[gentoo:postfix_-_sasl_tls_-_mailscanner_-_dbmail]
 
Trace: » dbmail_git » add-user-sql » new_page » limits » migrating_from_qmail_vpopmail_sql » daemonize » exporting_dbmail_users_to_maildir_format._ver_1.x » mailing_lists » archiving-howto » postfix_-_sasl_tls_-_mailscanner_-_dbmail

Author: Matthew J. Salerno

For Gentoo Linux: http://www.gentoo.org - but generic enough for most.

This has been in the planning for quite some time, but I just recently got the time and equipment to get it started. Here are my notes so far. I do not cover every step along this process, most of these programs come with well written README or INSTALL files that should not be overlooked. I am very new to postfix, so if anyone spots somthing that should be changed, please post it.

This is without a doubt the easiest virtual mail server I have ever setup.

postfix→MailScanner→postfix→DBMail

Minimum recommended use flags: sasl mysql pam apache2 innodb ssl postfix crypt

If you updated any of your use flags, try the following command to see what might need to be rebuild with the new libraries # emerge -N world –deep -pv

Here are the packages I am currently using:

  • mail-filter/spamassassin 3.0.2-r1
  • mail-filter/razor 2.61
  • dev-python/pyzor 0.4.0-r1
  • mail-filter/dcc 1.2.28-r1
  • app-antivirus/clamav 0.83
  • mail-mta/postfix 2.1.5-r2
  • dev-db/mysql 4.0.24

You have the option to use either just use SASL or SASL with pam_mysql. Completely your option.

If you choose just to use sasl, then you will need to emerge dev-libs/cyrus-sasl >= 2.1.20-r2

Which is currently masked. I just used:

ACCEPT_KEYWORDS=”~x86” emerge -v cyrus-sasl

If you don't want to emerge a masked package and you want to go the other route, then you will need

  • dev-libs/cyrus-sasl 2.1.20
  • sys-libs/pam_mysql 0.5

I used the MailScanner ebuild from http://bugs.gentoo.org/show_bug.cgi?id=36060 I know that there is a dbmail ebuild, but I built it from source - http://www.dbmail.org/

I configured postfix to run in the chroot'd env by executing: /usr/share/doc/postfix-2.1.5-r2/examples/chroot-setup/LINUX2

I also had to change the following line in the master.cf

smtp inet n - - - - smtpd

All I did was replace the second “n” with a ”-”. This tells postfix to run in a chroot.

I got postfix working before I made any of the following changes. Mail in and out with no problems. The postfix website http://www.postfix.org/documentation.html has lots of great documentation. If you are new to postfix, like me, I strongly recommend going through the docs.

Next, I setup MailScanner. Make sure postfix is in your use flags! I put it in my portage_overlay, and emerg'd it. Currently, it setups up 2 init scripts, MailScanner and MailScanner-mta. Due to my configuration, I don't start the MailScanner-mta service and I comment out MailScanner-mta in the /etc/init.d/MailScanner: 

depend() {
       need net # MailScanner-mta
       after postfix
       use logger dns
}

In the /etc/MailScanner/MailScanner.conf, I only changed some basic settings. (setting the Queue paths is required!): There are many more options to set, but I just wanted to get things working first. Many of those options are just set so that I know that MailScanner is working. Read through the file, it is well commented. 

Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
Always Include SpamAssassin Report = yes
Sign Clean Messages = yes
Use SpamAssassin = yes

/etc/mail/spamassassin/local.cf: 

rewrite_header Subject *****SPAM*****
bayes_sql_override_username     "global"
bayes_store_module              Mail::SpamAssassin::BayesStore::SQL
bayes_sql_dsn                   DBI:mysql:spamassassin:localhost
bayes_sql_username              bayesdb
bayes_sql_password              mypassword
use_bayes 1
use_bayes_rules 1
bayes_auto_learn 1
required_hits 5.5
report_safe 2
use_terse_report 1
dns_available yes
skip_rbl_checks 1
use_razor2 1
use_pyzor 1
use_dcc 1
ok_languages all
ok_locales all

For spamassassin, I imported my old bayes_db into my SQL database and could check connectivity by just executing: sa-learn –dump magic -D

At this point, you should be able to start postfix and mailscanner.

/etc/init.d/postfix start
/etc/init.d/MailScanner start

Send an e-mail to an external account

# echo Test | mutt me@foo.yahoo.com

When you receive the e-mail, check the headers for MailScanner entries.

