1 AUTHOR: Jim Gifford <lfs-hints@jg555.com>
5 LICENSE: GNU Free Documentation License Version 1.2
7 SYNOPSIS: Howto setup a complete email system.
9 DESCRIPTION: This hint will show you how to completly set
10 up an email system under LFS
12 PREREQUISITES: Files listed in hint must be downloaded
16 Introduction to Complete Email
18 This hint will help you configure a complete email system. One that supports
19 IMAP and POP3 requests. It will also filter SPAM and remove harmfull HTML code
20 from messages. This is a very long hint, but in order to get everything to work
21 you must follow all steps.
26 Download location http://www.postfix.org
30 Download location http://www.procmail.org
33 Program Name Courier Imap
34 Download location http://www.courier-mta.org
37 Program Name Avmailgate
38 Download location http://www.hbedv.com
42 Download location http://ssl.usu.edu/paul/gotmail
45 Program Name Fetchmail
46 Download location http://www.tuxedo.org/~esr/fetchmail
49 Program Name Anomy Mail Sanitzer
50 Download location http://mailtools.anomy.net
53 Program Name Spam Assassin
54 Download location http://www.spamassassin.org
58 Download location http://razor.sourceforge.net
61 Program Name Imap Filter
62 Download location http://imapfilter.hellug.gr
66 Download location http://fcron.free.fr
69 Program Name Berkeley DB
70 Download location http://www.sleepycat.com
74 Download location http://www.gnu.org/software/wget/wget.html
78 Download location http://omnibus.ruf.uni-freiburg.de/~gritter
82 Download location http://www.openssl.org
85 Program Name Pop-before-smtp
86 Download location http://www.trestle.com/unix/pop-before-smtp
90 Assumptions Made in this document
92 I have made the following assumptions in this document.
93 File have been downloaded.
95 Openssl is installed. Install information is located in this document also.
100 The complete mail system will not be functional until you have
101 completed all the steps. You can skip the steps that are optional,
104 DO NOT USE DB 4.1.25 IT DOES NOT WORK WITH THIS CONFIGURATION.
109 Before you can setup Postfix you will need to setup Berkeley DB.
113 To Compile Berekely DB you can use the following commands.
115 Change to the /usr/src/db-4.014/dist directory
116 In the directory issue the following commands
118 ./configure --prefix=/usr --enable-shared -- enable-compat185
119 make docdir=/usr/doc/BerkeleyDB-4 all install
121 This completes the Setup of Berkeley DB. You can remove the db-4.0.14
126 Before compiling postfix you will need to create a user and a group.
128 In /etc/passwd add : postfix:x:101:101::/dev/null:/bin/false
130 In /etc/group add : postfix:x:101: postdrop:x:102:
134 Change to /sr/src/postfix-1.1.11 directory
135 In the directory issue the following commands
139 Now if you have never installed Postfix before the next command you
140 will issue is the following command. You may want to look at the
141 configuration information beelow, it may help you answer some of
142 question that postfix will ask you.
146 If you have installed Postfix before the next command you will issue
147 is the following command
153 You will need to change postfix's configuration to work with the
154 courier-imap server. The configuration below is my working config. I
155 have added *** *** lines where changes are needed
157 Configuration File Main.cf - /etc/postfix/main.cf
159 queue_directory = /var/spool/postfix
160 command_directory = /usr/sbin
161 daemon_directory = /usr/libexec/postfix
163 myhostname = mail.server.com *** Change this to your mail server DNS Name ***
164 mydomain = server.com *** Change this to your domain name ***
166 inet_interfaces = all
167 mydestination = $myhostname, localhost.$mydomain, $mydomain,
168 mail.$mydomain, www.$mydomain, ftp.$mydomain
169 mynetworks_style = subnet
170 mynetworks = 192.168.0.0/24, 127.0.0.0/8 *** Change this to your Network IP -- Do not Change the 127.0.0.0/8 ***
171 relayhost = [ smtp.isp.com ] *** Change this to your ISP's smtp server ***
172 allow_percent_hack = yes
173 append_at_myorigin = yes
174 append_dot_mydomain = yes
175 empty_address_recipient = MAILER-DAEMON
176 masquerade_classes = envelope_sender, header_sender, header_recipient
177 masquerade_domains = server.com *** Change this to your domain name ***
178 masquerade_exceptions =
180 transport_maps = hash:/etc/postfix/transport
181 alias_maps = hash:/etc/postfix/aliases
182 alias_database = hash:/etc/postfix/aliases
183 home_mailbox = Maildir/
184 mail_spool_directory = /var/mail
185 mailbox_command = /usr/bin/procmail -d "$USER"
186 smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
189 PATH=/usr/bin:/usr/X11R6/bin
190 xxgdb $daemon_directory/$process_name $process_id & sleep 5
191 sendmail_path = /usr/sbin/sendmail
192 newaliases_path = /usr/bin/newaliases
