{"id":17,"date":"2010-09-03T10:42:50","date_gmt":"2010-09-02T22:42:50","guid":{"rendered":"http:\/\/www.templesoft.co.nz\/blog\/?p=17"},"modified":"2026-04-08T08:19:32","modified_gmt":"2026-04-07T20:19:32","slug":"17","status":"publish","type":"post","link":"https:\/\/templesoft.co.nz\/journal\/?p=17","title":{"rendered":"Setting up a mail server using Postfix on Ubuntu 10.04"},"content":{"rendered":"<h2 id=\"introduction\">Introduction.<\/h2>\n<h3 style=\"text-align: justify;\">Background.<\/h3>\n<p style=\"text-align: justify;\">I had already build a VoIP system using CentOS (another Unix-like OS) as a base with trixbox CE providing the VoIP telephony. It was a fun project and for all the same reasons I wanted to do something similar for our messaging. I naturally (or some may argue un-naturally) started thinking about Microsoft Exchange, but was put off by the cost and all the additional features that I might not use! Then I remembered reading something about Postfix and thought &#8220;I can setup a VoIP system, surely it can&#8217;t be too hard to setup a mail server on a <em>*nix<\/em> box?&#8221; It also seemed like I nice way to create a rounded &#8220;communication&#8221; solution for our organisation encompassing telephony and email (my thoughts immediately turned to shared calendaring too).<\/p>\n<p style=\"text-align: justify;\">With the availability of devices like the iPhone and iPad (yes, I&#8217;m a fan-boy!), it meant that I could create a mail platform that could be accessed &#8220;anywhere&#8221;, &#8220;anytime&#8221; on &#8220;any device&#8221; (and by any device read: iPad or iPhone ?). This was a plus for management, who wouldn&#8217;t need to be restricted to carrying around a laptop and 3G modem in order to access emails!<\/p>\n<p style=\"text-align: justify;\">So I started searching on the internet for a cookbook that would outline the steps and one of the first I came across (and ultimately stayed with) was Ivar Abrahamsen&#8217;s step-by-step guide at flurdy.com. It&#8217;s a fantastic guide that outlines things very clearly with details on &#8220;how&#8221; and &#8220;why&#8221; each step is taken.<\/p>\n<p style=\"text-align: justify;\">This HOWTO is effectively a duplicate (and to some degree a subset) of flurdy&#8217;s guide, with some of my own changes\/omissions based on my own situation and experiences during the install. It was also to some degree intended for my own reference in case I needed to recover my server one day. All credit goes to Ivar Abrahamsen without whom I&#8217;d never have got my server off the ground. I didn&#8217;t plan on using my server in the cloud so I removed the references to ec2.<\/p>\n<p style=\"text-align: justify;\">So why would you build your own mail server? There are a number of advantages to having your own mail server, and a cursory check of the MX records of a number of organisations I deal with revealed that almost everyone was doing it! Reason 1: I didn&#8217;t want to be left out!! More selfishly, it was a way to gain total control over the server, and with my &#8220;portable mail&#8221; plan relying on IMAP it meant I couldn&#8217;t have an ISP reigning me back on disk space!!<\/p>\n<p style=\"text-align: justify;\">I did have concerns about being a target for spammers and hackers, so it was a relief to see the sections in flurdy&#8217;s guide that dealt with spam and antivirus as well as the encryption of the traffic &#8211; another plus if the aforementioned management decided to access their mail, using webmail from a internet caf\u00e9 while on holiday!<\/p>\n<h3 style=\"text-align: justify;\">Base OS Distribution<\/h3>\n<p style=\"text-align: justify;\">This HOWTO is based on Ubuntu Server 10.04 LTS (Lucid Lynx) 64-bit and its Debian base which uses apt-get (aptitude) to download and install its packages.<\/p>\n<p style=\"text-align: justify;\">Why 10.04 and what is LTS? Lucid Lynx (10.04) is an LTS (<em>Long Term Support<\/em>) release. It (the server version) will be supported with security updates until April 2015. The long life cycle will hopefully mean a more stable platform, enhanced support and more time before we have to consider upgrading.<\/p>\n<p>Hardware configuration<\/p>\n<p style=\"text-align: justify;\">You know what they say about assumptions&#8230; Unfortunately I didn&#8217;t do enough research when picking my server hardware, and just went for the highest spec machine I could afford. Little did I know there would be issues around driver support for the RAID controller and GRUB&#8217;s inability to recognise GPT partitions for disks larger than 2TB! There are workarounds, but I had other options&#8230;<\/p>\n<p style=\"text-align: justify;\">Here&#8217;s the specifications of the server I used for this exercise:<\/p>\n<ul>\n<li>HP Proliant ML110 G6 with Intel G6950 (Dual-Core 2.8Ghz processor)<\/li>\n<li>4GB of RAM<\/li>\n<li>2 x 250GB SATA drives<\/li>\n<li>2 x 2TB SATA drives<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Never one to let road block get in the way of accomplishing a goal, I did the following steps in order to prepare the server for (and install) the OS:<\/p>\n<ol>\n<li>First I disabled the onboard RAID and configured the four drives as individuals making sure the 250GB drives were first in the SATA chain.<\/li>\n<li>Next, I followed the advanced Ubuntu setup here to configure software RAID using &#8220;mdadm&#8221;. There&#8217;s quite a good &#8220;cheat-sheet&#8221; here if you&#8217;re interested, otherwise a handy command is:\n<pre style=\"text-align: justify;\">sudo cat \/proc\/mdstat<\/pre>\n<p>to see the various components of the array and<\/p>\n<pre style=\"text-align: justify;\">sudo mdadm --detail \/dev\/md<span style=\"color: #3366ff;\"><strong><em>x<\/em><\/strong><\/span><\/pre>\n<p>where <span style=\"color: #3366ff;\"><strong><em>x<\/em><\/strong><\/span> is 0,1,2&#8230;<\/li>\n<li>When selecting the mount point for the array utilising the partitions on the 250GB drives I selected &#8220;\/&#8221; and &#8220;\/swap&#8221;.<\/li>\n<li>When selecting the mount point for the array utilising the partitions on the 2TG drives I selected &#8220;\/var&#8221; as this is the root for the location of the mail directory storage.<\/li>\n<li>Installation was basically a &#8220;follow the prompts&#8221; procedure, other than the steps taken when partitioning the drives. I interrupted the network detection to define a fixed IP address, and when prompted didn&#8217;t install any additional software.<\/li>\n<li>First boot after install was clean and good! No problems, with a little processing overhead as the RAID sync&#8217;d.<\/li>\n<\/ol>\n<h3 style=\"text-align: justify;\">Software components<\/h3>\n<h4 style=\"text-align: justify;\"><strong>OS: Ubuntu Linux<\/strong><\/h4>\n<p style=\"text-align: justify;\">Ah the age old distro argument&#8230; Why Ubuntu? It&#8217;s free, simple and slick with solid package management. As Ubuntu is derived from Debian the installations used here will be apt-get based..<\/p>\n<h4 style=\"text-align: justify;\"><strong>MTA: Postfix<\/strong><\/h4>\n<p style=\"text-align: justify;\">Simple, free, proven and slick. I agree with flurdy on this one &#8211; I&#8217;m a sucker for anything that works easily and like it was designed to. Postfix is all that! It&#8217;s powerful, well established, but not too bloated, and is security conscious from the start.<\/p>\n<h4 style=\"text-align: justify;\"><strong>POP\/IMAP: Courier IMAP<\/strong><\/h4>\n<p style=\"text-align: justify;\">Simple, free and support for IMAPv4.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Database: MySQL<\/strong><\/h4>\n<p style=\"text-align: justify;\">I haven&#8217;t had much exposure to database software other than the development I&#8217;ve done using MS SQL 2008 Express. MySQL, however, is well supported for the sort of lookups required in a mail server environment and these packages support it &#8220;out-of-the-box&#8221;.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Content Check: Amavisd-new<\/strong><\/h4>\n<p style=\"text-align: justify;\">Easy plug-in content interface solution for spam, virus checking etc.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Anti-SPAM: SpamAssassin &amp; Postgrey<\/strong><\/h4>\n<ul>\n<li style=\"text-align: justify;\">SpamAssassin &#8211; A powerful and renowned SPAM fighting tool.<\/li>\n<li style=\"text-align: justify;\">Postgrey &#8211; an excellent little script to stop 99% of all SPAM. On first contact for specific &#8220;from-to&#8221; combinations, it tells the sender server to try again in a little while, which (of course) most spammers can&#8217;t afford to do. When the proper servers try again after a few minutes delay, it lets the mail through.<\/li>\n<\/ul>\n<h4 style=\"text-align: justify;\"><strong>Anti-Virus: ClamAV<\/strong><\/h4>\n<p style=\"text-align: justify;\">A <span style=\"color: #339966;\"><strong>FREE<\/strong> <\/span>virus scanner this is trusted and proven, which includes an update daemon.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Authentication: Cyrus SASL<\/strong><\/h4>\n<p style=\"text-align: justify;\">Secure and trusted cryptography technology for authentication of SMTP traffic.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Encryption: TLS<\/strong><\/h4>\n<p style=\"text-align: justify;\">Secure and trusted cryptography technology for encryption of SMTP traffic. Not to be confused with client encryption technology like GnuPG and S\/MIME. Formerly referenced as SSL.<\/p>\n<h4 style=\"text-align: justify;\"><strong>Webmail: Roundcube<\/strong><\/h4>\n<p style=\"text-align: justify;\">For me interface is everything. It&#8217;s all about the &#8220;look-and-feel&#8221; baby! Roundcube is an &#8220;ajaxified&#8221; and prettier webmail client than SquirrelMail but not quite as solid&#8230; yet!<\/p>\n<h2 id=\"software-configuration\">Software configuration<\/h2>\n<h3 style=\"text-align: justify;\">Repositories<\/h3>\n<p style=\"text-align: justify;\">For this install you need the <strong>main<\/strong> and <strong>universe<\/strong> repositories, but I also throw in the other &#8220;safe&#8221; ones: <strong>restricted<\/strong> and <strong>multiverse<\/strong> (and <strong>partner<\/strong>, when available) if they are not already defined.<\/p>\n<pre style=\"text-align: justify;\"> sudo vi \/etc\/apt\/sources.list<\/pre>\n<h3 style=\"text-align: justify;\">Packages<\/h3>\n<p style=\"text-align: justify;\">There are a number of packages that constitute this installation. We will install and configure them individually, but before starting first check your package sources are correctly pointing to the <strong>main<\/strong>, <strong>multiverse<\/strong>, <strong>restricted<\/strong> and <strong>universe<\/strong> repositories of your current Ubuntu version as detailed above.<\/p>\n<p style=\"text-align: justify;\">Once complete, install any updates for the base install.<\/p>\n<pre>sudo aptitude update\r\nsudo aptitude safe-upgrade<\/pre>\n<h4 style=\"text-align: justify;\">MySQL<\/h4>\n<p style=\"text-align: justify;\">The first core component to install is MySQL.<\/p>\n<pre>sudo aptitude install mysql-client mysql-server<\/pre>\n<p style=\"text-align: justify;\">This will prompt you for a MySQL <strong>root<\/strong> password. Choose something secure and easy to remember (Current recommendations are for 12 alpha-numeric characters using case mixes). In this example we\u2019ll set it to <span style=\"color: #ff0000;\"><em>rootPASSWORD<\/em><\/span>.<\/p>\n<h4 style=\"text-align: justify;\">Postfix<\/h4>\n<p style=\"text-align: justify;\">Next install Postfix, assuming it wasn&#8217;t selected at the end of the Ubuntu install and similar steps taken to configure it.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install postfix postfix-mysql<\/pre>\n<p style=\"text-align: justify;\">During the install it will prompt you to choose the \u201c<em>type<\/em>\u201d of email server. Select \u201c<strong>internet site<\/strong>\u201d as it is assumed this install will connect to the internet to send and receive email. The install will also suggest\/request a server name. Alter as required using your FQDN or DynDNS equivalent.<\/p>\n<h4 style=\"text-align: justify;\">openSSH Server<\/h4>\n<p style=\"text-align: justify;\">Because it\u2019s easier to cut-and-paste using SSH telnet on your own PC, than keying it all in on the server console.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install openssh-server<\/pre>\n<h4 style=\"text-align: justify;\">SASL<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install libsasl2-modules libsasl2-modules-sql libgsasl7 libauthen-sasl-cyrus-perl sasl2-bin libpam-mysql<\/pre>\n<h4 style=\"text-align: justify;\">ClamAV<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install clamav-base libclamav6 clamav-daemon clamav-freshclam<\/pre>\n<h4 style=\"text-align: justify;\">Amavis, SpamAssassin, postgrey<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install amavisd-new\r\nsudo aptitude install spamassassin spamc\r\nsudo aptitude install postgrey<\/pre>\n<h4 style=\"text-align: justify;\">Roundcube<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install roundcube roundcube-mysql php-pear php5-cli<\/pre>\n<h4 style=\"text-align: justify;\">phpMyAdmin<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install phpmyadmin<\/pre>\n<p style=\"text-align: justify;\">Select \u201c<strong>Yes<\/strong>\u201d to set it up and enter the root MySQL password defined above. Create a phpmyadmin MySQL user password, and repeat to confirm. When asked, accept \u201capache2\u201d as the web server.<\/p>\n<h4 style=\"text-align: justify;\">ShoreWall<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install shorewall-common shorewall-perl<\/pre>\n<h4 style=\"text-align: justify;\">Courier<\/h4>\n<pre style=\"text-align: justify;\">sudo aptitude install courier-base courier-authdaemon courier-authlib-mysql courier-imap courier-imap-ssl courier-ssl<\/pre>\n<p style=\"text-align: justify;\">The install will prompt you about web directories. You can say \u201c<strong>No<\/strong>\u201d to this. It will also warn you about the certificate location. Ignore this.<\/p>\n<h4 style=\"text-align: justify;\">Extras<\/h4>\n<p style=\"text-align: justify;\">I also install a few other packages to add functionality but have nothing to do with the mail server setup.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install vim mutt lynx<\/pre>\n<ul>\n<li>vim \u2013 although I use Vi for editing files, VIM comes with more features if required.