In order to get SASL w/ TLS working with the chroot'd Postfix, I added the following lines to my /etc/fstab:

/var/lib/sasl2 /var/spool/postfix/var/lib/sasl2 bind bind 0 0
/var/run/mysqld /var/spool/postfix/var/run/mysqld bind bind 0 0

Of course I created the /var/spool/postfix/var/lib/sasl2 and the /var/spool/postfix/var/run/mysqld directories first

I also generated my own certs using: 

 
cd /etc/ssl/misc/ 
perl CA.pl -newca 
perl CA.pl -newreq 
perl CA.pl -sign

And then copying them to /etc/postfix/ssl/

These lines will allow postfix to access the mysql and sasl sockets from the chroot.

For my master.cf, I added the below line under the line for smtp:

dbmail-lmtp unix - - n - - lmtp

This is to tell postfix to hand the mail over to dbmail.

Current main.cf 

 
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_owner = postfix

sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /etc/postfix
readme_directory = /usr/share/doc/postfix-2.1.5-r2/readme

debug_peer_level = 2
debug_peer_list = 127.0.0.1
debugger_command =
        PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
        xxgdb $daemon_directory/$process_name $process_id & sleep 5

# SASL
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes

# TLS
smtpd_tls_auth_only = yes
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/postfix/ssl/ozone.key
smtpd_tls_cert_file = /etc/postfix/ssl/ozone.crt
smtpd_tls_CAfile = /etc/postfix/ssl/ozone.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

mynetworks_style = subnet
mynetworks = 127.0.0.0/8

alias_database = hash:/etc/mail/aliases
alias_maps = hash:/etc/mail/aliases

# Server
header_checks = regexp:/etc/postfix/header_checks

myhostname = foo.bar
mydomain = foo.bar
myorigin = $mydomain
mydestination = localhost, foo.bar

unknown_local_recipient_reject_code = 550


virtual_transport = dbmail-lmtp:localhost:24
virtual_mailbox_domains = mysql:/etc/postfix/virtual-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/virtual_aliases.cf mysql:/etc/postfix/valiasdom.cf

smtpd_recipient_restrictions =  reject_invalid_hostname, reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unauth_pipelining, reject_unknown_recipient_domain, reject_unknown_sender_domain, permit_mx_backup, permit_mynetworks, permit_sasl_authenticated, check_relay_domains, permit

/etc/postfix/header_checks: 

/^Received:/ HOLD

/etc/postfix/virtual-domains.cf: 

user = dbmail
password = password
dbname = dbmail
table = dbmail_vdomains
select_field = domain
where_field = domain

/etc/postfix/virtual_aliases.cf: 

user = dbmail
password = password
hosts = localhost
dbname = dbmail
table = dbmail_aliases
select_field = alias
where_field = alias

/etc/postfix/valiasdom.cf: 

user = dbmail
password = password
dbname = dbmail
table = dbmail_vdomains
select_field = concat( '@', pridomain )
where_field = concat( '@', domain )
additional_conditions = and pridomain is not NULL

Table structure for table 'dbmail_vdomains'

Field Type Null Key Default Extra
id int(7) PRI NULL auto_increment
domain varchar(40) UNI
comment varchar(40) YES NULL
pridomain varchar(40) YES NULL 
id      domain                 comment                       pridomain 
1       foo.com                Primary domain                NULL 
2       bar.com                Another domain                foo.com

SQL to create table 'dbmail_vdomains': 

DROP TABLE IF EXISTS `dbmail_vdomains`; 
CREATE TABLE IF NOT EXISTS `dbmail_vdomains` ( 
  `id` int(7) NOT NULL auto_increment, 
  `domain` varchar(40) NOT NULL default '', 
  `comment` varchar(40) default NULL, 
  `pridomain` varchar(40) default NULL, 
  PRIMARY KEY  (`id`), 
  UNIQUE KEY `domain` (`domain`), 
) TYPE=InnoDB AUTO_INCREMENT=1 ;

Then you can populate the table with:

For Primary domain:

INSERT INTO `dbmail_vdomains` (`domain`, `comment`, `pridomain`) VALUES(“pridom.com”, “Primary Domain”, NULL);

For Secondary domain:

INSERT INTO `dbmail_vdomains` (`domain`, `comment`, `pridomain`) VALUES(“secdom.com”, “Primary Domain”, “pridom.com);

Download the DBMail source and unpack it. Read through the README and INSTALL and the INSTALL.postfix for better instructions. You will need to copy the given dbmail.conf to /etc/ and make some changes. The only changes I made were for the database connection.