193 mailq_path = /usr/bin/mailq
194 setgid_group = postdrop
195 manpage_directory = /usr/share/man
196 sample_directory = /etc/postfix/sample
197 readme_directory = no
198 content_filter = smtp:127.0.0.1:10024
199 maps_rbl_reject_code = 571
200 maps_rbl_domains = dynablock.wirehub.net, blackholes.wirehub.net, relays.ordb.org
201 smtpd_sender_restrictions = hash:/etc/postfix/access, reject_maps_rbl
203 Configuration File Master.cf - /etc/postfix/master.cf
205 Use the file that is in /etc/postfix directory and add the following
208 localhost:smtp-backdoor inet n - n - - smtpd -o content_filter=
210 Configuration File Aliases - /etc/postfix/aliases
212 You will need to configure the aliases file to your needs, the default
213 should be fine. The import thing to remember is after you make changes
214 to this file, you will need to run the newaliases command for that file
215 to be in effect. Important note: You will need to create a user for the
216 root email account. By using procmail we have disabled the root mail
217 account. I suggest the account name of admin. Add the following to your
222 Configuration File Transport - /etc/postfix/transport
224 This file is how every mail is handled by your domain. You will need to
225 change *** *** lines where changes are needed. The import thing to remember
226 is after you make changes to this file, you will need to run the postmap
227 /etc/postfix/transport command for that file to be in effect.
228 .server.com local: *** Change this to your domain name ***
231 Configuration File Access - /etc/postfix/spam_access_list
233 This file I made a cron event. If you have already installed FCRON or
234 another cron program all you need to do is run the following script.
235 This file is for a spam protection. At the end of this file I have
236 added a fcron and wget instructions. You will need to run this file
237 manually one time. This will create the first access file.
243 echo "Getting SPAM Access list..."
244 wget http://basic.wirehub.nl/spamlist-extended.txt
245 echo "Moving SPAM Access list to Postfix Directory..."
246 mv /tmp/spamlist-extended.txt /etc/postfix/access
247 echo "Enabling SPAM Access list in Postfix..."
248 postmap /etc/postfix/access
253 # Begin $rc_base/init.d/postfix
255 # Based on sysklogd script from LFS-3.1 and earlier.
256 # Rewritten by Gerard Beekmans - gerard@linuxfromscratch.org
258 source /etc/sysconfig/rc
263 echo "Starting Postfix..."
264 /usr/sbin/postfix start > /dev/null 2>&1
269 echo "Stopping Postfix..."
270 /usr/sbin/postfix stop > /dev/null 2>&1
275 echo "Reloading Posfix..."
276 /usr/sbin/postfix reload > /dev/null 2>&1
286 echo "Usage: $0 {start|stop|reload|restart}"
291 # End $rc_base/init.d/postfix
293 Runlevels - You will need to select the runlevel you want to run
294 postfix at. Use the the following command to achieve this. Change
295 the ?? to the # you want to use.
297 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc0.d/K??postfix
298 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc3.d/S??postfix
299 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc4.d/S??postfix
300 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc5.d/S??postfix
301 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc6.d/K??postfix
308 You will need to edit the autenticate.c file before compiling. This
309 will make procmail work with Maildir style mailboxes.
311 Change to the /usr/src/procmail-3.22/src directory
313 cp authenticate.c authenticate.c.backup
314 sed -e 's|#define MAILSPOOLHOME "/.mail"|#define MAILSPOOLHOME "/Maildir/"|g' \
315 authenticate.c.backup > authenticate.c
317 Change to the /usr/src/procmail-3.22 directory
318 echo "" | make BASENAME=/usr install
320 More information will be discussed in the Procmail Recipes section
327 Change to the /usr/src/courier-imap-1.4.6 directory
329 These commands need to be run by a user other than root.
331 ./configure --prefix=/usr/courier \
332 --sysconfdir=/etc/courier \
333 --with-piddir=/var/run \
336 --without-authuserdb \
337 --without-authmysql \
338 --enable-workarounds-for-imap-client-bugs
341 These commands need to be run by the root users
344 make install-configure
348 Configuration File - /etc/courier/imapd
350 Edit this file. The last line of the file has the following information in it.
356 If you also want a POP3 server edit - /etc/courier/pop3d
358 The last line of the file has the following information in it.
364 Configuration File - /etc/courier/authdaemonrc
366 Verify that the authmodulelist="authshadow"
370 cp /usr/courier/libexec/imapd.rc /etc/rc.d/init.d/courier-imap
371 cp /usr/courier/libexec/pop3d.rc /etc/rc.d/init.d/courier-pop3
373 Runlevels - You will need to select the runlevel you want to run
374 courier at. Use the following command to achieve this. Change the
375 ?? to the # you want to use.