<\/li>\n<li>mutt \u2013 a simple email client with support for MIME, IMAP, POP3, message threading etc&#8230;<\/li>\n<li>lynx \u2013 is a text-based web browser for use on cursor-addressable character cell terminals and is very configurable (Yeah, I don&#8217;t know why either&#8230;)<\/li>\n<\/ul>\n<h3 style=\"text-align: justify;\">Package status<\/h3>\n<p style=\"text-align: justify;\">At any stage to find out which packages you may have installed, you can use the following commands (substituting \u201cpostfix\u201d with the package you\u2019re checking):<\/p>\n<pre style=\"text-align: justify;\">sudo dpkg --list | grep postfix sudo aptitude search postfix<\/pre>\n<h2 id=\"simple-mail-server\">Stage One: A simple mail server<\/h2>\n<p style=\"text-align: justify;\">Now let\u2019s configure a simple mail server using some of the packages installed previously. This HOWTO makes the assumption that you&#8217;re either NOT logged on as the root or root isn&#8217;t (or hasn&#8217;t) been enabled &#8211; hence the use of the &#8220;sudo&#8221; command.<\/p>\n<h3 style=\"text-align: justify;\">Firewall<\/h3>\n<h4 style=\"text-align: justify;\">Shorewall<\/h4>\n<p style=\"text-align: justify;\">UFW is bundled with the 10.04 Ubuntu distribution, but I still prefer <strong>Shorewall<\/strong> for servers I setup. Basically at first you want to only allow <strong>SSH<\/strong>. Then <strong>SMTP<\/strong> &amp; <strong>IMAP<\/strong> from your IP only. When you are confident that the mail server is secure, you can open <strong>SMTP<\/strong> and <strong>IMAP<\/strong> to the world.<\/p>\n<p style=\"text-align: justify;\">Later on in the install you may wish to open web access to the webmail and admin GUI. Once again, this can be restricted to specific IPs.<\/p>\n<h5 style=\"text-align: justify;\">SSH only<\/h5>\n<p style=\"text-align: justify;\">By default Shorewall in Ubuntu has an empty set up. You can find the default values for Shorewall in <em>\/usr\/share\/doc\/shorwall\/default-config<\/em>, and examples of configurations in <em>\/usr\/share\/doc\/shorwall\/examples<\/em>. To start, we will create the basic set up.<\/p>\n<p style=\"text-align: justify;\">First configure which network adapters are accessing the net.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/interfaces \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/interfaces net eth0 detect dhcp,tcpflags,logmartians,nosmurfs<\/pre>\n<p style=\"text-align: justify;\">Then we will configure network zones<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/zones \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/zones<\/pre>\n<p style=\"text-align: justify;\">Add the firewall if not there and the internet as a zone.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">fw firewall\r\n<span style=\"color: #c0c0c0;\"># loc ipv4<\/span>\r\nnet ipv4<\/span><\/pre>\n<p style=\"text-align: justify;\">Then (if needed) specify hosts in the Shorewall hosts file. i.e. If you want to specify what your home IP is etc.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/hosts \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/hosts # loc eth0:192.168.0.0\/24<\/pre>\n<p style=\"text-align: justify;\">Then set what the default policy is for firewall access.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/policy \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/policy $FW net ACCEPT\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">net $FW DROP info<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">net all DROP info<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># The FOLLOWING POLICY MUST BE LAST<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">all all REJECT info<\/span><\/pre>\n<p style=\"text-align: justify;\">For safety in case it goes down.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/routestopped \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/routestopped\r\n<span style=\"color: #339966; padding-left: 30px;\">eth0 0.0.0.0 routeback<\/span><\/pre>\n<p style=\"text-align: justify;\">For higher security you can use the netmask of your IP range if you\u2019re more concerned.<\/p>\n<p style=\"text-align: justify;\">The next step is to define the main firewall rules. You can find predetermined macro rules for Shorewall in the <em>\/usr\/share\/shorewall<\/em> directory.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/usr\/share\/doc\/shorewall\/default-config\/rules \/etc\/shorewall\/\r\nsudo vi \/etc\/shorewall\/rules\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">SSH\/ACCEPT net $FW<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Open for business?<\/h5>\n<p style=\"text-align: justify;\">Once your server is working properly, come back to this step and open up the required protocols to the net.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/shorewall\/rules\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">Ping\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># Permit all ICMP traffic FROM the firewall TO the net zone.<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">ACCEPT $FW net icmp<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># Add these for mail services.<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">SMTP\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">SMTPS\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">Submission\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">IMAP\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">IMAPS\/ACCEPT net $FW<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># Access for web clients.<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">Web\/ACCEPT net $FW<\/span><\/pre>\n<p style=\"text-align: justify;\">Firewall configuring is always a risky business and it is easy to lock yourself out. To test the syntax of your configuration run<\/p>\n<pre style=\"text-align: justify;\">sudo shorewall check<\/pre>\n<p style=\"text-align: justify;\">Then to switch it on during boot<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/default\/shorewall\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">startup=1<\/span><\/pre>\n<p style=\"text-align: justify;\">Restart it with<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/shorewall restart<\/pre>\n<p style=\"text-align: justify;\">For more details on IP Tables and Shorewall, reference the author\u2019s <a title=\"Link to authors website\" href=\"http:\/\/www.shorewall.net\/\" target=\"_blank\">website<\/a>.<\/p>\n<h3 style=\"text-align: justify;\">MTA &#8211; Mail Transfer Agent<\/h3>\n<h4 style=\"text-align: justify;\">Postfix<\/h4>\n<p style=\"text-align: justify;\">You should put the name of your server in this file&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/mailname<\/pre>\n<p style=\"text-align: justify;\">It could be something like <em><strong>smtp.domain.name<\/strong><\/em>, where <em>domain.name<\/em> is replaced with your own domain name.<\/p>\n<p style=\"text-align: justify;\">Now open the main postfix configuration file:<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/main.cf<\/pre>\n<p style=\"text-align: justify;\">Debian and Ubuntu by default include some sensible values in this file. You may need to comment some of them out if we duplicate with the commands below.<\/p>\n<p style=\"text-align: justify;\">First specify the name of your server.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># This is already done in \/etc\/mailname\r\n# myhostname= mail.example.com<\/span><\/pre>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong>NOTE:<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">After running my Postfix installation for a month or two I noticed in the message headers that the originating mail server was not what was defined in \/etc\/mailname but the local hostname &#8211; this was also confirmed by running <em><strong>postconf | grep myhostname<\/strong><\/em>. So&#8230; In my install I added the following entries in the <strong>main.cf<\/strong> file to accomodate.<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">myhostname = <strong>mail.example.com<\/strong><\/span>\r\n<span style=\"color: #339966;\">mydomain = <strong>example.com<\/strong><\/span><\/pre>\n<\/blockquote>\n<p style=\"text-align: justify;\">Next is the origin, which is the domain appended to each email sent from this machine. This can be your full servername, or just the DN.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><span style=\"color: #c0c0c0;\"># myorigin=\/etc\/mailname<\/span>\r\nmyorigin=<strong>example.com<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">Next, decide what the greeting text will be when Postfix is queried. Provide enough info so it is useful, but not enough to divulge everything to potential hackers!<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">smtpd_banner = $myhostname ESMTP $mail_name<\/span><\/pre>\n<p style=\"text-align: justify;\">&#8230;or hardcode the server name to avoid a banner\/hostname mismatch.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">smtpd_banner = <strong>smtp.example.com<\/strong> ESMTP $mail_name<\/span><\/pre>\n<p style=\"text-align: justify;\">Next you need to decide whether to send all outgoing mail via another SMTP server, or send it yourself. I send via my ISP&#8217;s server so they have to worry about the queuing etc. If you send it yourself, then you are NOT reliant on a 3rd party&#8217;s server, BUT you may risk more exposure, being accidentally blocked by &#8220;spam blockers&#8221; and providing more work for your own server.<\/p>\n<p style=\"text-align: justify;\">It&#8217;s also worth mentioning that many servers block dynamic DNS hosts (DynDNS etc), so you may find your server&#8217;s mail gets rejected. Weight up the pros and cons and choose a method that you are most comfortable with.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># leave blank to do it yourself.<\/span>\r\n<span style=\"color: #339966;\">relayhost =<\/span>\r\n\r\n<span style=\"color: #c0c0c0;\"># or put it an accessible smtp server.<\/span>\r\n<span style=\"color: #339966;\">relayhost = <strong>smtp.yourisp.com<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">Next are network details. We will define accepting connections from anywhere, and that we only trust this machine<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">inet_interfaces = all<\/span>\r\n<span style=\"color: #339966;\">mynetworks_style = host<\/span><\/pre>\n<p style=\"text-align: justify;\">Next you can masquerade some outgoing addresses. Say your machine&#8217;s name is <strong>mail.example.com<\/strong>. You may not want outgoing mail to come from <strong><em>username<\/em>@mail.example.com<\/strong>, as you&#8217;d prefer the standard <strong><em>username<\/em>@example.com<\/strong>. You can state which domain(s) not to masquerade (If you use a dynamic DNS service, then your server address will be a sub domain) and also specify which users not to masquerade.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># masquerade_domains = mail.example.com www.example.com !sub.dyndomain.com<\/span>\r\n<span style=\"color: #c0c0c0;\"># masquerade_exceptions = root<\/span><\/pre>\n<p style=\"text-align: justify;\">As this HOWTO describes using virtual domains, these need to be empty.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">local_recipient_maps =<\/span>\r\n<span style=\"color: #339966;\">mydestination =<\/span><\/pre>\n<p style=\"text-align: justify;\">I&#8217;ve had problems with web based IMAP clients sending messages so I add the local IP subnet for the server (192.168.1.0\/24) to the &#8220;mynetworks&#8221; variable.<\/p>\n<pre style=\"text-align: justify;\">mynetworks = 127.0.0.0\/8 [::ffff:127.0.0.0]\/104 [::1]\/128 <strong>192.168.1.0\/24<\/strong><\/pre>\n<p style=\"text-align: justify;\">Now we set a few numbers.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># How long if undelivered before sending warning update to sender.<\/span>\r\n<span style=\"color: #339966;\">delay_warning_time = <strong>4h<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># Will it be a permanent or temporary error.<\/span>\r\n<span style=\"color: #339966;\">unknown_local_recipient_reject_code = <strong>450<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># How long to keep messages on queue before returning as failed.<\/span>\r\n<span style=\"color: #339966;\">maximal_queue_lifetime = <strong>7d<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># MAX and MIN time in seconds between retries if connection has failed.<\/span>\r\n<span style=\"color: #339966;\">minimal_backoff_time = <strong>1000s<\/strong><\/span>\r\n<span style=\"color: #339966;\">maximal_backoff_time = <strong>8000s<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># How long to wait when servers connect before receiving the rest of the data.<\/span>\r\n<span style=\"color: #339966;\">smtp_helo_timeout = <strong>60s<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># How many addresses can be used in one message - effective stopper to mass spammers or<\/span>\r\n<span style=\"color: #c0c0c0;\"># accidental copy in of whole address list but may restrict intentional mail shots.<\/span>\r\n<span style=\"color: #339966;\">smtpd_recipient_limit = <strong>16<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># How many errors before server backs off.<\/span>\r\n<span style=\"color: #339966;\">smtpd_soft_error_limit = <strong>3<\/strong><\/span>\r\n<span style=\"color: #c0c0c0;\"># How many MAX errors before blocking it.<\/span>\r\n<span style=\"color: #339966;\">smtpd_hard_error_limit = <strong>12<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">Now we can specify some restrictions. Be careful that each of these settings is on one line only.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># Requirements for the HELO statement<\/span>\r\n<span style=\"color: #339966;\">smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit<\/span>\r\n<span style=\"color: #c0c0c0;\"># Requirements for the sender details.<\/span>\r\n<span style=\"color: #339966;\">smtpd_sender_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit<\/span>\r\n<span style=\"color: #c0c0c0;\"># Requirements for the connecting server.<\/span>\r\n<span style=\"color: #339966;\">smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl<del>, reject_rbl_client dnsbl.njabl.org<\/del><\/span>\r\n<span style=\"color: #c0c0c0;\"># Requirement for the recipient address.<\/span>\r\n<span style=\"color: #339966;\">smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, permit<\/span>\r\n<span style=\"color: #339966;\">smtpd_data_restrictions = reject_unauth_pipelining<\/span><\/pre>\n<p style=\"text-align: justify;\"><span style=\"color: #ff0000;\"><strong>Note:<\/strong> No point in including <strong>dnsbl.njabl.org<\/strong> (as detailed above), as this was shutdown in 2013&#8230;<\/span>[see <a href=\"http:\/\/www.dnsbl.info\/dnsbl-njabl-org.php\" target=\"_blank\">here<\/a>]<\/p>\n<p style=\"text-align: justify;\">Further restrictions that are used to mitigate malicious use.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># Require proper HELO at each connection.