/etc/dbmail.conf: 

[DBMAIL] 
host=localhost 
sqlport=3306 
sqlsocket=/var/run/mysqld/mysqld.sock 
user=dbmail 
pass=mypassword 
db=dbmail 
POSTMASTER=postmaster@foo.com 
TRACE_LEVEL=1 

[SMTP] 
SENDMAIL=/usr/sbin/sendmail 
AUTO_NOTIFY=no 
AUTO_REPLY=no 
TRACE_LEVEL=1 

[LMTP] 
EFFECTIVE_USER=nobody 
EFFECTIVE_GROUP=nogroup 
BINDIP=127.0.0.1 
                          
PORT=24 
NCHILDREN=20 
MAXCHILDREN=15 
MINSPARECHILDREN=2 
MAXSPARECHILDREN=4 
MAXCONNECTS=10000 
TIMEOUT=300 
RESOLVE_IP=yes 
TRACE_LEVEL=1 
MAX_ERRORS=500 

[POP] 
EFFECTIVE_USER=nobody 
EFFECTIVE_GROUP=nogroup 
BINDIP=* 
PORT=110 
NCHILDREN=30 
MAXCHILDREN=200 
MINSPARECHILDREN=2 
MAXSPARECHILDREN=4 
MAXCONNECTS=10000 
TIMEOUT=300 
RESOLVE_IP=yes 
POP_BEFORE_SMTP=no 
TRACE_LEVEL=1 

[IMAP] 
EFFECTIVE_USER=nobody 
EFFECTIVE_GROUP=nogroup 
BINDIP=* 
PORT=143 
NCHILDREN=5 
MAXCHILDREN=100 
MINSPARECHILDREN=2 
MAXSPARECHILDREN=4 
MAXCONNECTS=10000 
TIMEOUT=4000 
RESOLVE_IP=yes 
IMAP_BEFORE_SMTP=no 
TRACE_LEVEL=1

I got the init scripts from the ebuild

/etc/conf.d/saslauthd: 

SASLAUTHD_OPTS="" 
SASLAUTHD_OPTS="${SASLAUTH_MECH} -a pam -r"

<Just SASL> If you plan on using just SASL: This will allow you to authenticate your through your SMTP server using: crypt, plaintext, md5 /etc/sasl2/smtpd.conf: 

pwcheck_method: auxprop 
auxprop_plugin: sql 
allowanonymouslogin: no 
allowplaintext: yes 
mech_list: PLAIN LOGIN 
srp_mda: md5 
srvtab: /dev/null 
opiekeys: /dev/null 
password_format: crypt 
sql_user: dbmail 
sql_passwd: mypassword 
sql_hostnames: localhost 
sql_database: dbmail 
sql_select: SELECT passwd FROM dbmail_users WHERE userid = '%u@%r' 
log_level: 10 
sql_verbose: yes

</Just SASL>

<SASL with pam_mysql> If you plan on using SASL with pam_mysql: /etc/pam.d/smtp: This will allow you to authenticate your through your SMTP server using: crypt, plaintext, md5 Watch out for the line wrap. When you create the smtp file, there should only be 2 lines. 

auth    sufficient      pam_mysql.so user=dbmail passwd=password host=127.0.0.1 db=dbmail table=dbmail_users usercolumn=userid passwdcolumn=passwd crypt=1 

account required        pam_mysql.so user=dbmail passwd=password host=127.0.0.1 db=dbmail table=sbmail_users usercolumn=userid passwdcolumn=passwd crypt=1

/etc/sasl2/smtpd.conf: 

pwcheck_method:saslauthd 
mech_list: plain login

</SASL with pam_mysql>

/etc/init.d/dbmail-lmtpd: 

#!/sbin/runscript
#
# chkconfig: - 91 35
# description: Starts and stops the dbmail-lmtpd daemon
#

PROGRAM=dbmail-lmtpd 
BIN_DIR=/usr/local/sbin 

PID_DIR=/var/run 
PID=pid 

# Where is the dbmail.conf file located? 
CONFIG=/etc/dbmail.conf 

# opts="${opts} reload" 

depend() { 
        need net 
        # This won't cause a hard failure if neither is installed, however. 
        use mysql 
        after mysql mta 
} 

initService() { 
    # Avoid using root's TMPDIR 
    unset TMPDIR 

    # Check that config file exists. 
    [ -f $CONFIG ] || exit 0 

    RETVAL=0 
} 

start() { 
        initService 
        ebegin "Starting DBMail LMTP daemon ($PROGRAM)" 
            start-stop-daemon --start --quiet \ 
              --pidfile $PID_DIR/$PROGRAM.$PID \ 
              --exec $BIN_DIR/$PROGRAM \ 
              --name $PROGRAM \ 
              -- -f $CONFIG -p $PID_DIR/$PROGRAM.$PID 2>&1 
        eend $? 
} 

stop() { 
        initService 
        ebegin "Stopping DBMail LMTP daemon ($PROGRAM)" 
            start-stop-daemon --stop --quiet --retry 5 \ 
              --pidfile $PID_DIR/$PROGRAM.$PID 
        eend $? 
}