377 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc0.d/K??courier-imap
378 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc3.d/S??courier-imap
379 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc4.d/S??courier-imap
380 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc5.d/S??courier-imap
381 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc6.d/K??courier-imap
383 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc0.d/K??courier-pop3
384 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc3.d/S??courier-pop3
385 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc4.d/S??courier-pop3
386 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc5.d/S??courier-pop3
387 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc6.d/K??courier-pop3
392 For security reasons this package cannot be compiled. This will give you
393 complete antivirus protection.
395 You can get a free license for this program. You apply for it at
396 http://www.antivir.de/order/privreg/order_e.htm
398 This will get you a key file.
402 Change to the /usr/src/avmailgate-2.0.0.6-Linux-glibc directory
406 This will ask you a series of questions. These questions relate to
407 you specific system setup.
412 This is an optional program that will pull mail from Hotmail.
416 Change to the /usr/src directory
418 mv gotmail-0.7.0 gotmail
421 mv *.1 /usr/share/man/man1
423 In the Cron section I will show you how to use this program.
428 This is an optional program that will pull mail from a POP3 server.
432 Change to the /usr/src/fetchmail-5.9.13 directory
434 ./configure --prefix=/usr \
435 --enable-fallback=procmail \
443 Config File - /~/fetchmail.rc
445 # Begin /~/.fetchmailrc
449 set logfile /var/log/fetchmail.log
451 # Get mail from ISP.com
458 is local_username here password local_password
460 # End /~/.fetchmailrc
462 In the Cron section I will show you how to use this program.
464 More information will be discussed in the Procmail Recipes section
471 Change to the /usr/src directory
478 # Configuration file for Anomy Sanitizer
481 # Do not log to STDERR:
484 # Don't insert log in the message itself:
487 # Advertisement to insert in each mail header:
488 header_info = X-Sanitizer: This mail was sanitized
492 # Enable filename based policy decisions:
495 # Protect against buffer overflows and null values:
498 # Replace MIME boundaries with our own:
501 # Fix invalid and ambiguous MIME boundaries, if possible:
504 # Trust signed and/or encrypted messages:
506 msg_pgp_warning = WARNING: Unsanitized content follows.\n
508 # Defang shell scripts:
511 # Defang active HTML:
514 # Defang UUEncoded files:
517 # Sanitize forwarded content too:
520 # Testing? Set to 1 for testing, 0 for production:
523 ## Warn user about unscanned parts, etc.
526 # Force all parts (except text/html parts) to
533 # Disable "score" based mail discarding:
537 msg_file_drop = \n*****\n
538 msg_file_drop += NOTE: An attachment named %FILENAME was deleted from
539 msg_file_drop += this message because was a windows executable.
540 msg_file_drop += Contact the system administrator for more information.
543 ## File attachment name mangling rules:
546 file_name_tpl = /var/quarantine/att-$F-$T.$$
548 # Number of rulesets we are defining:
550 file_default_policy = defang
552 # Delete probably nasty attachments:
553 file_list_1 = (?i)(winmail.dat)|
554 file_list_1 += (\.(vb[se]|exe|com|cab|dll|ocx|msi|cmd|bat|pif|lnk|hlp|ms[ip]|reg|asd))$
555 file_list_1_policy = drop
556 file_list_1_scanner = 0
558 # Allow known "safe" file types and those that can be
559 # scanned by the downstream virus scanner:
560 file_list_2 = (?i)\.(doc|dot|rtf|xls|ppt|xlw|jpg|gif|png|tiff?|txt|zip|tgz|gz)
561 file_list_2_policy = accept
562 file_list_2_scanner = 0
564 # Any attachment not listed above gets renamed.
566 More information will be discussed in the Procmail Recipes section
569 Spamassassin and Razor
571 Change to the /usr/src/razor-agents-2.14 directory
577 Change to the /usr/src/Mail-SpamAssassin-2.31 directory
585 /etc/mail/spamassassin/local.cf file you may need to specify email
586 addresses that are exempt from spam checking. Example to allow all
587 emails from joe@isp.com you would add the following line to the
590 whitelist_from joe@isp.com
595 I will be using the user admin as the example here. You will need to
596 do this for all the users that you want to give mail access to. If
597 you run this command as root you will need to change the file
598 permissions to the maildir manually, using the following chmod
599 utilizing 700 and chown user.user -R
601 Now we are getting to the actual mail directories. First you will
602 need to create a default mail directory.