<\/span>\r\n<span style=\"color: #339966;\">smtpd_helo_required = yes<\/span>\r\n<span style=\"color: #c0c0c0;\"># Waste spammers time before rejecting them<\/span>\r\n<span style=\"color: #339966;\">smtpd_delay_reject = yes<\/span>\r\n<span style=\"color: #339966;\">disable_vrfy_command = yes<\/span><\/pre>\n<p style=\"text-align: justify;\">Next we need to set some maps and lookups for the virtual domains. These will reference files that will contain access information for the MySQL databases that contain the relevant data<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># Not sure of the difference of the next two but they are needed for local aliasing<\/span>\r\n<span style=\"color: #339966;\">alias_maps = hash:\/etc\/postfix\/aliases<\/span>\r\n<span style=\"color: #339966;\">alias_database = hash:\/etc\/postfix\/aliases<\/span>\r\n<span style=\"color: #c0c0c0;\"># This specifies where the virtual mailbox folders will be located.<\/span>\r\n<span style=\"color: #339966;\">virtual_mailbox_base = \/var\/spool\/mail\/virtual<\/span>\r\n<span style=\"color: #c0c0c0;\"># This is for the mailbox location for each user.<\/span>\r\n<span style=\"color: #339966;\">virtual_mailbox_maps = mysql:\/etc\/postfix\/mysql_mailbox.cf<\/span>\r\n<span style=\"color: #c0c0c0;\"># and this is for aliases<\/span>\r\n<span style=\"color: #339966;\">virtual_alias_maps = mysql:\/etc\/postfix\/mysql_alias.cf<\/span>\r\n<span style=\"color: #c0c0c0;\"># and this is for domain lookups<\/span>\r\n<span style=\"color: #339966;\">virtual_mailbox_domains = mysql:\/etc\/postfix\/mysql_domains.cf<\/span>\r\n<span style=\"color: #c0c0c0;\"># This is how to connect to the domains (all virtual, but the option is there)<\/span>\r\n<span style=\"color: #c0c0c0;\"># ** NOT USED YET **<\/span>\r\n<span style=\"color: #c0c0c0;\"># transport_maps = mysql:\/etc\/postfix\/mysql_transport.cf<\/span><\/pre>\n<p style=\"text-align: justify;\">You can use a lookup for the UID and GID of the owner of the mail files but I tend to have one owner (virtual), so instead add this.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">virtual_uid_maps = static:5000<\/span>\r\n<span style=\"color: #339966;\">virtual_gid_maps = static:5000<\/span><\/pre>\n<p style=\"text-align: justify;\">You need to set up an alias file. This is only used locally, and not by your own mail domains.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/etc\/aliases \/etc\/postfix\/aliases<\/pre>\n<p style=\"text-align: justify;\">&#8230; you may want to view the file to check if OK, especially if the final alias e.g. root goes to a real person&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo postalias \/etc\/postfix\/aliases<\/pre>\n<p style=\"text-align: justify;\">Next you need to set up the folder where the virtual mail will be stored. This may have already been done by the apt-get. Also, create the user who will own the folders.<\/p>\n<p style=\"text-align: justify;\">Use this to add if there is not a virtual user<\/p>\n<pre style=\"text-align: justify;\">sudo mkdir \/var\/spool\/mail\/virtual\r\nsudo groupadd --system virtual -g 5000\r\nsudo useradd --system virtual -u 5000 -g 5000\r\nsudo chown -R virtual:virtual \/var\/spool\/mail\/virtual<\/pre>\n<h4 style=\"text-align: justify;\">Postfix&#8217;s MySQL configuration<\/h4>\n<p style=\"text-align: justify;\">We now need to set up the files to access the lookups via the MySQL database. We will only set up the essential files for now, and the rest later if\/when needed.<\/p>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong><strong>NOTE<\/strong>:<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">The <strong><em>mailPASSWORD<\/em><\/strong> that you choose and define in the files below, will be configured in the next step titled &#8220;<strong>Database<\/strong>&#8220;. It is not the <strong>rootPASSWORD<\/strong> you created when installing MySQL.<\/span><\/p>\n<\/blockquote>\n<p style=\"text-align: justify;\">Create the file that tells Postfix how to find the users mailbox location.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/mysql_mailbox.cf\r\n<span style=\"color: #339966; padding-left: 30px;\">user=mail<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">password=<em><span style=\"color: #ff0000;\">mailPASSWORD<\/span><\/em><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">dbname=maildb<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">table=users<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">select_field=maildir<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">where_field=id<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">hosts=127.0.0.1<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">additional_conditions = and enabled = 1<\/span><\/pre>\n<p style=\"text-align: justify;\">Create the file that tells Postfix how to find the email alias.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/mysql_alias.cf\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">user=mail<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">password=<em><span style=\"color: #ff0000;\">mailPASSWORD<\/span><\/em><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">dbname=maildb<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">table=aliases<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">select_field=destination<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">where_field=mail<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">hosts=127.0.0.1<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">additional_conditions = and enabled = 1<\/span><\/pre>\n<p style=\"text-align: justify;\">Create the file that tells Postfix how to find the domains.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/mysql_domains.cf\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">user=mail<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">password=<span style=\"color: #ff0000;\"><em>mailPASSWORD<\/em><\/span><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">dbname=maildb<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">table=domains<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">select_field=domain<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">where_field=domain<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">hosts=127.0.0.1<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">additional_conditions = and enabled = 1<\/span><\/pre>\n<p style=\"text-align: justify;\">If you specify an IP in hosts file (as opposed to &#8216;localhost&#8217;) then it will communicate over TCP and not the MySQL socket (a chroot restriction).<\/p>\n<h3 style=\"text-align: justify;\">Database<\/h3>\n<h4 style=\"text-align: justify;\">MySQL<\/h4>\n<p style=\"text-align: justify;\">The next step now is to create the tables for those lookups we just defined. First you need to create a user to use in MySQL for mail ONLY. Then you need to create the database. Make sure you take note of your chosen mail username and password. You will need the password you specified for root during the MySQL package installation.<\/p>\n<p style=\"text-align: justify;\">If you haven&#8217;t already done this in package installation&#8230;<\/p>\n<pre style=\"text-align: justify;\">mysqladmin -u root password <span style=\"color: #ff0000;\"><em>newPassword<\/em><\/span><\/pre>\n<p style=\"text-align: justify;\">Log in as root<\/p>\n<pre style=\"text-align: justify;\">mysql -u root -p<\/pre>\n<p style=\"text-align: justify;\">Then enter password for the <strong>root<\/strong> account when prompted. Now we create the mail database&#8230;<\/p>\n<pre style=\"text-align: justify;\"><strong>CREATE DATABASE<\/strong> maildb;<\/pre>\n<p style=\"text-align: justify;\">Then we create a new user called &#8220;mail&#8221;<\/p>\n<pre style=\"text-align: justify;\"><strong>GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP ON<\/strong> maildb.* <strong>TO<\/strong> 'mail'@'localhost' <strong>IDENTIFIED BY<\/strong> '<span style=\"color: #ff0000;\"><em>mailPASSWORD<\/em><\/span>';\r\n<strong>GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP ON<\/strong> maildb.* <strong>TO<\/strong> 'mail'@'%' <strong>IDENTIFIED BY<\/strong> '<em><span style=\"color: #ff0000;\">mailPASSWORD<\/span><\/em>';\r\nexit;<\/pre>\n<p style=\"text-align: justify;\">Obviously replace <em><span style=\"color: #ff0000;\">mailPASSWORD<\/span><\/em> with your chosen password, and the one defined in the Postfix section above!<\/p>\n<p style=\"text-align: justify;\">We&#8217;ve talked about them, defined them&#8230; now it&#8217;s time to actually create them. &#8216;Create what?&#8217; you ask? The following tables of course:<\/p>\n<ul>\n<li>aliases<\/li>\n<li>domains<\/li>\n<li>users<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">We will create more later on for further extensions, but for now only these are relevant.<\/p>\n<p style=\"text-align: justify;\">Log into MySQL as the new mail user, connecting to the maildb database.<\/p>\n<pre style=\"text-align: justify;\">mysql -u <strong>mail<\/strong> -p <strong>maildb<\/strong><\/pre>\n<p style=\"text-align: justify;\">Then run the following commands to create the specified tables. Quick side note here: It makes a difference if you use <span style=\"color: #ff0000;\"><strong>`<\/strong><\/span> vs. <span style=\"color: #ff0000;\"><strong>&#8216;<\/strong><\/span> so take note of which one is used in the commands below.<\/p>\n<pre style=\"text-align: justify;\"><strong>CREATE TABLE<\/strong> `aliases` ( `pkid` smallint(3) <strong>NOT NULL<\/strong> auto_increment, `mail` varchar(120) <strong>NOT NULL<\/strong> default '', `destination` varchar(120) NOT NULL default '', `enabled` tinyint(1) <strong>NOT NULL<\/strong> default '1', <strong>PRIMARY KEY<\/strong> (`pkid`), <strong>UNIQUE KEY<\/strong> `mail` (`mail`));\r\n\r\n<strong>CREATE TABLE<\/strong> `domains` ( `pkid` smallint(6) <strong>NOT NULL<\/strong> auto_increment, `domain` varchar(120) <strong>NOT NULL<\/strong> default '', `transport` varchar(120) <strong>NOT NULL<\/strong> default 'virtual:', `enabled` tinyint(1) <strong>NOT NULL<\/strong> default '1', <strong>PRIMARY KEY<\/strong> (`pkid`));\r\n\r\n<strong>CREATE TABLE<\/strong> `users` ( `id` varchar(128) <strong>NOT NULL<\/strong> default '', `name` varchar(128)<strong> NOT NULL<\/strong> default '', `uid` smallint(5) unsigned <strong>NOT NULL<\/strong> default '5000', `gid` smallint(5) unsigned <strong>NOT NULL<\/strong> default '5000', `home` varchar(255) <strong>NOT NULL<\/strong> default '\/var\/spool\/mail\/virtual', `maildir` varchar(255) <strong>NOT NULL<\/strong> default 'blah\/', `enabled` tinyint(3) unsigned <strong>NOT NULL<\/strong> default '1', `change_password` tinyint(3) unsigned <strong>NOT NULL<\/strong> default '1', `clear` varchar(128) <strong>NOT NULL<\/strong> default 'ChangeMe', `crypt` varchar(128) <strong>NOT NULL<\/strong> default 'sdtrusfX0Jj66', `quota` varchar(255) <strong>NOT NULL<\/strong> default '', `procmailrc` varchar(128) <strong>NOT NULL<\/strong> default '', `spamassassinrc` varchar(128) <strong>NOT NULL<\/strong> default '', <strong>PRIMARY KEY<\/strong> (`id`), <strong>UNIQUE KEY<\/strong> `id` (`id`));<\/pre>\n<p style=\"text-align: justify;\">The last few fields in the &#8216;users&#8217; table are not required, but useful if you decide to extend functionality later on.<\/p>\n<p style=\"text-align: justify;\">To visualise the tables created, you can use the following command(s) when logged into the MySQL database.<\/p>\n<pre style=\"text-align: justify;\"><strong>DESCRIBE<\/strong> `aliases`;\r\n<strong>DESCRIBE<\/strong> `domains`;\r\n<strong>DESCRIBE<\/strong> `users`;\r\nexit;<\/pre>\n<p style=\"text-align: justify;\">Next you need to edit the MySQL <em><strong>my.cnf<\/strong><\/em> file. In Ubuntu\/Debian this is created by default. In Mandrake I had to manually create a blank one in <em><strong>\/etc<\/strong><\/em>.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/mysql\/my.cnf<\/pre>\n<p style=\"text-align: justify;\">In previous versions you needed to comment out this line <span style=\"color: #339966;\"><em>#skip-networking<\/em><\/span>. However in the latest version of the file the default is to bind the address to <strong>localhost<\/strong>, which is fine.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">bind-address = 127.0.0.1<\/span><\/pre>\n<p style=\"text-align: justify;\">It is very useful at the start to log any SQL calls that make it to MySQL. To do this enable these lines.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">general_log_file = \/var\/log\/mysql\/mysql.log<\/span>\r\n<span style=\"color: #339966;\">general_log = 1<\/span><\/pre>\n<p style=\"text-align: justify;\">Then in a few weeks when your sure everything is working OK, comment it out as it slows MySQL down<\/p>\n<p style=\"text-align: justify;\">Once the changes are complete, restart MySQL to make sure it picks up the new settings.<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/mysql restart<\/pre>\n<h3 style=\"text-align: justify;\">POP\/IMAP<\/h3>\n<h4 style=\"text-align: justify;\">Courier IMAP<\/h4>\n<p style=\"text-align: justify;\">You need to change Courier to use MySQL and tell it where to find the information in our databases.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/courier\/authdaemonrc<\/pre>\n<p style=\"text-align: justify;\">Change to MySQL mode.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">authmodulelist=\"<strong>authmysql<\/strong>\"<\/span><\/pre>\n<p style=\"text-align: justify;\">Further down in the file enable logging.<\/p>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong>WARNING<\/strong>:<\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">This level of logging will show passwords in <span style=\"text-decoration: underline;\"><strong>cleartext<\/strong><\/span>in the syslog!<\/span><\/p>\n<\/blockquote>\n<p style=\"text-align: justify;\"><span style=\"color: #339966;\">DEBUG_LOGIN=2<\/span><\/p>\n<p style=\"text-align: justify;\">Now change\/update user, password, database, table names, crypt, mail directory and &#8216;where&#8217; clause&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/courier\/authmysqlrc\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_USERNAME <strong>mail<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_PASSWORD <span style=\"color: #ff0000;\"><em><strong>mailPASSWORD<\/strong><\/em><\/span><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_DATABASE <strong>maildb<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_USER_TABLE <strong>users<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_CRYPT_PWFIELD <strong>crypt<\/strong><\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># MYSQL_CLEAR_PWFIELD clear<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_MAILDIR_FIELD concat(<strong>home<\/strong>,'\/',<strong>maildir<\/strong>)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">MYSQL_WHERE_CLAUSE <strong>enabled=1<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">Lastly you can have a look at the imapd file, but no changes are needed so it&#8217;s recommended to leave it as is.