spam relay. SASL is a way of authenticating users when they are trying to send mail. It uses a variety of methods and it's fairly flexible, at the expense of being simple. To ensure proper SASL authentication, add the following to your (:source lang=Bash:) smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_invalid_hostname reject_unknown_sender_domain (:sourcend:)
The first line enables authentication for email being sent through the server from the outside (allowing roaming users to send email from the Internet). For security reasons, Postfix runs as an unprivileged user, meaning that it doesn't have access to your password files. Fortunately, this is already installed on Fedora and probably on most distributions as well. Just to be sure, do the following from the prompt: (:source:)
(:sourcend:) There is nothing else to do: the default configuration takes care of everything. Note: on other Linux systems, this file may be missing or may be located under AliasesThe minimum alias that must be set-up is for the postmaster who will receive errors and warnings issued by Postfix: Edit The administrator user must have been created and you should probably the one using that account regularly to check for issues. Note: after every modification of the alias file, you must run To add more aliases, just add them to accounts: boss marketing: boss sales: boss joe.doe boss joedoe boss (:sourcend:) Don't forget to run Dovecot for POP3 and IMAPDovecot is a good and flexible POP3 and IMAP mail server. It is very performing and can manage large amounts of emails. If you haven't got it on your system, you can build it from source or just use the ubiquitous yum: (:source lang=:)
(:sourcend:) First, we need to tell Dovecot where to fin our emails: as you remember, we told Postfix to use maildirs in the user directories instead of the default mbox. Edit the Restart Dovecot ( SSL for IMAP and POPTSL for securely sending mailAmavisd-NewDo the following from the command line (check the latest version number of Amavisd-New and replace it, this is just an example): (:source lang=:) cd /usr/local/src/ wget http://www.ijs.si/software/amavisd/amavisd-new-2.3.2.tar.gz tar xzvf amavisd-new-2.3.2.tar.gz cd amavisd-new-2.3.2 cp amavisd /usr/local/sbin/ cp amavisd.conf /etc/ (:sourcend:) SpamAssassinClamAV AntivirusSquirrelMail web interfaceSquirrelMail is the webmail interface that comes preloaded with Fedora. Make sure Apache is running By default, SquirrelMail is not accessible from https, and since our server will only be for mail, there is not need for appending the First get the original SquirrelMail Apache config file out of the way: (:source lang=:)
(:sourcend:) Then edit the ...
DocumentRoot "/usr/share/squirrelmail"
ServerName mail.example.com
<Directory /usr/share/squirrelmail>
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
</Directory>
...
</Virtualhost>
RewriteEngine on RewriteLog "/var/log/httpd/rewrite_log" RewriteLogLevel 0
RewriteCond %{HTTPS} off RewriteCond %{HTTP_HOST} ^(.*)$ [NC] RewriteRule (^.*$) https://%1 [L,R] (:sourcend:) Now restart Apache Note: https connections require a digital certificate registered with a known authority. The certificate is only valid for one website and one IP address and you need to pay for it. If you don;t have a certificate, your users will receive a warning when trying to access the site. You will have to tell them not to worry about that if you don't want or can't have a certificate (if you're using dynamic IP for instance). The certificate is only necessary to confirms that the site using is really who it pretends to be, it doesn't affect the fact that communications are encrypted. Configuring the firewallAppendix 1 - Specific issues encountered
Appendix 2 - TroubleshootingChecking SASL authentication(:noteblock:) Testing your Authentication Config (:notecontent:) The script in this section was lifted from the very complete book Postfix: the Definitive Guide from O'Reilly. (:noteblockend:) To ensure that your authentication process works fine, we'll check what the server reports when we try to feed it a correct login. Since logins are base64 encoded, copy and paste the following in a file that you call
use strict; use MIME::Base64; if ( $#ARGV != 1 ) { die "Usage: encode_sasl_plain.pl <username> <password>\n"; } print encode_base64("$ARGV[0]\0$ARGV[0]\0$ARGV[1]"); exit 0; (:sourcend:) Then use it to encode a username/password pair as it would be expected by the mail server for authentication. Here I use the existing administrator user (the account must exist on the system): (:source:)
YWRtaW5pc3RyYXRvcgBhZG1pbmlzdHJhdG9yADEyMzQ1Ng== (:sourcend:) Then, talk to your mail server manually: (:source linenum:)
Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 220 mail.example.com ESMTP MyOwnPostOffice EHLO test.faraway.com 250-mail.example.com 250-PIPELINING 250-SIZE 20971520 250-VRFY 250-ETRN 250-AUTH LOGIN DIGEST-MD5 PLAIN CRAM-MD5 250-AUTH=LOGIN DIGEST-MD5 PLAIN CRAM-MD5 250 8BITMIME AUTH PLAIN YWRtaW5pc3RyYXRvcgBhZG1pbmlzdHJhdG9yADEyMzQ1Ng== 235 Authentication successful quit 221 Bye Connection closed by foreign host. (:sourcend:) The only lines you will need to type are 6, 15, 17. The others are the server's responses. References
(:comments:) to:
This is a rather extensive article describing the configuration of a high performance Mail server for Small and Medium businesses, with a focus on mail retention and accessibility though IMAP. You can view the article as a single long page or as a series of smaller articles describing each steps to perform :
I hope you will find these helpfull. Let me know if they helped or if you have any comments: (:email etc@nkadesign.com:) or just leave your comments in the comment boxes at the bottom of each article. Sunday 10 July 2005, at 05:11 GMT+8
by -
Added lines 1-421:
![]() ARTICLE WILL BE COMPLETED BY 12JULY2005 Setting Up a high performance IMAP serverThe aim of this article is to describe how to configure a reliable and high performance email server for a 5-100 employees company. The constraint here is not to send/receive millions of messages a day but to allow users to keep their emails on the server and use IMAP to retrieve them from wherever they are, and for however long they want to keep them. This type of server is particularly suited for companies whose employees deal with a lot of emails, such as an Engineering, Project Management or a Law firm. ObjectivesThe main objectives are:
AssumptionsIn this document, the FQDN? (Fully Qualified Domain Name) of the server is also its hostname mail.example.com and its domain name is thus example.com. I assume that you have setup a MX DNS record for mail.example.com and that mail sent to joe@example.com will be attempted to be delivered to the server we're setting up. Note: if you need to setup your domain name and take control of your email, I suggest that you take an account with ZoneEdit: the first 5 zones are free, and extra services are quite cheap. You have total control over you domains, subdomains, and can of course create Mail eXchange records. They also have a service to buffer your email should your server be offline. when things return to normal, any email they kept will be delivered as usual. InstallationThe initial installation process is not critical here. Simply avoid installing too much stuff that you don't need (like X, Gnome or KDE and anything graphical) and limit the number of services that run on the server. It's easy enough to add missing packages afterwards. Buy your hard-drives in double or triple and mount your partitions as RAID1 or RAID5 arrays: this is quite critical as it means that you won't lose everything if one of the drives fails. I won't discuss backup solutions for this system, but you should have one. In the future, I plan to describe a mail to database solution that could be used as a specific mail backup/archiving/retrieval system. When deciding your disk partitions, allow a rather large one that you will mount as During the installation process, make sure that you choose After you've rebooted, use Check partition indexesBy default, Fedora Core 4 uses indexes when creating Why are indexes so important you ask? It doesn't hurt to double check that our partition supports indexes. Let's suppose that your (:source lang=Bash:)
tune2fs -l /dev/hda3 | grep features
(:sourcend:)
You should see a reference to UsersThere are plenty of different ways to authenticate users for mail access. Using LDAP, virtual users, MySQL databases, NIS, SMB or any other scheme is of course possible but in our case I wanted to keep things simple and allow this server to later become say a file server as well without too much hassle. Changing the authentication scheme can be necessary if you're managing virtual email accounts with lots of different domains (if you're and ISP for instance). Having said that, there are a few of drawbacks to using standard user accounts:
I will assume that all our users will not need to login onto the machine by default. If you need such users, you can still override these settings. Edit the
GROUP=100
HOME=/mail
INACTIVE=-1
EXPIRE=
SHELL=/bin/nologin
SKEL=/etc/skelmail
(:sourcend:)
Note: the normal way of doing this is to use Now create the skeleton directory: (:source lang=:)
(:sourcend:) Now, whenever we use the Note: It's very important that the email folder is not world-accessible: Postfix will otherwise refuse to write any email in it as it would be a security hazard. That's why we set it to Should you need to add normal login users accounts, you can override the default settings of
(:sourcend:) Will add the normal login user susan to the system. Switch to PostfixNow that your system is nice and clean, let's switch from the default To switch, do the following:
(:source lang=Bash:)
yum install postfix
yum install system-switch-mail
/usr/sbin/system-switch-mail
(:sourcend:)