604 maildirmake /home/admin/Maildir
606 This will create the main mail directory. Since we are also using
607 spam checking I would also create a Spam folder. Type it exactly
610 maildirmake /home/admin/Maildir/.Spam
615 The procmail recipe I use will sort the mail, sanitize, and spam
616 check all the emails that enter the system. This file will need
617 to be in all of the users home directory. Permissions on this
618 file must be set with the chmod utilizing 644.
622 # Begin /~/.procmailrc
626 MAILDIR=$HOME/Maildir/
629 LOGFILE=/var/log/procmailrc.log
635 * ^From:.*\<*@server.com> # Change server.com to your domain. This will bypass all
636 $DEFAULT # check if the mail is from the localdomain.
639 | /usr/anomy/bin/sanitizer.pl /usr/anomy/anomy.conf
646 * ^X-Spam-Status: Yes
649 # Accept all the rest to default mailbox
655 You can also have it sort email that come in from the gotmail and
656 fetchmail script. Here is a modified procmailrc file that will sort
657 emails from gotmail and fetchmail. You will have to issue an additonal
658 makemaildir command. Here is the command line for the examples I show.
660 maildirmake /home/admin/Maildir/.Hotmail
661 maildirmake /home/admin/Maildir/.isp
662 maildirmake /home/admin/Maildir/.isp2
664 After you have made the Maildir directories make sure that the user
665 that owns then is the same user that the mail is intended for. In
668 chown admin.admin /home/admin/Maildir -R
669 chmod 700 /home/admin/Maildir -R
673 # Begin /~/.procmailrc
677 MAILDIR=$HOME/Maildir/
680 LOGFILE=/var/log/procmailrc.log
686 * ^From:.*\<*@server.com> # Change server.com to your domain. This will bypass all
687 $DEFAULT # check if the mail is from the localdomain.
690 | /usr/anomy/bin/sanitizer.pl /usr/anomy/anomy.conf
697 * ^X-Spam-Status: Yes
701 * ^TO_user@hotmail.com
712 # Accept all the rest to default mailbox
721 This program will allow you to filter IMAP messages like procmail,
722 but that is not why I use it. It also allows you to delete emails
723 that are old. The imapfilterrc file must chmod with 700 and belong
724 to the user who's home dir it is in.
728 Change to the /usr/src/imapfilter-0.7.3 directory
730 cp Makefile Makefile.org
731 sed -e 's|/usr/local|/usr|g' \
732 Makefile.org > Makefile
738 The only catch to this configuration file is that it requires a
739 username and password. It lives in the home directory of the users.
740 This will only delete the messages older than 7 days from the Spam
741 folder only. It will not touch the INBOX
747 # Some program options, such as log file and non-response server timeout.
749 logfile = /var/log/imapfilter.log
754 ##########################
755 # Accounts and mailboxes #
756 ##########################
758 # Each account has a number of folders/mailboxes which are grouped under
759 # an alias name. Folders belong to the last preceding account. A mailbox
760 # can belong to many mailbox groups.
764 # Connects to "imap1.mail.server" at port 143, as "user1" and
765 # using password "secret1".
767 # Mailboxes that exist at "imap1.mail.server" include: "INBOX", "woody",
768 # "linux-mailist", etc. and are grouped in various ways.
770 account account1 username:password@mail.server.com:143
778 # Filters are completely independent from any account or folder settings.
779 # The mask command may be ommited. If no masks are declared inside
780 # a filter entry, then all messages are matched.
791 # Last, there is the definition of the jobs where user combines
792 # folders and filters _already_ defined, and specifies which filters
793 # should be applied to which folders.
801 This will give a basic setup for wget.
803 ./configure --prefix=/usr \
804 --sysconfdir=/etc/wget
808 Some users may need to change the #passive_ftp = off to passive_ftp = on
813 This will give a basic setup for nail. Do to the setup, this is only
814 used to send email and not to receive. Nail is not Maildir compatible.