<\/p>\n<pre style=\"text-align: justify;\">vi \/etc\/courier\/imapd<\/pre>\n<h2 id=\"advanced-mail-server\">Stage Two: Advanced mail server<\/h2>\n<h3>Content check interface<\/h3>\n<h4>Amavisd-new<\/h4>\n<p style=\"text-align: justify;\">Amavisd-new is a high-performance interface between mailer (MTA) and content checkers: virus scanners, and\/or SpamAssassin. The default values are a good start and the Ubuntu documentation is pretty clear with its recommendations.<\/p>\n<p style=\"text-align: justify;\">Here is a tweaked version of those recommendations. Initially we will not enable spam or virus detection! This is so we can get amavis set up to receive, check and pass on emails before we go on to over-complicate it.<\/p>\n<p style=\"text-align: justify;\">All of amavis&#8217; configuration files are in <strong>\/etc\/amavisd<\/strong>. They are now broken down into several configuration files in <strong>conf.d\/<\/strong>.<\/p>\n<pre style=\"text-align: justify;\">cd \/etc\/amavis\/conf.d<\/pre>\n<p style=\"text-align: justify;\">The <strong>01-debian<\/strong>, <strong>25-amavis_helpers<\/strong> and <strong>30-template-localization<\/strong> defaults are fine and it&#8217;s worth while having a look at the following files, but don&#8217;t change anything in them.<\/p>\n<pre style=\"text-align: justify;\">less 05-domain_id\r\nless 05-node_id\r\nless 15-av_scanners\r\nless 20-debian_defaults\r\nless 21-ubuntu_defaults<\/pre>\n<p style=\"text-align: justify;\">Edit content check file.<\/p>\n<pre style=\"text-align: justify;\">sudo vi 15-content_filter_mode<\/pre>\n<p style=\"text-align: justify;\">Comment out both virus and spam scan lines. (They are commented out by default).<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\">#@bypass_virus_checks_maps = (<\/span>\r\n<span style=\"color: #c0c0c0;\">#   \\%bypass_virus_checks, \\@bypass_virus_checks_acl,\/$bypass_virus_checks_re);<\/span>\r\n<span style=\"color: #c0c0c0;\">#@bypass_spam_checks_maps = (<\/span>\r\n<span style=\"color: #c0c0c0;\">#   \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\$bypass_spam_checks_re);<\/span><\/pre>\n<p style=\"text-align: justify;\">Edit the user file.<\/p>\n<pre style=\"text-align: justify;\">sudo vi 50-user<\/pre>\n<p style=\"text-align: justify;\">In the middle of the file insert the following:<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">@local_domains_acl = qw(.);<\/span>\r\n<span style=\"color: #339966;\">$log_level = <strong>2<\/strong>;<\/span>\r\n<span style=\"color: #339966;\">$syslog_priority = '<strong>debug<\/strong>';<\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level<\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level<\/span>\r\n<span style=\"color: #339966;\">$sa_kill_level_deflt = 8.0; # triggers spam evasive actions<\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent<\/span>\r\n<span style=\"color: #339966;\">$final_spam_destiny = <strong>D_PASS<\/strong>;<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_REJECT; # default<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_BOUNCE; # debian default<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_DISCARD; # ubuntu default, recommended as sender is usually faked<\/span><\/pre>\n<p style=\"text-align: justify;\">We have now setup amavis to scan and pass along incoming emails. Next we will configure Postfix to talk to Amavis.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/master.cf<\/pre>\n<p style=\"text-align: justify;\">Append these lines to the end of the file but make sure they are not already present. (Note the <strong>-o<\/strong> lines have spaces in front of them).<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">amavis      unix    -       -       -       -       2       smtp\r\n        -o smtp_data_done_timeout=1200\r\n        -o smtp_send_xforward_command=yes\r\n        -o disable_dns_lookups=yes\r\n        -o max_use=20\r\n127.0.0.1:10025 inet    n       -       -       -       -       smtpd\r\n        -o content_filter=\r\n        -o local_recipient_maps=\r\n        -o relay_recipient_maps=\r\n        -o smtpd_restriction_classes=\r\n        -o smtpd_delay_reject=no\r\n        -o smtpd_client_restrictions=permit_mynetworks,reject\r\n        -o smtpd_helo_restrictions=\r\n        -o smtpd_sender_restrictions=\r\n        -o smtpd_recipient_restrictions=permit_mynetworks,reject\r\n        -o smtpd_data_restrictions=reject_unauth_pipelining\r\n        -o smtpd_end_of_data_restrictions=\r\n        -o mynetworks=127.0.0.0\/8\r\n        -o smtpd_error_sleep_time=0\r\n        -o smtpd_soft_error_limit=1001\r\n        -o smtpd_hard_error_limit=1000\r\n        -o smtpd_client_connection_count_limit=0\r\n        -o smtpd_client_connection_rate_limit=0\r\n        -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks<\/span><\/pre>\n<p style=\"text-align: justify;\">&#8230; then add the following two lines immediately below the &#8220;<strong>pickup<\/strong>&#8221; transport service:<\/p>\n<pre><span style=\"color: #339966;\">        -o content_filter=\r\n        -o receive_override_options=no_header_body_checks<\/span><\/pre>\n<p style=\"text-align: justify;\">&#8230;and then add the reference to the <em>content_filter<\/em> in <strong>main.cf<\/strong><\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/main.cf\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">content_filter = amavis:[127.0.0.1]:10024<\/span><\/pre>\n<p style=\"text-align: justify;\">We now enable scanning of amavis&#8217; temporary files by ClamAV.<\/p>\n<pre style=\"text-align: justify;\">sudo adduser clamav amavis<\/pre>\n<p style=\"text-align: justify;\">This should be it to get Amavis-new working. If emails are picked up by Amavis-new and passed back to Postfix then everything should be okay.<\/p>\n<h5 style=\"text-align: justify;\">Open for business?<\/h5>\n<p style=\"text-align: justify;\">Only when you have finished the next section (<strong>SpamAssassin<\/strong>) and testing, do you proceed to uncomment the anti-virus and anti-spam lines in <em>15-content_filter_mode<\/em><\/p>\n<pre>sudo vi 15-content_filter_mode\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">@bypass_virus_checks_maps = (<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">    \\%bypass_virus_checks, \\@bypass_virus_checks_acl, \\$bypass_virus_checks_re);<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">@bypass_spam_checks_maps = (<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">    \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\$bypass_spam_checks_re);<\/span><\/pre>\n<p style=\"text-align: justify;\">&#8230;and turn down the logging level, and start bouncing\/discarding spam.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/amavis\/conf.d\/50-user\r\n\r\n<span style=\"color: #339966;\">@local_domains_acl = qw(.);<\/span>\r\n<span style=\"color: #339966;\">$log_level = <strong>1<\/strong>;<\/span>\r\n<span style=\"color: #339966;\">$syslog_priority = '<strong>info<\/strong>';<\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level<\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level<\/span>\r\n<span style=\"color: #339966;\">$sa_kill_level_deflt = 8.0; <span style=\"color: #c0c0c0;\"># triggers spam evasive actions<\/span><\/span>\r\n<span style=\"color: #c0c0c0;\"># $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_PASS;<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_REJECT; # default<\/span>\r\n<span style=\"color: #c0c0c0;\"># $final_spam_destiny = D_BOUNCE; # debian default<\/span>\r\n<span style=\"color: #339966;\">$final_spam_destiny = <strong>D_DISCARD<\/strong>; <span style=\"color: #c0c0c0;\"># ubuntu default, recommended as sender is usually faked<\/span><\/span><\/pre>\n<h3 style=\"text-align: justify;\">Anti-SPAM<\/h3>\n<h4 style=\"text-align: justify;\">SpamAssassin<\/h4>\n<p style=\"text-align: justify;\">The default configuration of SpamAssassin is fine, but you do need to tell SpamAssassin to start &#8220;<strong>smapd<\/strong>&#8221; on boot.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/default\/spamassassin\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">ENABLED=<strong>1<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">One configuration option you could tweak is to enable &#8220;<strong>Bayes<\/strong>&#8221; and &#8220;<strong>Bayes auto-learning<\/strong>&#8220;.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/spamassassin\/local.cf\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\"># Use Bayesian classifier (default: 1)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">#<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">use_bayes <strong>1<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"># Bayesian classifier auto-learning (default: 1)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">#<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">bayes_auto_learn <strong>1<\/strong><\/span><\/pre>\n<h4 style=\"text-align: justify;\">Postgrey<\/h4>\n<p style=\"text-align: justify;\">The default configuration of Postgrey is fine. However you do need to tell Postfix to use it.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/main.cf<\/pre>\n<p style=\"text-align: justify;\">&#8230;then edit the recipient restrictions setting:<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit<\/span><\/pre>\n<p style=\"text-align: justify;\">You can then tweak whitelisting in <strong>\/etc\/postgrey<\/strong> if you wish. You can also tweak the Postgrey configuration by editing <strong>\/etc\/default\/postgrey<\/strong>. For example you could change delay, auto whitelisting, or message rejection.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">POSTGREY_OPTS=\"--inet=10023 --max-age=365\"<\/span><\/pre>\n<h3 style=\"text-align: justify;\">Anti-VIRUS<\/h3>\n<h4 style=\"text-align: justify;\">ClamAV<\/h4>\n<p style=\"text-align: justify;\">ClamAV does not need any setting up. The configuration files are located in <strong>\/etc\/clamav<\/strong>, but they are automatically generated, so do not edit them. By default <strong>freshclam<\/strong>, the daemon that updates the virus definition database, is run 24 times a day(!!). That seems a little excessive, so I tend to set that to once a day.<\/p>\n<pre style=\"text-align: justify;\">sudo dpkg-reconfigure clamav-freshclam<\/pre>\n<p style=\"text-align: justify;\">Running this &#8220;reconfigure&#8221; will also prompt you whether you want it to be <strong>daemon<\/strong> (answer: <strong>Yes<\/strong>) and which server is closest to you. If needed, the command below will redefine the entire configuration with a lot of questions\/prompting. It&#8217;s not needed unless you really need to configure ClamAV to the <em>n<\/em>th degree.<\/p>\n<pre style=\"text-align: justify;\">sudo dpkg-reconfigure clamav-base<\/pre>\n<h2 id=\"secure-mail-server\">Stage Three: Secure your mail server<\/h2>\n<h3>SSL Certificates&#8230; or &#8220;How I lost my mind for a week&#8221;<\/h3>\n<h4>Don&#8217;t cry little baby&#8230;<\/h4>\n<p style=\"text-align: justify;\">OK, I confess I had a hell of time getting my head around the certificates for the traffic encryption. I think it was compounded by the fact that I didn&#8217;t think I was doing anything out of the ordinary, but I couldn&#8217;t seem to find a solid set of steps to follow, and instead had to amalgamate a number of different procedures from different sources to get it working (<em>at least I think it&#8217;s working?!<\/em>). It also doesn&#8217;t help when some clients are more forgiving than others about how they handle incorrect certificates.<\/p>\n<p style=\"text-align: justify;\">In the end it was Microsoft&#8217;s obtuse Outlook 2007 that helped me the most, refusing to work until I&#8217;d got the certificate details sorted. Well, to help save <strong>you<\/strong> some pain, hopefully the following steps will assist you (&#8230;and your sanity!)<\/p>\n<h4 style=\"text-align: justify;\">Down to business<\/h4>\n<p style=\"text-align: justify;\">Ubuntu will have created it&#8217;s own self-signed certificate in <strong>\/etc\/ssl\/certs<\/strong> with the key in <strong>\/etc\/ssl\/private<\/strong> called <em>ssl-cert-snakeoil.pem<\/em> and <em>ssl-cert-snakeoil.key<\/em> respectively. I think these are fine if you&#8217;re only going to use the server locally, but once it&#8217;s opened up to the internet, clients will complain about the certificate validity (at least mine did!)<\/p>\n<p style=\"text-align: justify;\">The two processes that will use the certificates &#8211; in context of this HOWTO &#8211; are Postfix and Courier. The instructions are based to some degree on the Ubuntu documentation <a title=\"Ubuntu server guide - Certificates and Security\" href=\"https:\/\/help.ubuntu.com\/10.04\/serverguide\/C\/certificates-and-security.html#generating-a-csr\">here<\/a>. I created a directory called <strong>certs<\/strong> in my admin user&#8217;s home directory so I could keep everything together.<\/p>\n<p style=\"text-align: justify;\">First we create a file with the encrypted private server key in it and this will form the basis of certificate generation. I&#8217;ve used <strong>2048<\/strong> as the key length based on security recommendations at the time of writing this (Sept 2010). This command will prompt you for a server passphrase &#8211; the longer the phrase the better, but the minimum for DES3 is four (<strong>4<\/strong>).<\/p>\n<pre style=\"text-align: justify;\">cd ~\/certs\r\nsudo openssl genrsa -des3 -out <strong>server.key 2048<\/strong><\/pre>\n<p style=\"text-align: justify;\">Now create the insecure key, the one without a passphrase, and shuffle the key names.<\/p>\n<pre style=\"text-align: justify;\">sudo openssl rsa -in <strong>server.key<\/strong> -out <strong>server.key.insecure<\/strong>\r\nsudo mv <strong>server.key server.key.secure<\/strong>\r\nsudo mv <strong>server.key.insecure server.key<\/strong><\/pre>\n<p style=\"text-align: justify;\">The insecure key is now named <em>server.key<\/em>, and you can use this file to generate the CSR without a passphrase stored in it. To create the CSR, run the following command. <strong>You can combine steps within the one command to create the certificate without using a CSR<\/strong>, but if you decide to get an SSL certificate from a CA, having the CSR will come in handy.<\/p>\n<pre style=\"text-align: justify;\">sudo openssl req -new -key <strong>server.key<\/strong> -out <strong>server.csr<\/strong><\/pre>\n<p style=\"text-align: justify;\">This will now prompt you for some certificate information like country, location, company name etc.<\/p>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong>IMPORTANT:<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">Make sure that you use the server&#8217;s <strong>FQDN<\/strong> when prompted for the common name (<strong>CN<\/strong>). In most of the examples we&#8217;ve referred to it as <strong><em>smtp.example.com<\/em><\/strong> (or similar) and will continue to use that in the following steps.