/etc/init.d/dbmail-pop3d: 

#!/sbin/runscript
#
# chkconfig: - 91 35
# description: Starts and stops the dbmail-pop3d daemon
#

PROGRAM=dbmail-pop3d 
BIN_DIR=/usr/local/sbin 

PID_DIR=/var/run 
PID=pid 

# Where is the dbmail.conf file located? 
CONFIG=/etc/dbmail.conf 

# opts="${opts} reload" 

depend() { 
        need net 
        # This won't cause a hard failure if neither is installed, however. 
        use mysql 
        use pgsql 
        after mta 
} 

initService() { 
    # Avoid using root's TMPDIR 
    unset TMPDIR 

    # Check that config file exists. 
    [ -f $CONFIG ] || exit 0 

    RETVAL=0 
} 

start() { 
        initService 
        ebegin "Starting DBMail POP3 daemon ($PROGRAM)" 
            start-stop-daemon --start --quiet \ 
              --pidfile $PID_DIR/$PROGRAM.$PID \ 
              --exec $BIN_DIR/$PROGRAM \ 
              --name $PROGRAM \ 
              -- -f $CONFIG -p $PID_DIR/$PROGRAM.$PID 2>&1 
        eend $? 
} 

stop() { 
        initService 
        ebegin "Stopping DBMail POP3 daemon ($PROGRAM)" 
            start-stop-daemon --stop --quiet --retry 5 \ 
              --pidfile $PID_DIR/$PROGRAM.$PID 
        eend $? 
}

/etc/init.d/dbmail-imapd: 

#!/sbin/runscript
#
# chkconfig: - 91 35
# description: Starts and stops the dbmail-imapd daemon
#

PROGRAM=dbmail-imapd 
BIN_DIR=/usr/local/sbin 

PID_DIR=/var/run 
PID=pid 

# Where is the dbmail.conf file located? 
CONFIG=/etc/dbmail.conf 

# opts="${opts} reload" 

depend() { 
        need net 
        # This won't cause a hard failure if neither is installed, however. 
        use mysql 
        use pgsql 
        after mta 
} 

initService() { 
    # Avoid using root's TMPDIR 
    unset TMPDIR 

    # Check that config file exists. 
    [ -f $CONFIG ] || exit 0 

    RETVAL=0 
} 

start() { 
        initService 
        ebegin "Starting DBMail IMAP daemon ($PROGRAM)" 
            start-stop-daemon --start --quiet \ 
              --pidfile $PID_DIR/$PROGRAM.$PID \ 
              --exec $BIN_DIR/$PROGRAM \ 
              --name $PROGRAM \ 
              -- -f $CONFIG -p $PID_DIR/$PROGRAM.$PID 2>&1 
        eend $? 
} 

stop() { 
        initService 
        ebegin "Stopping DBMail IMAP daemon ($PROGRAM)" 
            start-stop-daemon --stop --quiet --retry 5 \ 
              --pidfile $PID_DIR/$PROGRAM.$PID 
        eend $? 
}

Currently with this setup, my mail server is working great. Now all I have to do is setup mysql to listen on an external ip address, setup another server with almost the same settings, setup sql replication and I should have some pretty reliable and redundant mail servers. Of course the switchover won't be automatic, yet…

Good luck

Readers note, perhaps this would be better served by an email to the author; but im a bit lazy tonight – kerpal2343 at domain yahoo.com – The primary and seconday domain portion I feel is a bitt off from a default setup, as its not in the database and I am a DBMA web user (more so, im setting up the system to be so for a client). I could not tell from this article how this affects the system, im left to assume that this allows one to have a postmaster@organization.com mapped to an organization.net address or silly.com address by default.. let me know if I am fool with this thought. If not.. umm please add a description up there – End –