The first 2 You will be presented with a choice on screen, go for Configuring Postfix
Let's first make a backup copy of these config files, just in case: (:source lang=Bash:) cp master.cf master.cf.ORIGINAL cp main.cf main.cf.ORIGINAL (:sourcend:) main.cf parametersNow, edit the (:source lang=Bash:) myorigin = $mydomain (:sourcend:) This says that mail sent from your server will take the form xxx@example.com. Note that by default, $myhostname and $mydomain are automatically derived from your machine's name. This name should be a Fully Qualified Domain Name (FQDM) like mail.example.com. (:source lang=Bash:) mydestination = $myhostname localhost.$mydomain localhost $mydomain (:sourcend:) Defines which domains you want to receive mail for. We should always allow the variations of localhost so the server can accept mail sent to itself, and $myhostname and $mydomain ensure that you will get mail sent to both mail.example.com and example.com. (:source lang=Bash:) mynetworks_style = subnet (:sourcend:) Allows people on the local network to be able to use the server to relay their emails. People from outside the subnet (outside of the IP addresses defined by your network's netmask, such as 255.255.255.0) will not be able to use the server to send email. This is safe, you never want unknown people from the Internet to be able to relay their mail through your server: it would only take a few minutes for your machine to become a spam hub. (:source lang=Bash:) relay_domains = $mydestination (:sourcend:) Authorises people from the outside to send email that is supposed to be for us. (:source lang=Bash:) notify_classes = resource, software (:sourcend:) Defines what sort of information should be sent to the postmaster when there is a problem. There are more options to that, but using too many could flood your mailbox. (:source lang=Bash:) relayhost = (:sourcend:) Confirms we're not using any external relays as we want the server to deliver our emails directly to other servers. If your ISP doesn't let you send emails by yourself (some block port 25), then you can put their own email server there [mail.isp.com] (including the brackets). Any mail you sent through your server will be given to your ISP's email server for delivery. Note that this is not very reliable as ISP have usually no guarantee that your email will be delivered to its destination: you're in effect sending your mail through a black hole. (:source lang=Bash:) proxy_interfaces = 1.2.3.4 (:sourcend:) Is only needed if your server is not directly connected to the Internet but is for instance behind a firewall that uses Port Forwarding to redirect traffic to it on a local subnet (for instance, your server address is 192.168.0.1 or another reserved LAN IP Class). In that case, you have to tell Postfix what is the outside address of the mail server (replace 1.2.3.4 by whatever is your real IP). Note though that if you don't have a fixed IP, this can be a bit annoying and you may be better off with connecting the server directly to the Internet and using iptables as a good internal firewall. (:source lang=Bash:) inet_interfaces = all (:sourcend:) Makes Postfix listen to all interfaces for email. (:source lang=Bash:) message_size_limit = 20971520 (:sourcend:) Limits the size of emails. Here we set it to 20MB which should be more than enough for most systems. It's a good idea to set a limit. I've have users trying to send 150MB emails to people who only had a dial-up connection (since delivery to the server from the local network is fast, people tend not to notice much the size of the emails they send). (:source lang=Bash:) masquerade_domains = $mydomain (:sourcend:) Ensures that mail from other hosts being sent through the server gets rewritten with our domain name correctly appended. this means that if elise@accounts.example.com sends an email through the server, it will be rewritten as elise@example.com. (:source lang=Bash:) mail_name = MyOwnPostOffice (:sourcend:) Optional and replaces the default name returned by Postfix. It's not a bad idea to replace the default string as it is par of the messages exchanged every time an email is being delivered. Potentially, it could allow someone to use that information to exploit a known security hole (the default string contains the full version number of Postfix). (:source lang=Bash:)
home_mailbox = email/
(:sourcend:)
If that directive is present, it will tell Postfix to deliver messages to the Note: you do not need to create the directories: Postfix will do that for you if they don't exist. SASL AuthenticationAs we've discussed before, ensuring that your server is locked down is vital if you don't want to become the next spam relay. SASL is a way of authenticating users when they are trying to send mail. It uses a variety of methods and it's fairly flexible, at the expense of being simple. To ensure proper SASL authentication, add the following to your (:source lang=Bash:) smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_invalid_hostname reject_unknown_sender_domain (:sourcend:)