<\/span><\/p>\n<\/blockquote>\n<p style=\"text-align: justify;\">You can now submit this CSR file to a CA (Verisign, Comodo etc&#8230;) for processing. The CA will use this CSR file and issue the certificate but we&#8217;re going to use it to create a self-signed certificate. It&#8217;s up to you how many days you create make the certificate valid for, the default is 365 days.<\/p>\n<pre style=\"text-align: justify;\">sudo openssl x509 -sha256 -req -days <strong>999<\/strong> -in <strong>server.csr<\/strong> -signkey <strong>server.key<\/strong> -out <strong>server.crt<\/strong><\/pre>\n<p style=\"text-align: justify;\">Fantastic&#8230; we have a certificate and a key, but <strong>PEM<\/strong> format certificates (<span style=\"color: #999999;\"><em>a certificate that may include just the public certificate, or may include an entire certificate chain including public key, private key, and root certificates. The name is from <strong>P<\/strong>rivacy <strong>E<\/strong>nhanced <strong>E<\/strong>mail, a failed method for secure email but the container format it used lives on.<\/em><\/span>) often include the key and the certificate in one file. Combining them is simple&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo cat <strong>server.key<\/strong> <strong>server.crt<\/strong> &gt;&gt; <strong>server.pem<\/strong><\/pre>\n<p style=\"text-align: justify;\">Next, we copy some of these files to the relevant locations where they will be used.<\/p>\n<pre style=\"text-align: justify;\">sudo cp <strong>server.crt<\/strong> \/etc\/ssl\/certs\/<strong><span style=\"color: #339966;\"><em>smtp.example.com<\/em><\/span>.pem<\/strong>\r\nsudo cp <strong>server.key<\/strong> \/etc\/ssl\/private\/<strong><span style=\"color: #339966;\"><em>smtp.example.com<\/em><\/span>.key<\/strong>\r\nsudo cp <strong>server.pem<\/strong> \/etc\/courier\/<strong>imapd.pem<\/strong><\/pre>\n<p style=\"text-align: justify;\">That&#8217;s pretty much it for the certificates. The next step is to secure your mail server using the certificate we&#8217;ve just created.<\/p>\n<h4 style=\"text-align: justify;\">Some helpful commands<\/h4>\n<p style=\"text-align: justify;\">To view the contents of a PEM (Privacy Enhanced Mail) certificate<\/p>\n<pre style=\"text-align: justify;\">sudo openssl x509 -in <strong>certname.pem<\/strong> -noout -text<\/pre>\n<p style=\"text-align: justify;\">Create a public key, using your private key (using the files created above&#8230;)<\/p>\n<pre style=\"text-align: justify;\">sudo openssl rsa -in <strong>server.pem<\/strong> -pubout -out <strong>server.public<\/strong><\/pre>\n<p style=\"text-align: justify;\">Create a certificate file for import in Windows certificate manager (important if the certificate is self-signed).<\/p>\n<pre style=\"text-align: justify;\">sudo openssl x509 -in <strong>certname.pem<\/strong> -out <strong>certname.crt<\/strong><\/pre>\n<p style=\"text-align: justify;\">Create a self-signed certificate with a &#8220;auto-generated&#8221; key and write it out to a PEM format file.<\/p>\n<pre style=\"text-align: justify;\">sudo openssl req -x509 -newkey rsa:2048 -keyout <strong>certname.pem<\/strong> -out <strong>certname.pem<\/strong> -nodes -days <strong>999<\/strong><\/pre>\n<h3 style=\"text-align: justify;\">Configuring authentication<\/h3>\n<h4 style=\"text-align: justify;\">SASL<\/h4>\n<p style=\"text-align: justify;\">SASL secures the actual authentication (login), by encoding the passwords so that it can not be easily intercepted. The rest of the emails are however in clear plain text.<\/p>\n<p style=\"text-align: justify;\">SASL can be a royal pain to set up, especially as it does not support storing encrypted passwords by default in Ubuntu.<\/p>\n<p style=\"text-align: justify;\">Obviously this is not ideal, so there are ways to combine SASL and storing encrypted passwords. In the future the packages that come with Ubuntu may support the <strong>password_format<\/strong> configuration option for SASL, but until then you can configure SASL to ask PAM to compare the passwords.<\/p>\n<p style=\"text-align: justify;\">Install packages if not all installed already&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install sasl2-bin libpam-mysql libsasl2-modules libsasl2-modules-sql<\/pre>\n<p style=\"text-align: justify;\">Enable postfix to access SASL files.<\/p>\n<pre style=\"text-align: justify;\">sudo adduser postfix sasl<\/pre>\n<p style=\"text-align: justify;\">Create SASL directories which will be chrooted Postfix.<\/p>\n<pre style=\"text-align: justify;\">sudo mkdir -p \/var\/spool\/postfix\/var\/run\/saslauthd<\/pre>\n<p style=\"text-align: justify;\">Add SASL configurations to Postfix.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/main.cf\r\n\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># SASL<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">smtpd_sasl_auth_enable = yes<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># If your clients use Outlook Express or other older clients then<\/span>\r\n<span style=\"color: #c0c0c0; padding-left: 30px;\"># broken_sasl_auth_clients needs to be set to yes<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">broken_sasl_auth_clients = no<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">smtpd_sasl_security_options = noanonymous<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">smtpd_sasl_local_domain =<\/span><\/pre>\n<p style=\"text-align: justify;\">Modify these existing configurations<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># Add permit_sasl_authenticated to you existing smtpd_sender_restrictions<\/span>\r\n<span style=\"color: #339966;\">smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain,reject_unauth_pipelining, permit<\/span>\r\n<span style=\"color: #c0c0c0;\"># Add permit_sasl_authenticated to you existing smtpd_recipient_restrictions<\/span>\r\n<span style=\"color: #339966;\">smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks,permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain,reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit<\/span><\/pre>\n<p style=\"text-align: justify;\">Change how saslauthd is run.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/default\/saslauthd\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">START=yes<\/span>\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">OPTIONS=\"-r -c -m \/var\/spool\/postfix\/var\/run\/saslauthd\"<\/span><\/pre>\n<p style=\"text-align: justify;\">Now tell Postfix how to interact with SASL.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/sasl\/smtpd.conf\r\n\r\n<span style=\"color: #339966;\">pwcheck_method: <strong>saslauthd<\/strong><\/span>\r\n<span style=\"color: #339966;\">mech_list: <strong>plain login cram-md5 digest-md5<\/strong><\/span>\r\n<span style=\"color: #339966;\">log_level: <strong>7<\/strong><\/span>\r\n<span style=\"color: #339966;\">allow_plaintext: true<\/span>\r\n<span style=\"color: #339966;\">auxprop_plugin: <strong>mysql<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_engine: <strong>mysql<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_hostnames: 127.0.0.1<\/span>\r\n<span style=\"color: #339966;\">sql_user: <strong>mail<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_passw: <em><strong>mailPASSWORD<\/strong><\/em><\/span>\r\n<span style=\"color: #339966;\">sql_database: <strong>maildb<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_select: select <strong>crypt<\/strong> from <strong>users<\/strong> where <strong>id<\/strong>='%u@%r' and <strong>enabled<\/strong> = 1<\/span><\/pre>\n<p style=\"text-align: justify;\">Note: When SASL is working, you can remove the <strong>log_level<\/strong> line.<\/p>\n<blockquote id=\"sasl-fix-1204\">\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong>Using Ubuntu 12.04.1 or greater?<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">I had a few problems sending emails after I upgraded my 10.04 system to 12.04 and finally traced the problems to the <strong>smtpd.conf<\/strong> file. It would seem that the definition names had changed slightly from the original documentation, or the Ubuntu build was more sensitive to proper naming convention.<\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">Either way, I was unable to send emails until I made the changes described below:<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">pwcheck_method: <strong>saslauthd<\/strong><\/span>\r\n<span style=\"color: #339966;\">mech_list: <strong>plain login cram-md5 digest-md5<\/strong><\/span>\r\n<span style=\"color: #339966;\">log_level: 7<\/span>\r\n<span style=\"color: #339966;\">allow_plaintext: true<\/span>\r\n<span style=\"color: #339966;\">auxprop_plugin: <span style=\"color: #ff0000;\"><strong>sql<\/strong><\/span><\/span>\r\n<span style=\"color: #339966;\">sql_engine: <strong>mysql<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_hostname<span style=\"color: #ff0000;\"><strong>s<\/strong><\/span>: 127.0.0.1<\/span>\r\n<span style=\"color: #339966;\">sql_user: <strong>mail<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_passw<span style=\"color: #ff0000;\"><strong>d<\/strong><\/span>: <em><strong>mailPASSWORD<\/strong><\/em><\/span>\r\n<span style=\"color: #339966;\">sql_database: <strong>maildb<\/strong><\/span>\r\n<span style=\"color: #339966;\">sql_select: select <strong>crypt<\/strong> from <strong>users<\/strong> where <strong>id<\/strong>='%u@%r' and <strong>enabled<\/strong> = 1<\/span><\/pre>\n<p style=\"text-align: justify;\"><span style=\"color: #ff6600;\">You can find more details on the configuration of the <strong>smtpd.conf<\/strong> file <a href=\"http:\/\/www.postfix.org\/SASL_README.html#auxprop\" target=\"_blank\"><span style=\"color: #ff6600;\">here<\/span><\/a>.<\/span><\/p>\n<\/blockquote>\n<p style=\"text-align: justify;\">Tell pam how to to authenticate smtp via mysql.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/pam.d\/smtp<\/pre>\n<p style=\"text-align: justify;\">Note: These must be on 2 lines only.<\/p>\n<pre style=\"text-align: justify;\">auth required pam_mysql.so user=mail passwd=mailPASSWORD host=127.0.0.1 db=maildb table=users usercolumn=id passwdcolumn=crypt crypt=1\r\naccount sufficient pam_mysql.so user=mail passwd=mailPASSWORD host=127.0.0.1 db=maildb table=users usercolumn=id passwdcolumn=crypt crypt=1<\/pre>\n<p style=\"text-align: justify;\">In addition to tailing <em>var\/log\/mail.log<\/em> and <em>\/var\/log\/mysql\/mysql.log<\/em> it is quite useful to tail the <em>auth.log<\/em> as well when you&#8217;re testing SASL.<\/p>\n<pre style=\"text-align: justify;\">sudo tail -f \/var\/log\/auth.log<\/pre>\n<p style=\"text-align: justify;\">Restart Postfix and saslauthd in order to enable SASL for sending emails.<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/saslauthd restart\r\nsudo \/etc\/init.d\/postfix restart<\/pre>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong>Update 8th February 2011<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">Interesting point I uncovered while checking into saslauthd. Accouring to the Postfix SASL documentation, using &#8220;saslauthd&#8221; in the &#8220;pwcheck_method&#8221; (see above) means you cannot use <strong>cram-md5<\/strong> or <strong>digest-md5<\/strong>!<\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">To quote:<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #800080;\"><strong>Important<\/strong>\r\n\r\nDo not specify any other mechanisms in mech_list than PLAIN or LOGIN when using saslauthd! It can only handle these two mechanisms, and authentication will fail if clients are allowed to choose other mechanisms.<\/span><\/pre>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">Then a bit further down it says:<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #800080;\"><strong>Important<\/strong>\r\n\r\nThese three plugins [sasldb,sql,ldapdb] support shared-secret mechanisms i.e. CRAM-MD5, DIGEST-MD5 and NTLM. These mechanisms send credentials encrypted but their verification process requires the password to be available in plaintext. Consequently passwords cannot (!) be stored in encrypted form.<\/span><\/pre>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">It seems fairly conclusive to me that I was never going to get this to work and have failed to do so tinkering with a multitude of settings and configurations (cleartext passwords, MD5 encrypted passwords, encrypted passwords etc..) to date. Now I&#8217;ve decided to omit the step below, move on to the section &#8220;Configuring encryption&#8221; and have altered \/etc\/postfix\/sasl\/smtpd.conf so that&#8230;<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">mech_list: plain login cram-md5 digest-md5<\/span><\/pre>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">now looks like&#8230;<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">mech_list: plain login<\/span><\/pre>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">The section from Flurdy&#8217;s guide is included for consistency and completeness.<\/span><\/p>\n<\/blockquote>\n<h4 style=\"text-align: justify;\">IMAP SASL \/ Courier<\/h4>\n<p style=\"text-align: justify;\">I tend not to have SASL for my courier authentication, as I enforce TLS for all my clients. However, if you have a more lenient access policy (which is wise if you have many users), then you may want SASL in Courier as well.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/courier\/imapd<\/pre>\n<p style=\"text-align: justify;\">This is available as a commented out line. Uncomment it or replace the current line by adding <strong>AUTH=CRAM-MD5 AUTH=CRAM-SHA1<\/strong> so it resembles something like this on one line.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966; padding-left: 30px;\">IMAP_CAPABILITY=\"IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA AUTH=CRAM-MD5 AUTH=CRAM-SHA1 IDLE\"sudo \/etc\/init.d\/courier-authdaemon restart;<\/span>\r\n\r\nsudo \/etc\/init.d\/courier-imap restart<\/pre>\n<h3 style=\"text-align: justify;\">Configuring encryption<\/h3>\n<h4 style=\"text-align: justify;\">Notes on TLS<\/h4>\n<p style=\"text-align: justify;\">Encrypting the traffic stops anyone else from listening in on your email communications, which is very desirable. There are different types of communication that need to be encrypted:<\/p>\n<ol>\n<li>The data traffic between your email applications and the server when you read (or send) emails.<\/li>\n<li>Communication between other email servers and your server.<\/li>\n<\/ol>\n<p style=\"text-align: justify;\">For the encryption of reading emails, it is Courier you need to configure. For sending and the &#8220;between server&#8221; communication encryption, it&#8217;s Postfix we change.<\/p>\n<h4 style=\"text-align: justify;\">TLS in Postfix<\/h4>\n<p style=\"text-align: justify;\">To encrypt you need a certificate. As I&#8217;ve mentioned in the section above, Ubuntu creates some for you for which you can use while setting up the server. However before you go live, it is recommended to create your own with your proper domain name. In the examples below we will refer to the fictitious certificates created above.