今晩、誰か泊めてくれませんか〜ぉ礼はするょ^^どこに住んでるか教えてね(*´Д｀*)ノシchoco0315@softbank.ne.jp 一晩限りの恋人契約で高額報酬 http://ok.w3vr.cn セフレを探してるんです。love1224hhh@softbank.ne.jpです。必ずお返事します♪待ってるょ 割り切りお付き合いで大金を稼いでみませんか http://ok.rwhvtw.cn 家出をして不安な少女 http://ok.w3yn.cn モテる度を無料診断、モテる度チェッカー http://ok.sey3n78.cn 手軽にお金稼ぎが出来るサイト http://ok.urmi6.cn ネットカフェに寝泊まりしてる子に安息の時間と場所を提供しませんか http://ok.e35n5.cn 女性のオナニーを見るだけで高収入のお仕事 http://ok.w63n5.cn 最近ネット始めたsoraでぇす♪もしよければ誰かお友達になってくださぁい mikumiku_0430@yahoo.co.jp 女性にメールやチャットをして癒してあげるだけで儲かる新感覚のアルバイト http://ok.rgw35u.cn 家出少女のHなお礼 http://ok.46mn.cn あなたのエッチ度を無料チェック http://ok.g3w08.cn 彼女たちを癒して大金を儲ける事も可能です http://ok.dhgq2.cn Ｈメールや普通に遊んでくれる人募集中なんでいつでもメールしてね(*^-^) nanako_l0oo0l@docomo.ne.jp 時給2万円〜の高額アルバイト、出張ホスト http://ok.bbrba4.cn 割り切ったアルバイト感覚で稼げる逆援バイト http://ok.dhvaw874.cn 一晩のお付き合いで大金を稼げるのが素人ホスト http://ok.gh2048g.cn 家出をして生活が不安な少女を囲ってみませんか？ http://ok.ghq34g.cn あなたの隠された性癖がわかる えっちチェッカー http://ok.h824.cn 高級セレブたちとの出会いの場を提供しております http://ok.fh9823g.cn 時間がなくて恋がまったくできません（＞c＜）22歳にして欲求不満な私ですが、誰か絡んでください！ lioil_celebration@docomo.ne.jp 大好評の逆ナンパ出会いイベントがなんと毎週開催決定！ http://www.deai-megami.net/ GW特別企画今だけ天皇賞・春の鉄板激アツ情報を配信中！ http://www.aveureka.org/ 新しい出会いと大金を儲けることが可能です http://see.jk98r.cn 家出少女が泊まるところを探して家出サイトに集まっています http://see.3rg3.cn カワイイあの子をエッチ診断してそのままHしちゃおう！ http://see.gh384g.cn 女性のオナニーを見るだけで大金を得ることが出来てしまうのです http://see.fg83q4.cn 少しの時間だけでもいいのでお話しませんか？kyun—v0v-iine@docomo.ne.jp 容姿や年齢、経験は一切不問！期間限定恋人がほしい方はこのサイト！ http://see.34yq34y.cn ゲーマーチェッカーであなたのゲーマー度数を測定しよう http://see.g3qgb.cn/ 癒してほしいセレブ達が集まる、セレブラブ http://see.gfh45.cn 家出娘のメッセージが多数書き込みされています http://see.he456j.cn HちぇっくでH度を測定しちゃおう http://see.jetnbg.cn 話題の逆円助サイトで女を抱いて報酬をもらおう http://see.3g3wj.cn 簡単に家出少女と会えちゃう掲示板 http://see.berbn45.cn あなたも不貞行為の刺激を試してみませんか http://see.j7kek.cn SM度をチェックして最高のパートナーをGETしよう http://see.5hw3.cn 簡単な登録制のバイトで好きな時に稼げます http://see.6j46j.cn 誰か割り切りでアタシを満足させてもらえませんか？ c.dior_l-3-l_la.al@docomo.ne.jp チェッカーサイトで一番人気、Hチェッカー http://see.2qev2.cn 誰か割り切りでアタシを満足させてもらえませんか？ c.dior_l-3-l_la.al@docomo.ne.jp 誰も試したことの無いような一人エッチで快楽を楽しもう http://see.34g46h.cn mixiでの楽しい思い出を再び感じたい方はコチラ http://mixi.050522o.net/ 毎日投稿ムービーが更新されている人気SNSはここ http://nice.k56hy.cn 誰か割り切りでアタシを満足させてもらえませんかlo3ol_jv.vj_favorite-cartier@docomo.ne.jp

 
gentoo/postfix_-_sasl_tls_-_mailscanner_-_dbmail.txt · Last modified: 2009/05/22 04:20 (external edit)