815 You can use mutt or pine to read emails from a IMAP folder
817 ./configure --prefix=/usr \
818 --with-sendmail=/usr/sbin/sendmail
821 ln -sf /usr/bin/nail /usr/bin/mail
827 This will give a basic setup for fcron. Follow the fcron instruction
828 during the fcron installation process
832 ./configure --prefix=/usr \
834 --with-sendmail=/usr/sbin \
835 --with-piddir=/var/run \
836 --sysconfdir=/etc/fcron
840 Mail Related Cron Events
842 To update the spamlist use the following commands as root
846 add the following line
848 %hourly 01 /etc/postfix/spam_access_list
850 To use gotmail to get Hotmail and fetchmail to get other ISP's mail
854 add the following line
856 %hourly 02 /usr/gotmail/gotmail -u username -p password -f linuxusername@server.com --delete --silent
857 %hourly 03 /usr/bin/fetchmail
859 To use imapfilter to delete old messages
863 %nightly 00 01 /usr/bin/imapfilter
869 This will setup openssl to work with Courier and Fetchmail
871 Change to /usr/src/openssl-0.9.6d directory
873 ./config --prefix=/usr --openssldir=/etc/openssl shared
875 make MANDIR=/usr/man install
878 Optional program pop-before smtp
880 This program allow your remote users to send email from a remote
881 location. It allows this by capturing their current IP after they
882 have done a POP or IMAP transfer from courier. The IP only stays
883 active for a time that you have setup.
885 Here is the basic compile and configuration for pop-before-smtp
890 cp pop-before-smtp.conf pop-before-smtp.conf.org
891 sed -e 's|grace = 2h|grace = 30m|g' \
892 -e 's|log_file = /var/log/mail.log|log_file = /var/log/mail.log|g' \ # Change to your log file
893 pop-before-smtp.conf.org > pop-before-smtp.conf
894 rm -rf pop-before-smtp.conf.org
896 Now you will need to configure postfix to use the file
898 You will need to edit your main.cf file and add the following line
899 smtpd_recipient_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/pop-before-smtp, check_relay_domains
904 # Begin $rc_base/init.d/pop-before-smtp
906 # Based on sysklogd script from LFS-3.1 and earlier.
907 # Rewritten by Gerard Beekmans - gerard@linuxfromscratch.org
909 source /etc/sysconfig/rc
914 echo "Clearing POP Before SMTP File..."
915 rm -rf /etc/postfix/pop-before-smtp
917 echo "Starting POP Before SMTP..."
918 /usr/bin/pop-before-smtp &
923 echo "Stopping Pop Before SMTP..."
924 killproc /usr/bin/pop-before-smtp
938 echo "Usage: $0 {start|stop|restart|status}"
943 # End $rc_base/init.d/pop-before-smtp
946 Runlevels - You will need to select the runlevel you want to run
947 pop-before-smtp at. Use the following command to achieve this.
948 Change the ?? to the # you want to use.
950 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc0.d/K??pop-before-smtp
951 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc3.d/S??pop-before-smtp
952 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc4.d/S??pop-before-smtp
953 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc5.d/S??pop-before-smtp
954 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc6.d/K??pop-before-smtp
959 --- Outlook Express ---
961 If you are using Outlook Express Clients. Here is how you would
964 Setup an IMAP account. Follow the prompts until you get a message.
965 Would you like to Download folders from the mail server you added.
966 Click on NO. If you have not exited from the account creation screen
967 you can continue to the next step.
969 Then go to Tools -=> Accounts -=> Select the Account You just made -=> Properties
971 Go to the IMAP tab. In the Root folder path type INBOX.
973 --- Pine 4.10 or greater ---
975 Go to Pine's Main Menu. Select Setup then Configure. Go down to "inbox-path" setting
976 set it (hostname) INBOX
978 --- Netscape Messenger ---
980 Uncheck the opton Show only subscribed folders in the Advanced tab.
982 Under "Personal Namespace" enter "INBOX."
984 --- Shared Folders ---
986 If you are using shared folders the same steps apply, but I would create
987 a separate account and using the above information. All you have to do
988 is change INBOX to SHARED.
993 Here are the necessary permissions needed for some of the rc files
994 and the commands to correct them.
996 chmod 600 .procmailrc
997 chmod 710 .fetchmailrc
998 chmod 600 .imapfilterrc
1000 Here are the necssary permissions for unifed logging of all of the
1003 chmod 666 /var/log/procmail.log
1004 chmod 666 /var/log/imapfilter.log
1005 chmod 666 /var/log/fetchmail.log
1006 chmod 666 /var/log/anomy.log
1010 CHANGELOG: 1.7 Update CVS Information
1011 1.6 Update to New Hint Format Completed
1012 1.5 Updated Email Address
1013 1.4 Updated to New Hint Format
1014 1.3 Updated versions
1016 1.1 Fixed listed permissions
1019 New Version of this document can be viewed from http://cvs.jg555.com/viewcvs.cgi/lfs-hints