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/main.cf<\/pre>\n<p style=\"text-align: justify;\">There are already some TLS settings in the default Debian\/Ubuntu version of this file. I amalgamated them and moved them to the beginning for clarity, but that&#8217;s up to you.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #c0c0c0;\"># TLS parameters<\/span>\r\n<span style=\"color: #c0c0c0;\">#smtp_use_tls = no<\/span>\r\n<span style=\"color: #339966;\">smtp_tls_security_level = may<\/span>\r\n<span style=\"color: #c0c0c0;\">#smtpd_use_tls=yes<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_security_level = may<\/span>\r\n<span style=\"color: #c0c0c0;\">#smtpd_tls_auth_only = no<\/span>\r\n<span style=\"color: #339966;\">smtp_tls_note_starttls_offer = yes<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_loglevel = 1<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_received_header = yes<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_session_cache_timeout = 3600s<\/span>\r\n<span style=\"color: #339966;\">tls_random_source = dev:\/dev\/urandom<\/span>\r\n<span style=\"color: #c0c0c0;\"># The original references to the system cert and key.<\/span>\r\n<span style=\"color: #c0c0c0;\"># smtpd_tls_cert_file=\/etc\/ssl\/certs\/ssl-cert-snakeoil.pem<\/span>\r\n<span style=\"color: #c0c0c0;\"># smtpd_tls_key_file=\/etc\/ssl\/private\/ssl-cert-snakeoil.key<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_cert_file=\/etc\/ssl\/certs\/smtp.example.com.pem<\/span>\r\n<span style=\"color: #339966;\">smtpd_tls_key_file=\/etc\/ssl\/private\/smtp.example.com.key<\/span>\r\n<span style=\"color: #c0c0c0;\">#smtpd_tls_session_cache_database = btree:${data_directory}\/smtpd_scache<\/span>\r\n<span style=\"color: #c0c0c0;\">#smtp_tls_session_cache_database = btree:${data_directory}\/smtp_scache<\/span><\/pre>\n<p style=\"text-align: justify;\">Next we edit the <em>master.cf<\/em> file.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/postfix\/master.cf<\/pre>\n<p style=\"text-align: justify;\">By default, only the normal smtp service is enabled, which is fine. It&#8217;s preferable to enable submission (port 587), so that clients can use it, and I can restrict them to TLS only. Also enabled is the smtps service (port 465), for some compatibility with some older clients (Outlook Express etc&#8230;)<\/p>\n<pre><span style=\"color: #339966;\">submission inet n       -       n       -       -       smtpd\r\n  -o smtpd_sasl_auth_enable=yes\r\n<span style=\"color: #c0c0c0;\"># if you do not want to restrict it encryption only, comment out next line<\/span>\r\n  -o smtpd_tls_auth_only=yes\r\n<span style=\"color: #c0c0c0;\"># -o smtpd_tls_security_level=encrypt\r\n# -o header_checks=\r\n# -o body_checks=<\/span>\r\n  -o smtpd_client_restrictions=permit_sasl_authenticated,reject_unauth_destination,reject\r\n  -o smtpd_sasl_security_options=noanonymous,noplaintext\r\n  -o smtpd_sasl_tls_security_options=noanonymous\r\n<span style=\"color: #c0c0c0;\"># -o milter_macro_daemon_name=ORIGINATING<\/span>\r\nsmtps     inet  n       -       -       -       -       smtpd\r\n  -o smtpd_tls_wrappermode=yes\r\n  -o smtpd_sasl_auth_enable=yes \r\n  -o smtpd_tls_auth_only=yes\r\n  -o smtpd_client_restrictions=permit_sasl_authenticated,reject\r\n  -o smtpd_sasl_security_options=noanonymous,noplaintext\r\n  -o smtpd_sasl_tls_security_options=noanonymous\r\n<span style=\"color: #c0c0c0;\"># -o milter_macro_daemon_name=ORIGINATING<\/span><\/span><\/pre>\n<h4>TLS in Courier<\/h4>\n<p style=\"text-align: justify;\">As mentioned previously, Ubuntu has created a certificate for you, but if you want to create your own, especially for a properly named server, then follow the steps in the section SSL Certificates above.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/courier\/imapd-ssl<\/pre>\n<p style=\"text-align: justify;\">By default Ubuntu already points to your certificate file&#8230;<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">TLS_CERTFILE=\/etc\/courier\/imapd.pem<\/span><\/pre>\n<p style=\"text-align: justify;\">&#8230;modify this if needed.<\/p>\n<p style=\"text-align: justify;\">Also you if want to restrict IMAP users to only using SSL\/TLS, toggle the following setting to &#8220;1&#8221;.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">IMAP_TLS_REQUIRED=<strong>1<\/strong><\/span><\/pre>\n<p style=\"text-align: justify;\">To maintain maximum compatibility it is not wise or recommended to restrict the traffic between servers to TLS only, as this means some of the valid emails sent by others may not reach your server.<\/p>\n<p style=\"text-align: justify;\">Be aware that the emails are not encrypted on your machine, nor on the server.<\/p>\n<p style=\"text-align: justify;\">There are some situations where SASL and TLS do not play well together. Those situations are normally when you combine the storing of encrypted passwords and using MD5 authentication over encrypted traffic. I (read:flurdy) recommend insisting on TLS traffic with your authenticating clients, which then negates the need for SASL.<\/p>\n<h2 id=\"roundcube-webmail\">Stage Four: Roundcube webmail client<\/h2>\n<h3>Installing Roundcube<\/h3>\n<p style=\"text-align: justify;\">As an alternative to SquirrelMail, Roundcube has a more modern feel to it. It doesn&#8217;t have the proven track record of SquirrelMail and is still not quite a version &#8220;1.0&#8221; release (<del>0.4<\/del> <del>0.5<\/del> <del>0.6<\/del> <del>0.7<\/del> 0.9.5 was the latest release at the time this was written).<\/p>\n<p style=\"text-align: justify;\">However if you prefer a more appealing interface (and design is everything for me!) then follow these easy steps to get it up and running.<\/p>\n<p style=\"text-align: justify;\">If you&#8217;ve already installed it and want to remove SquirrelMail, then<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude remove squirrelmail squirrelmail-locales<\/pre>\n<p style=\"text-align: justify;\">Then install Roundcube (if you didn&#8217;t do so already in the &#8220;Packages&#8221; section).<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install roundcube roundcube-mysql<\/pre>\n<p style=\"text-align: justify;\">During the install it will ask you if you want to configure database access automatically. Answer <strong>Yes<\/strong>, then select MySQL as the database. You will then be prompted for the root MySQL password. This script will create the relevant database. tables and a Roundcube MySQL user. You will be prompted for a password for this new user.<\/p>\n<p style=\"text-align: justify;\">The install will create a symblink in <strong>\/etc\/apache2\/conf.d\/<\/strong> to <strong>\/etc\/roundcube\/apache.conf<\/strong>. Edit this file&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/roundcube\/apache.conf<\/pre>\n<p style=\"text-align: justify;\">Depending on your setup you may want to move those <em>Alias <\/em>commands to the top to your virtual hosts configuration, or for this example enable them here for all hosts.<\/p>\n<pre><span style=\"color: #339966;\">Alias \/roundcube\/program\/js\/tiny_mce\/ \/usr\/share\/tinymce\/www\/<\/span>\r\n<span style=\"color: #339966;\">Alias \/roundcube \/var\/lib\/roundcube<\/span><\/pre>\n<p style=\"text-align: justify;\">Roundcube uses PEAR, which is a framework and distribution system for reusable PHP components. Assuming your system is up-to-date, it might pay to make sure PEAR is also.<\/p>\n<pre style=\"text-align: justify;\">sudo pear channel-update pear.php.net<\/pre>\n<p style=\"text-align: justify;\">&#8230;and make sure the MDB2 module is up to date.<\/p>\n<pre style=\"text-align: justify;\">sudo pear install mdb2<\/pre>\n<p style=\"text-align: justify;\">Now edit the Roundcube configuration file.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/roundcube\/main.inc.php<\/pre>\n<p style=\"text-align: justify;\">Modify the following lines for added security\/support of SASL\/TLS (see informational note below)&#8230;<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">$rcmail_config['default_host'] = 'ssl:\/\/localhost:993';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_server'] = 'ssl:\/\/localhost';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_port'] = 465;<\/span><\/pre>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong><strong>NOTE<\/strong>:<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">I deviated from &#8220;Flurdy&#8217;s&#8221; guide at this point as I had problems logging in until tweaked the following (based on the debug of messages in <strong>\/var\/log\/syslog<\/strong>)<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">$rcmail_config['smtp_user'] = '<strong>%u<\/strong>';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_pass'] = '<strong>%p<\/strong>';<\/span><\/pre>\n<p style=\"text-align: justify;\">\n<\/blockquote>\n<p style=\"text-align: justify;\">Update the following to enable some default features. Note: for &#8220;<strong>smtp_helo_host<\/strong>&#8221; you can keep as the default value or change to your mail server name.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">$rcmail_config['smtp_helo_host'] = '<strong>mail.example.com<\/strong>';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['language'] = 'en_GB';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['product_name'] = '<strong>[<em>your organisation name<\/em>]<\/strong> RoundCube Webmail';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['default_imap_folders'] = array('INBOX', 'Drafts', '<strong>Read<\/strong>', 'Sent', 'Junk', 'Trash');<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['create_default_folders'] = TRUE;<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['preview_pane'] = TRUE;<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['logout_purge'] = TRUE;<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['logout_expunge'] = TRUE;<\/span><\/pre>\n<p style=\"text-align: justify;\">There are other tweaks and security features you can enable such as&#8230;<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">$rcmail_config['sendmail_delay'] = <strong>1<\/strong>;<\/span><\/pre>\n<blockquote>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\"><strong><strong>NOTE<\/strong>:<\/strong><\/span><\/p>\n<p style=\"text-align: left;\"><span style=\"color: #ff6600;\">If you&#8217;re configuring Roundcube prior to having setup SASL\/TLS (detailed under the &#8220;Secure&#8221; section above) then you&#8217;ll need to use the following settings until you do:<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">$rcmail_config['default_host'] = '<strong>localhost<\/strong>';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_server'] = '<strong>localhost<\/strong>';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_port'] = <strong>25<\/strong>;<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_user'] = '';<\/span>\r\n<span style=\"color: #339966;\">$rcmail_config['smtp_pass'] = '';<\/span><\/pre>\n<\/blockquote>\n<p style=\"text-align: justify;\">Lastly we&#8217;ll add support for the default time of the server&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/usr\/share\/roundcube\/.htaccess<\/pre>\n<p style=\"text-align: justify;\">&#8230;by adding this parameter. Note: Of course you substitude &#8220;<strong>Pacific\/Auckland<\/strong>&#8221; with your own time zone.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\">php_value date.timezone \"Pacific\/Auckland\"<\/span><\/pre>\n<p style=\"text-align: justify;\">You can find a list of valid timezones <a href=\"http:\/\/www.php.net\/manual\/en\/timezones.php\">here<\/a> at the PHP website.<\/p>\n<p style=\"text-align: justify;\">A lot of these tweaks are personal preference, but as an advisory it might pay to get the basics working first before playing with the settings too much! When you&#8217;re finished save and restart the apache process to enable changes.<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/apache2 reload<\/pre>\n<p style=\"text-align: justify;\">Go to any web browser and point it to your Roundcube installation. Normally it&#8217;s <strong>http:\/\/<em>mail.example.com<\/em>\/roundcube<\/strong> by default.<\/p>\n<p style=\"text-align: justify;\">You can obviously modify and tweak further. One thing that may be useful is to have the Roundcube Apache Alias on different virtual hosts and configure <em>username_domain<\/em> in <strong>main.inc.php<\/strong> to append different email addresses, or configure the <em>default_host<\/em> to a different mail server depending on the virtual host&#8230;<\/p>\n<p style=\"text-align: justify;\">More details on the <a href=\"http:\/\/trac.roundcube\/wiki\/\">Roundcube<\/a> wiki.<\/p>\n<h4 style=\"text-align: justify;\">Configuring HTTPS (If you want it?)<\/h4>\n<p style=\"text-align: justify;\">The <strong>mod_ssl<\/strong> module adds an important feature to the Apache2 server &#8211; the ability to encrypt communications. So, when your browser is communicating using SSL, the <strong>https:\/\/<\/strong> prefix is used at the beginning of the Uniform Resource Locator (URL) in the browser navigation bar.<\/p>\n<p style=\"text-align: justify;\">The mod_ssl module is available in the apache2-common package. Execute the following command from a terminal prompt to enable the mod_ssl module.<\/p>\n<pre style=\"text-align: justify;\">sudo a2enmod ssl<\/pre>\n<p style=\"text-align: justify;\">The default HTTPS configuration file is <strong>\/etc\/apache2\/sites-available\/default-ssl<\/strong>. In order for Apache2 to provide HTTPS, a certificate and key file are also needed. The default HTTPS configuration will use a certificate and key generated by the ssl-cert package.<\/p>\n<p style=\"text-align: justify;\">They are good for testing, but the auto-generated certificate and key should be replaced by a certificate specific to the site or server. For information on generating a key and obtaining a certificate see the section Secure \u00bb SSL Certificates of this HOWTO or refer to Ubuntu&#8217;s documentation in the section called \u201cCertificates\u201d<\/p>\n<p style=\"text-align: justify;\">To configure Apache2 for HTTPS, enter the following command.<\/p>\n<pre style=\"text-align: justify;\">sudo a2ensite default-ssl\r\nsudo vi \/etc\/apache2\/sites-available\/default-ssl\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">SSLCertificateFile \/etc\/ssl\/certs\/<strong>&lt;<em>your certificate file name<\/em>&gt;.pem<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">SSLCertificateKeyFile \/etc\/ssl\/private\/<strong>&lt;<em>your key file name<\/em>&gt;.key<\/strong><\/span><\/pre>\n<blockquote><p><span style=\"color: #ff6600;\"><strong><strong>NOTE<\/strong>:<\/strong><\/span><\/p>\n<p><span style=\"color: #ff6600;\">The directories <strong>\/etc\/ssl\/certs<\/strong> and <strong>\/etc\/ssl\/private<\/strong> are the default locations. If you install the certificate and key in another directory make sure to change <em>SSLCertificateFile<\/em> and <em>SSLCertificateKeyFile<\/em> appropriately.