The first line enables authentication for email being sent through the server from the outside (allowing roaming users to send email from the Internet). For security reasons, Postfix runs as an unprivileged user, meaning that it doesn't have access to your password files. Fortunately, this is already installed on Fedora and probably on most distributions as well. Just to be sure, do the following from the prompt: (:source:)
(:sourcend:) There is nothing else to do: the default configuration takes care of everything. Note: on other Linux systems, this file may be missing or may be located under AliasesThe minimum alias that must be set-up is for the postmaster who will receive errors and warnings issued by Postfix: Edit The administrator user must have been created and you should probably the one using that account regularly to check for issues. Note: after every modification of the alias file, you must run To add more aliases, just add them to accounts: boss marketing: boss sales: boss joe.doe boss joedoe boss (:sourcend:) Don't forget to run Dovecot for POP3 and IMAPDovecot is a good and flexible POP3 and IMAP mail server. It is very performing and can manage large amounts of emails. If you haven't got it on your system, you can build it from source or just use the ubiquitous yum: (:source lang=:)
(:sourcend:) First, we need to tell Dovecot where to fin our emails: as you remember, we told Postfix to use maildirs in the user directories instead of the default mbox. Edit the Restart Dovecot ( SSL for IMAP and POPTSL for securely sending mailAmavisd-NewDo the following from the command line (check the latest version number of Amavisd-New and replace it, this is just an example): (:source lang=:) cd /usr/local/src/ wget http://www.ijs.si/software/amavisd/amavisd-new-2.3.2.tar.gz tar xzvf amavisd-new-2.3.2.tar.gz cd amavisd-new-2.3.2 cp amavisd /usr/local/sbin/ cp amavisd.conf /etc/ (:sourcend:) SpamAssassinClamAV AntivirusSquirrelMail web interfaceSquirrelMail is the webmail interface that comes preloaded with Fedora. Make sure Apache is running By default, SquirrelMail is not accessible from https, and since our server will only be for mail, there is not need for appending the First get the original SquirrelMail Apache config file out of the way: (:source lang=:)
(:sourcend:) Then edit the ...
DocumentRoot "/usr/share/squirrelmail"
ServerName mail.example.com
<Directory /usr/share/squirrelmail>
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
</Directory>
...
</Virtualhost>
RewriteEngine on RewriteLog "/var/log/httpd/rewrite_log" RewriteLogLevel 0
RewriteCond %{HTTPS} off RewriteCond %{HTTP_HOST} ^(.*)$ [NC] RewriteRule (^.*$) https://%1 [L,R] (:sourcend:) Now restart Apache Note: https connections require a digital certificate registered with a known authority. The certificate is only valid for one website and one IP address and you need to pay for it. If you don;t have a certificate, your users will receive a warning when trying to access the site. You will have to tell them not to worry about that if you don't want or can't have a certificate (if you're using dynamic IP for instance). The certificate is only necessary to confirms that the site using is really who it pretends to be, it doesn't affect the fact that communications are encrypted. Configuring the firewallAppendix 1 - Specific issues encountered
Appendix 2 - TroubleshootingChecking SASL authentication(:noteblock:) Testing your Authentication Config (:notecontent:) The script in this section was lifted from the very complete book Postfix: the Definitive Guide from O'Reilly. (:noteblockend:) To ensure that your authentication process works fine, we'll check what the server reports when we try to feed it a correct login. Since logins are base64 encoded, copy and paste the following in a file that you call
use strict; use MIME::Base64; if ( $#ARGV != 1 ) { die "Usage: encode_sasl_plain.pl <username> <password>\n"; } print encode_base64("$ARGV[0]\0$ARGV[0]\0$ARGV[1]"); exit 0; (:sourcend:) Then use it to encode a username/password pair as it would be expected by the mail server for authentication. Here I use the existing administrator user (the account must exist on the system): (:source:)
YWRtaW5pc3RyYXRvcgBhZG1pbmlzdHJhdG9yADEyMzQ1Ng== (:sourcend:) Then, talk to your mail server manually: (:source linenum:)
Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 220 mail.example.com ESMTP MyOwnPostOffice EHLO test.faraway.com 250-mail.example.com 250-PIPELINING 250-SIZE 20971520 250-VRFY 250-ETRN 250-AUTH LOGIN DIGEST-MD5 PLAIN CRAM-MD5 250-AUTH=LOGIN DIGEST-MD5 PLAIN CRAM-MD5 250 8BITMIME AUTH PLAIN YWRtaW5pc3RyYXRvcgBhZG1pbmlzdHJhdG9yADEyMzQ1Ng== 235 Authentication successful quit 221 Bye Connection closed by foreign host. (:sourcend:) The only lines you will need to type are 6, 15, 17. The others are the server's responses. References
(:comments:) |