<\/span><\/p><\/blockquote>\n<p style=\"text-align: justify;\">Then restart Apache&#8230;<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/apache2 restart<\/pre>\n<p style=\"text-align: justify;\">You can access the secure server pages by typing <strong>https:\/\/<em>your_hostname<\/em>\/url\/<\/strong> in your browser&#8217;s address bar.<\/p>\n<h2 id=\"a1-adding-data\">Appendix One: Adding data to the server<\/h2>\n<h3 style=\"text-align: justify;\">Add users and domains<\/h3>\n<p style=\"text-align: justify;\">Alright, so you finally got your mail server installed and you want to test it&#8230; BUT there&#8217;s no users or domains! Nada!! OK, to kick things off you need to add some default data, some of which is required and most which should make sense.<\/p>\n<p style=\"text-align: justify;\">After that, we need to start adding your users and associated mail domains. Then you should be ready to start testing, or if you&#8217;ve done the testing&#8230; roll the server into production!<\/p>\n<h4 style=\"text-align: justify;\">Base domain and user<\/h4>\n<p style=\"text-align: justify;\">First the required domain for local mail.<\/p>\n<pre style=\"text-align: justify;\">mysql -u mail -p maildb<\/pre>\n<p style=\"text-align: justify;\">Insert the domain information:<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> domains (domain) <strong>VALUES<\/strong> ('localhost'), ('localhost.localdomain');<\/span><\/pre>\n<p style=\"text-align: justify;\">Then the default aliases. Some people say these are not needed, but I recommend including them.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('<strong>postmaster<\/strong>@localhost','<strong>root<\/strong>@localhost'), ('<strong>sysadmin<\/strong>@localhost','<strong>root<\/strong>@localhost'), ('<strong>webmaster<\/strong>@localhost','<strong>root<\/strong>@localhost'), ('<strong>abuse<\/strong>@localhost','<strong>root<\/strong>@localhost'), ('<strong>root<\/strong>@localhost','<strong>root<\/strong>@localhost'), ('<strong>@localhost<\/strong>','<strong>root<\/strong>@localhost'), ('<strong>@localhost.localdomain<\/strong>','@localhost');<\/span><\/pre>\n<p style=\"text-align: justify;\">It&#8217;s worth noting at this point, that this &#8220;set&#8221; of aliases is common across each domain i.e. <strong>postmaster<\/strong>,<strong>abuse<\/strong> and if you like <strong>sysadmin<\/strong> or <strong>admin<\/strong>.<\/p>\n<p style=\"text-align: justify;\">Now we create a &#8220;<strong>root<\/strong>&#8221; user.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> users (id,name,maildir,crypt) <strong>VALUES<\/strong> ('root@localhost','root','root\/', encrypt('apassword') );<\/span><\/pre>\n<h4 style=\"text-align: justify;\">Domains and users<\/h4>\n<p style=\"text-align: justify;\">It&#8217;s at this point that we add some proper data. In this example we&#8217;ll say you want this machine to handle data for the fictional domains of &#8220;<strong>blobber.org<\/strong>&#8221; and &#8220;<strong>whopper.nu<\/strong>&#8220;.<\/p>\n<p style=\"text-align: justify;\">We will refer to this machine&#8217;s name as &#8220;<strong>mail.blobber.org<\/strong>&#8220;.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> domains (domain) <strong>VALUES<\/strong> ('blobber.org'), ('mail.blobber.org'), ('whopper.nu');<\/span>\r\n<span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('@mail.blobber.org','@blobber.org'), ('postmaster@whopper.nu','postmaster@localhost'), ('abuse@whopper.nu','abuse@localhost'), ('postmaster@blobber.org','postmaster@localhost'), ('abuse@blobber.org','abuse@localhost');<\/span><\/pre>\n<p style=\"text-align: justify;\">Having created the domains and aliases we now add names for two users called &#8220;<em>Fred<\/em>&#8221; and &#8220;<em>Wilma<\/em>&#8220;.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> users (id,name,maildir,crypt) <strong>VALUES<\/strong> ('<strong><em>fred<\/em><\/strong>@blobber.org','Fred Flintsone','fredflinstone\/', encrypt('<em>apassword<\/em>') ), ('<em><strong>wilma<\/strong><\/em>@blobber.org','Wilma Fintstone','wilmaflinstone\/', encrypt('<em>anotherpassword<\/em>') );<\/span>\r\n<span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('<em><strong>fred<\/strong><\/em>@blobber.org','<em><strong>fred<\/strong><\/em>@blobber.org'), ('<em><strong>wilma<\/strong><\/em>@blobber.org','<em><strong>wilma<\/strong><\/em>@blobber.org');<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Adding tweaks to the basic users<\/h5>\n<p style=\"text-align: justify;\">If you want <span style=\"text-decoration: underline;\"><strong>all<\/strong><\/span> the mail for <strong>whooper.nu<\/strong> to go to Fred (i.e. <strong><em>*<\/em>@whooper.nu<\/strong>).<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('@whopper.nu','<em><strong>fred<\/strong><\/em>@blobber.org');<\/span><\/pre>\n<p style=\"text-align: justify;\">Say there is a user called &#8220;<em>Pebbles<\/em>&#8220;, but she wants all her mail forwarded to an external account.<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('pebbles@blobber.org','pebbles.flintstone@gmail.com');<\/span><\/pre>\n<p style=\"text-align: justify;\">So what do each of these lines above actually do? Well the domain entries are pretty straight forward. So too are the lines relating to the users, however it&#8217;s worth noting here that each entry requires the following four fields to be included.<\/p>\n<ul>\n<li><strong>id<\/strong> is the email address of the user, and also its username when logging in. This is described later on.<\/li>\n<li><strong>name<\/strong> is optional description or &#8220;full name&#8221; of the user.<\/li>\n<li><strong>maildir<\/strong> is the name of the folder inside \/var\/spool\/mail\/virtual. It MUST end in a \/, otherwise it won&#8217;t be used as the unix maildir format.<\/li>\n<li><strong>crypt<\/strong> is the encrypted text password to use.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The aliases are the interesting part. Lets track an incoming message to see how it&#8217;s delivered.<\/p>\n<p style=\"text-align: justify;\">Say an email arrives addressed to &#8220;<strong>john@whopper.nu<\/strong>&#8220;:<\/p>\n<ol>\n<li>Postfix looks up the <strong><em>domains<\/em> <\/strong>table and locates <em>whopper.nu<\/em> as a domain it listens to.<\/li>\n<li>Postfix then looks up <em><strong>aliases<\/strong> <\/em>and searches for a row where the mail field matches &#8220;<em>john@whopper.nu<\/em>&#8220;.<\/li>\n<li>There is <span style=\"text-decoration: underline;\">no match<\/span>, so it searches for &#8220;<em>@whopper.nu<\/em>&#8220;, which is the &#8220;catchall&#8221; for that domain.<\/li>\n<li>Postfix then finds one row and its destination is &#8220;<em>fred@blobber.org<\/em>&#8220;.<\/li>\n<li>It then searches for &#8220;<em>fred@blobber.org<\/em>&#8221; and finds an entry, which has a destination that is the same as the mail and therefore it is the <span style=\"text-decoration: underline;\">final destination<\/span>.<\/li>\n<li>It then tries to deliver this mail. The look up says <strong>blobber.org<\/strong> is a local mail domain so it looks up users for a matching id and delivers it to its <em>maildir<\/em>.<\/li>\n<\/ol>\n<p style=\"text-align: justify;\">Any mail arriving for &#8220;<em>pebbles@blobber.org<\/em>&#8221; gets forwarded to the external address of &#8220;<em>pebbles.flintstone@gmail.com<\/em>&#8220;. So forwarding is as simple as adding a line into the <em><strong>aliases<\/strong> <\/em>table.<\/p>\n<p style=\"text-align: justify;\">I also added the required aliases of <strong>postmaster<\/strong> and <strong>abuse<\/strong> to <em>blobber.org<\/em> and <em>whopper.nu<\/em>. Another useful alias to add is <strong>root<\/strong>, as often you get admin mail from cron jobs etc within those domains. Other often used aliases are <strong>info<\/strong>, <strong>sysadmin<\/strong>, <strong>support<\/strong>, <strong>sales<\/strong>, <strong>webmaster<\/strong>, <strong>mail<\/strong>, <strong>contact<\/strong> and <strong>all<\/strong>. The problem with creating all of them is that they are also <span style=\"text-decoration: underline;\">honeypots for spam<\/span>, so just include the ones you think you will need.<\/p>\n<h4 style=\"text-align: justify;\">Adding domains, users and aliases using a template<\/h4>\n<p style=\"text-align: justify;\">To add a new domain to the system you use this command in MySQL, replacing the values in italics with data relevant to you:<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> domains (<em>domain<\/em>) <strong>VALUES<\/strong> ('<em>domain.tld<\/em>');\r\n<strong>INSERT INTO<\/strong> aliases (mail,destination) <strong>VALUES<\/strong> ('@<em>domain.tld<\/em>','email@address'), ('postmaster@<em>domain.tld<\/em>','email@address'), ('abuse@<em>domain.tld<\/em>','email@address');<\/span><\/pre>\n<p style=\"text-align: justify;\">To add a new user to the system:<\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> users (id,name,maildir,crypt) <strong>VALUES<\/strong> ('<em>email@address<\/em>','<em>short description<\/em>','<em>foldername<\/em>\/',encrypt('<em>password<\/em>'));<\/span>\r\n<span style=\"color: #339966;\"><strong>INSERT INTO<\/strong> aliases (mail,destination) VALUES ('<em>email@address<\/em>','<em>email@address<\/em>');<\/span><\/pre>\n<h3 style=\"text-align: justify;\">Common SQL statements<\/h3>\n<p style=\"text-align: justify;\">A selection of useful SQL statements to use if you are not using an admin\/manager program to maintain your email domains and users.<\/p>\n<h5 style=\"text-align: justify;\">Find domains without a &#8220;catchall&#8221;<\/h5>\n<p style=\"text-align: justify;\"><span style=\"color: #ff0000;\">Remember some might be disabled!!<\/span><\/p>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>SELECT<\/strong> dom.domain <strong>FROM<\/strong> domains dom <strong>LEFT JOIN<\/strong> aliases al <strong>ON CONCAT<\/strong>( '@', dom.domain ) = al.mail <strong>WHERE<\/strong> al.mail is null <strong>OR<\/strong> al.enabled = 0 <strong>ORDER BY<\/strong> dom.domain <strong>ASC<\/strong>;<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Find aliases for an invalid domain<\/h5>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>SELECT<\/strong> al.* <strong>FROM<\/strong> aliases al <strong>LEFT JOIN<\/strong> domains dom <strong>ON<\/strong> dom.domain = <strong>SUBSTRING<\/strong>(al.mail,<strong>LOCATE<\/strong>('@',al.mail)+1) <strong>WHERE<\/strong> dom.domain is null <strong>OR<\/strong> dom.enabled = 0 <strong>ORDER BY<\/strong> al.mail <strong>ASC<\/strong>;<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Find all non local destination aliases<\/h5>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>SELECT<\/strong> al.* <strong>FROM<\/strong> aliases al <strong>LEFT JOIN<\/strong> domains dom <strong>ON<\/strong> dom.domain = <strong>SUBSTRING<\/strong>(al.destination,<strong>LOCATE<\/strong>('@',al.destination)+1) <strong>WHERE<\/strong> dom.domain is null <strong>ORDER BY<\/strong> al.enabled, al.destination <strong>ASC<\/strong>, al.mail <strong>ASC<\/strong>;<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Find all aliases for a certain domain<\/h5>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>SELECT<\/strong> al.* <strong>FROM<\/strong> aliases al <strong>WHERE<\/strong> <strong>SUBSTRING<\/strong>(al.mail,<strong>LOCATE<\/strong>('@',al.mail)+1) = '<em>domain.tld<\/em>' <strong>ORDER BY<\/strong> al.enabled, al.mail <strong>ASC<\/strong>;<\/span><\/pre>\n<h5 style=\"text-align: justify;\">Find all aliases for a certain domain, checking if enabled for both domain and alias<\/h5>\n<pre style=\"text-align: justify;\"><span style=\"color: #339966;\"><strong>SELECT<\/strong> * <strong>FROM<\/strong> domains d <strong>JOIN<\/strong> aliases a <strong>ON<\/strong> a.mail like concat( '%','@',d.domain) <strong>AND<\/strong> a.enabled = 1 <strong>WHERE<\/strong> d.enabled = 1 <strong>AND<\/strong> d.domain like '%<em>foobar<\/em>%' <strong>ORDER BY<\/strong> d.domain,a.mail;<\/span><\/pre>\n<h2 id=\"a1-adding-data\">Appendix Two: Testing the server<\/h2>\n<h3>Common problems<\/h3>\n<ul>\n<li>\n<h4>Missed a step?<\/h4>\n<p>If you mistakenly or intentionally skipped past sections, you may have missed an important step in your configuration, which this guide presumes you have followed.<\/li>\n<li>\n<h4>Typo!<\/h4>\n<p>99% of all problems is spelling errors or typos you entered while following this guide. Sorry, but it just happens. Often it can be trivial, such as a space at the end of the configuration line which was not expected etc. Or not understanding my example where it is a multi line entry.<\/li>\n<li>\n<h4>Typo in he documentation.<\/h4>\n<p>Yes, I (read: flurdy) can make mistakes. Nothing wrong in that, but I hope I have corrected most over time after each proof read. However, any new sections to this guide are potentially at risk&#8230; \u263a<\/li>\n<li>\n<h4>Different application or configuration.<\/h4>\n<p>It is obviously entirely up to you how you set up your system. But the more you deviate from this guide, the more likely incompatibilities or confusion will arise.<\/li>\n<li>\n<h4>Distribution\/version differences.<\/h4>\n<p>If you run a different version or even distribution to this guide, then some things will be different. Small issues, such as default values and significant things such as path differences etc. Some sections in this guide are not always thoroughly tested with every new release of Ubuntu, but these differences get pointed out by people for me.<\/li>\n<li>\n<h4>Walking before crawling.<\/h4>\n<p>Don&#8217;t try the full blown mail server before the basics are working.<\/li>\n<li>\n<h4>Gamma rays and little goblins!<\/h4>\n<p>Because we&#8217;ve got to blame it on something&#8230; right? \ud83d\ude09<\/li>\n<\/ul>\n<h3>Test strategy<\/h3>\n<h4>Test early and frequently<\/h4>\n<p style=\"text-align: justify;\">It is very helpful to test early in this set-up to establish if the first sections are working as expected. So when you only have your very basic Postfix and MySQL up and running &#8211; TEST IT! That way you know that certain step worked and you can rule it out of any future problems. Don&#8217;t wait until you complicated the install by adding additional features like AMAVIS, SASL, Postgrey etc&#8230;<\/p>\n<p style=\"text-align: justify;\">By constantly testing if you can send and receive you can tick off and black box each section as working, and immediately spot issues.<\/p>\n<h4>Isolate the problem!<\/h4>\n<p style=\"text-align: justify;\">Testing how things work is often about isolating the problem first. So by using the steps of testing early above, you can see which step caused the problem. Also if you can&#8217;t log into your webmail it is often nothing to do with the webmail section that is causing the problem. Often postfix itself is broken&#8230;<\/p>\n<h4>Test in order<\/h4>\n<p style=\"text-align: justify;\">As part of the isolating the problem step it&#8217;s a good idea to test steps in order, thus isolating the problem. This would then quickly indicate where the problem might lie. e.g. In the example relating to webmail access, the order of testing might go:<\/p>\n<ol>\n<li><strong>Access<\/strong>: Can I get (SSH) access to the box, and is there a firewall issue?<\/li>\n<li><strong>Database<\/strong>: Is the database up, can my applications talk to it?<\/li>\n<li><strong>Postfix<\/strong>: Can I send an email by command line (telnet)? Can I receive emails via telnet?<\/li>\n<li><strong>Content checks<\/strong>: Is the content of my message causing a problem?<\/li>\n<li><strong>Courier<\/strong>: Can I read emails?<\/li>\n<li><strong>Webmail<\/strong>: Does the web integration work?<\/li>\n<\/ol>\n<h4>Simplify the system<\/h4>\n<p style=\"text-align: justify;\">Assisting in isolating the problem, you often have to disable options and applications. An example might be to turn off Postgrey or the content checks to make sure emails to get delivered.<\/p>\n<h3>Get out the toolbox&#8230; MXToolbox that is<\/h3>\n<p style=\"text-align: justify;\">One website I found invaluable for testing my server from the &#8220;outside&#8221; was <a href=\"http:\/\/www.mxtoolbox.com\/\">MXToolbox<\/a>. You can use it to lookup\/check your MX records, run SMTP tests to the server, check for open ports&#8230; and (hopefully never) check if your server has been blacklisted!<\/p>\n<p style=\"text-align: justify;\">It&#8217;s probably really widely known by those in the &#8220;mail&#8221; support field, but I stumbled across it trying to troubleshot why a colleague&#8217;s emails were getting bounced when he tried to send them to us. The support guy on the phone told me to use MXToolbox to check if the server had been blacklisted and follow it up from there as there was nothing they could do. Lo-and-behold, his server was blacklisted on one of the many &#8220;blacklist reference servers&#8221; used by our ISP (and others). I can&#8217;t stop using it now, it&#8217;s a great site&#8230;<\/p>\n<h3>Tail, tail and tail again<\/h3>\n<p style=\"text-align: justify;\">It&#8217;s essential to monitor what actually happens, and tailing (specifically the mail and mysql log) is key in tracking down problems. The following are most commonly referred to when troubleshooting:<\/p>\n<ul>\n<li>\/var\/log\/syslog<\/li>\n<li>\/var\/log\/mail.log<\/li>\n<li>\/var\/log\/mysql.log<\/li>\n<li>\/var\/log\/apache2\/access.log<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">You could have multiple windows open &#8220;tailing&#8221; the log files and changing the configuration in a third.<\/p>\n<pre>tail -f \/var\/log\/<strong>mail.log<\/strong>\r\ntail -f \/var\/log\/<strong>mysql.log<\/strong><\/pre>\n<h3>Switch debugging on<\/h3>\n<h4>Shorewall<\/h4>\n<p style=\"text-align: justify;\">You can also switch on more messages for when the firewall is rejecting connections. Add info to all REJECT, BOUNCE and DROP policies.<\/p>\n<pre>sudo vi \/etc\/shorewall\/policy\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">Net\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 all\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 info<\/span><\/pre>\n<h4>MySQL<\/h4>\n<p style=\"text-align: justify;\">There is no point in tailing the mysql log if query debugging is not turned one. By default it is not. However in this guide I do switch it on. In case that was missed switch it on now:<\/p>\n<pre>sudo vi \/etc\/mysql\/my.cnf<\/pre>\n<p>and make sure this line is not commented out.<\/p>\n<pre><span style=\"color: #339966;\">log = \/var\/log\/mysql\/mysql.log<\/span><\/pre>\n<h4>Courier<\/h4>\n<p>As mentioned in the setup , switching on debugging for Courier is easy:<\/p>\n<pre>sudo vi \/etc\/courier\/authdaemonrc\r\n<span style=\"color: #339966; padding-left: 30px;\">DEBUG_LOGIN=<strong>2<\/strong><\/span><\/pre>\n<blockquote><p><span style=\"color: #ff6600;\"><strong>WARNING<\/strong>:<\/span><\/p>\n<p><span style=\"color: #ff6600;\">With this setting passwords logged in syslog will be in clear text!<\/span><\/p><\/blockquote>\n<h4>AMAVIS<\/h4>\n<p>You can also debug AMAVIS:<\/p>\n<pre>sudo vi \/etc\/amavis\/conf.d\/<strong>50-user<\/strong><\/pre>\n<p>And perhaps bump up the log level if you are already debugging:<\/p>\n<pre><span style=\"color: #339966;\">$log_level = 2;<\/span><\/pre>\n<h3>Telnet is your friend!<\/h3>\n<p style=\"text-align: justify;\">When testing a mail server, telnet is alpha &amp; omega. You use it to simulate another mail server in order to test responses by your mail server.<\/p>\n<ol>\n<li>First you test it on the server to rule out firewall and network issues.<\/li>\n<li>Then you test it from another machine to simulate another mail server trying to communicate.<\/li>\n<li>Once these are working you can use a proper email client, however in 99% of cases I just use MUTT locally when I need to test if a server is working.<\/li>\n<\/ol>\n<h4>Can Postfix receive?<\/h4>\n<p>Lets assume:<\/p>\n<ul>\n<li>You have followed the guide up to &#8220;Basic&#8221; configuration at the very least.<\/li>\n<li>You have entered data into the database (see previous section).<\/li>\n<li>The services MySQL and Postfix are running.<\/li>\n<li>If testing a fuller stack, then amavis, postgrey, clamav-daemon, spamassassin etc must also be running.<\/li>\n<\/ul>\n<p>Try this locally on the server first, then try from another machine once you confirm it works locally.<\/p>\n<p>Lets try and send a message to <em><strong>fred@example.org<\/strong><\/em> (replace with your own user in this setup, or use <strong>postmaster@localhost<\/strong>) from <em><strong>you@example.com<\/strong><\/em> (again, replace with a real email address that is not associated with this server).<\/p>\n<pre><span style=\"color: #0000ff;\">telnet localhost 25<\/span>\r\n<span style=\"color: #c0c0c0;\"> # Open and hand shake with EHLO and the server name you are connecting from. <\/span><span style=\"color: #c0c0c0;\">Change <strong><em>mail.example.com<\/em><\/strong> to something valid. e.g. your servername<\/span>\r\n<strong><span style=\"color: #0000ff;\"> EHLO <span style=\"color: #ff0000;\"><em>mail.example.com<\/em><\/span><\/span><\/strong>\r\n<span style=\"color: #c0c0c0;\"> # The mail server will then dump out some details about its capabilities, e.g.<\/span>\r\n<span style=\"color: #0000ff;\"> &gt; 250-mail.flurdy.net<\/span>\r\n<span style=\"color: #0000ff;\"> &gt; 250-PIPELINING<\/span>\r\n<span style=\"color: #0000ff;\"> &gt; ...<\/span>\r\n<span style=\"color: #0000ff;\"> &gt; ...<\/span>\r\n<span style=\"color: #c0c0c0;\"> # then say who is the sender of this email<\/span>\r\n<strong><span style=\"color: #0000ff;\"> MAIL FROM: <span style=\"color: #ff0000;\"><em>your@example.com<\/em><\/span><\/span><\/strong>\r\n<span style=\"color: #0000ff;\"> &gt; 250 Ok<\/span>\r\n<span style=\"color: #c0c0c0;\"> # then say who the mail is for...<\/span>\r\n<strong><span style=\"color: #0000ff;\"> RCPT TO: <span style=\"color: #ff0000;\"><em>fred@example.org<\/em><\/span><\/span><\/strong>\r\n<span style=\"color: #0000ff;\"> &gt; 250 Ok<\/span>\r\n<span style=\"color: #c0c0c0;\"> # then enter the keyword <strong>data<\/strong><\/span>\r\n<strong><span style=\"color: #0000ff;\"> data<\/span><\/strong>\r\n<span style=\"color: #0000ff;\"> &gt; 354 End data with &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;<\/span>\r\n<span style=\"color: #c0c0c0;\"> # enter message body and end with a line with only a full stop then enter.<\/span>\r\n<strong><span style=\"color: #0000ff;\"> blah blah blah<\/span><\/strong>\r\n<strong><span style=\"color: #0000ff;\"> more blah<\/span><\/strong>\r\n<strong><span style=\"color: #0000ff;\"> .<\/span><\/strong>\r\n<span style=\"color: #0000ff;\"> &gt; 250 Ok; queued as QWKJDKASAS<\/span>\r\n<span style=\"color: #c0c0c0;\"> # end the connection with quit<\/span>\r\n <strong><span style=\"color: #0000ff;\">quit<\/span><\/strong>\r\n<span style=\"color: #0000ff;\"> &gt; 221 BYE<\/span><\/pre>\n<p style=\"text-align: justify;\">If (while you were doing this) you were tailing <strong>\/var\/log\/mail.log<\/strong> you would (read: should) have seen some activity and whether any errors occurred. (You might get some complaints about missing headers as we skipped most of them&#8230;)<\/p>\n<p>If (while you were doing this) you were tailing <strong>\/var\/log\/mysql.log<\/strong> as well, you would definitely have seen some activity &#8211; if not you have a problem!<\/p>\n<p>If you see any errors (or worse no activity) in these log files, then this highlights what you need to fix! However, if no errors popped up, and the folder <strong>\/var\/mail\/virtual\/fred <\/strong>(or similar) now exists then your server can receive emails!<\/p>\n<h4>Can Postfix send?<\/h4>\n<p style=\"text-align: justify;\">You need to first make sure that receive emails (<em>as detailed above<\/em>) and the services MySQL and Postfix are running.<\/p>\n<p style=\"text-align: justify;\">Try this locally on the server first, then try from another machine once you confirm it works locally.<\/p>\n<pre><span style=\"color: #0000ff;\">telnet localhost 25\r\n <span style=\"color: #c0c0c0;\"># Open and hand shake with EHLO and the server name you are connecting from. Change <em>mail.example.com<\/em> to something valid. e.g. your servername<\/span>\r\n <strong>EHLO <span style=\"color: #ff0000;\"><em>mail.example.com<\/em><\/span><\/strong>\r\n <span style=\"color: #c0c0c0;\"># The mail server will then dump out some details about its capabilities, e.g.<\/span>\r\n &gt; 250-mail.flurdy.net\r\n &gt; 250-PIPELINING\r\n &gt; ...\r\n &gt; ...\r\n <span style=\"color: #c0c0c0;\"># then say who is the sender of this email<\/span>\r\n <strong>MAIL FROM: <span style=\"color: #ff0000;\"><em>fred@example.org<\/em><\/span><\/strong>\r\n &gt; 250 Ok\r\n <span style=\"color: #c0c0c0;\"># then say who the mail is for...<\/span>\r\n <strong>RCPT TO: <span style=\"color: #ff0000;\"><em>your@example.com<\/em><\/span><\/strong>\r\n &gt; 250 Ok\r\n <span style=\"color: #c0c0c0;\"># then enter the keyword <strong>data<\/strong><\/span>\r\n <strong>data<\/strong>\r\n &gt; 354 End data with &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;\r\n <span style=\"color: #c0c0c0;\"># enter message body and end with a line with only a full stop then enter.<\/span>\r\n<strong> blah blah blah<\/strong>\r\n<strong> more blah<\/strong>\r\n<strong> .<\/strong>\r\n &gt; 250 Ok; queued as QWKJDKASAS\r\n <span style=\"color: #c0c0c0;\"># end the connection with quit<\/span>\r\n <strong>quit<\/strong>\r\n &gt; 221 BYE<\/span><\/pre>\n<p style=\"text-align: justify;\">We have to assume (I know what they say about assuming) that receiving works so there is no ned to tail the MySQL log. However, if any rejection messages occurred in the mail.log then you need to troubleshoot it to resolution.<\/p>\n<p style=\"text-align: justify;\">If no errors occurred and you see something in the <strong>mail.log<\/strong> that looks like this:<\/p>\n<pre>Dec 17 10:25:45 servername postfix\/smtp[12345]: 12345678: to=&lt;<strong>you@example.com<\/strong>&gt;, relay=127.0.0.1[127.0.0.1]:10024, delay=15, delays=15\/0.01\/0.02\/0.11, dsn=2.0.0, status=<strong>sent<\/strong> (250 2.0.0 Ok, id=12345-09, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 1234567)<\/pre>\n<p>then the sending of emails is working perfectly!<\/p>\n<h4>Can Courier read emails?<\/h4>\n<ul>\n<li>You need to first make sure that you can receive emails (as detailed above).<\/li>\n<li>You need to make sure that you can send emails (as detailed above).<\/li>\n<li>You need to make sure you have received an email by checking that the folder <strong>\/var\/mail\/virtual\/<span style=\"color: #808080;\"><em>username<\/em> <\/span><\/strong>exists.<\/li>\n<li>The MySQL, courier-authdaemon and courier-imap services are all running.<\/li>\n<\/ul>\n<p>There is not too much you can test via telnet for courier. But you can check if it is up and that you can connect to it.<\/p>\n<pre><span style=\"color: #0000ff;\"><strong>telnet 127.0.0.1 143<\/strong>\r\n Trying 127.0.0.1...\r\n Connected to 127.0.0.1. Escape character is '^]'.\r\n * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS LOGINDISABLED] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc. See COPYING for distribution information<\/span><\/pre>\n<p>For more in depth testing, you would have to use a proper IMAP email client.<\/p>\n<h4>Can AMAVIS check and pass on emails?<\/h4>\n<ul>\n<li style=\"text-align: justify;\">You need to first make sure that you can receive emails (as detailed above).<\/li>\n<li style=\"text-align: justify;\">You need to make sure that you can send emails (as detailed above).<\/li>\n<li style=\"text-align: justify;\">You need to make sure you have received an email by checking that the folder\u00a0<strong>\/var\/mail\/virtual\/<span style=\"color: #808080;\"><em>username<\/em> <\/span><\/strong> exists.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">All you can do here is check to make sure that the service is responding.<\/p>\n<pre><span style=\"color: #0000ff;\"><strong>telnet 127.0.0.1 10024<\/strong>\r\n Trying 127.0.0.1...\r\n Connected to 127.0.0.1.\r\n Escape character is '^]'.\r\n 220 [127.0.0.1] ESMTP amavisd-new service ready<\/span><\/pre>\n<p>then tail <strong>\/var\/log\/mail.log<\/strong> and see if there are any problems.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction. Background. I had already build a VoIP system using CentOS (another Unix-like OS) as a base with trixbox CE providing the VoIP telephony. It was a fun project and for all the same reasons I wanted to do something similar for our messaging. I naturally (or some may argue un-naturally) started thinking about Microsoft&#8230;  <a class=\"excerpt-read-more\" href=\"https:\/\/templesoft.co.nz\/journal\/?p=17\" title=\"Read Setting up a mail server using Postfix on Ubuntu 10.04\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[25,35,48,28,23,40,24,37,44,42,34,47,45,46,22,39,21,26,32,41,29,36,43,27,31,30,19,20,33,38],"class_list":["post-17","post","type-post","status-publish","format-standard","hentry","category-technical-resource","tag-amavisd-new","tag-aptitude","tag-authdaemonrc","tag-clamav","tag-courier-imap","tag-hosts","tag-imap","tag-mail","tag-main-cf","tag-mta","tag-multiverse","tag-my-cnf","tag-mydomain","tag-myhostname","tag-mysql","tag-phpmyadmin","tag-postfix","tag-postgrey","tag-roundcube","tag-rules","tag-sasl","tag-shorewall","tag-smtp","tag-spamassassin","tag-ssl","tag-tls","tag-ubuntu","tag-ubuntu-10-04-lts","tag-universe","tag-virtual"],"_links":{"self":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17"}],"version-history":[{"count":35,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":155,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions\/155"}],"wp:attachment":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}