3 AUTHOR: Jim Gifford <giffordj@linkline.com>
6 How to setup a complete email system.
11 Introduction to Complete Email
13 This hint will help you configure a complete email system. One that supports
14 IMAP and POP3 requests. It will also filter SPAM and remove harmfull HTML code
15 from messages. This is a very long hint, but in order to get everything to work
16 you must follow all steps.
21 Download location http://www.postfix.org
25 Download location http://www.procmail.org
28 Program Name Courier Imap
29 Download location http://www.courier-mta.org
32 Program Name Avmailgate
33 Download location http://www.hbedv.com
37 Download location http://ssl.usu.edu/paul/gotmail
40 Program Name Fetchmail
41 Download location http://www.tuxedo.org/~esr/fetchmail
44 Program Name Anomy Mail Sanitzer
45 Download location http://mailtools.anomy.net
48 Program Name Spam Assassin
49 Download location http://www.spamassassin.org
53 Download location http://razor.sourceforge.net
56 Program Name Imap Filter
57 Download location http://imapfilter.hellug.gr
61 Download location http://fcron.free.fr
64 Program Name Berkeley DB
65 Download location http://www.sleepycat.com
69 Download location http://www.gnu.org/software/wget/wget.html
73 Download location http://omnibus.ruf.uni-freiburg.de/~gritter
77 Download location http://www.openssl.org
80 Program Name Pop-before-smtp
81 Download location http://www.trestle.com/unix/pop-before-smtp
85 Assumptions Made in this document
87 I have made the following assumptions in this document.
88 File have been downloaded.
90 Openssl is installed. Install information is located in this document also.
95 The complete mail system will not be functional until you have
96 completed all the steps. You can skip the steps that are optional,
99 DO NOT USE DB 4.1.24 IT DOES NOT WORK WITH THIS CONFIGURATION.
104 Before you can setup Postfix you will need to setup Berkeley DB.
108 To Compile Berekely DB you can use the following commands.
110 Change to the /usr/src/db-4.014/dist directory
111 In the directory issue the following commands
113 ./configure --prefix=/usr --enable-shared -- enable-compat185
114 make docdir=/usr/doc/BerkeleyDB-4 all install
116 This completes the Setup of Berkeley DB. You can remove the db-4.0.13 file and directory.
120 Before compiling postfix you will need to create a user and a group.
122 In /etc/passwd add : postfix:x:101:101::/dev/null:/bin/false
124 In /etc/group add : postfix:x:101: postdrop:x:102:
128 Change to /sr/src/postfix-1.1.11 directory
129 In the directory issue the following commands
133 Now if you have never installed Postfix before the next command you will issue
134 is the following command. You may want to look at the configuration information
135 below, it may help you answer some of question that postfix will ask you.
139 If you have installed Postfix before the next command you will issue is the following
146 You will need to change postfix's configuration to work with the courier-imap server.
147 The configuration below is my working config. I have added *** *** lines where changes are
150 Configuration File Main.cf - /etc/postfix/main.cf
152 queue_directory = /var/spool/postfix
153 command_directory = /usr/sbin
154 daemon_directory = /usr/libexec/postfix
156 myhostname = mail.server.com *** Change this to your mail server DNS Name ***
157 mydomain = server.com *** Change this to your domain name ***
159 inet_interfaces = all
160 mydestination = $myhostname, localhost.$mydomain, $mydomain,
161 mail.$mydomain, www.$mydomain, ftp.$mydomain
162 mynetworks_style = subnet
163 mynetworks = 192.168.0.0/24, 127.0.0.0/8 *** Change this to your Network IP -- Do not Change the 127.0.0.0/8 ***
164 relayhost = [ smtp.isp.com ] *** Change this to your ISP's smtp server ***
165 allow_percent_hack = yes
166 append_at_myorigin = yes
167 append_dot_mydomain = yes
168 empty_address_recipient = MAILER-DAEMON
169 masquerade_classes = envelope_sender, header_sender, header_recipient
170 masquerade_domains = server.com *** Change this to your domain name ***
171 masquerade_exceptions =
173 transport_maps = hash:/etc/postfix/transport
174 alias_maps = hash:/etc/postfix/aliases
175 alias_database = hash:/etc/postfix/aliases
176 home_mailbox = Maildir/
177 mail_spool_directory = /var/mail
178 mailbox_command = /usr/bin/procmail -d "$USER"
179 smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
182 PATH=/usr/bin:/usr/X11R6/bin
183 xxgdb $daemon_directory/$process_name $process_id & sleep 5
184 sendmail_path = /usr/sbin/sendmail
185 newaliases_path = /usr/bin/newaliases
186 mailq_path = /usr/bin/mailq
187 setgid_group = postdrop
188 manpage_directory = /usr/share/man
189 sample_directory = /etc/postfix/sample
190 readme_directory = no
191 content_filter = smtp:127.0.0.1:10024
192 maps_rbl_reject_code = 571
193 maps_rbl_domains = dynablock.wirehub.net, blackholes.wirehub.net, relays.ordb.org
194 smtpd_sender_restrictions = hash:/etc/postfix/access, reject_maps_rbl
196 Configuration File Master.cf - /etc/postfix/master.cf
198 Use the file that is in /etc/postfix directory and add the following line after smtp
200 localhost:smtp-backdoor inet n - n - - smtpd -o content_filter=
202 Configuration File Aliases - /etc/postfix/aliases
204 You will need to configure the aliases file to your needs, the default should be fine. The
205 import thing to remember is after you make changes to this file, you will need to run the
206 newaliases command for that file to be in effect. Important note: You will need to create a
207 user for the root email account. By using procmail we have disabled the root mail account. I
208 suggest the account name of admin. Add the following to your aliases file.
212 Configuration File Transport - /etc/postfix/transport
214 This file is how every mail is handled by your domain. You will need to change *** *** lines
215 where changes are needed. The import thing to rember is after you make changes to this file,
216 you will need to run the postmap /etc/postfix/transport command for that file to be in effect.
218 .server.com local: *** Change this to your domain name ***
221 Configuration File Access - /etc/postfix/spam_access_list
223 This file I made a cron event. If you have already installed FCRON or another cron program all
224 you need to do is run the following script. This file is for a spam protection. At the end of
225 this file I have added a fcron and wget instructions. You will need to run this file manually
226 one time. This will create the first access file.
232 echo "Getting SPAM Access list..."
233 wget http://basic.wirehub.nl/spamlist-extended.txt
234 echo "Moving SPAM Access list to Postfix Directory..."
235 mv /tmp/spamlist-extended.txt /etc/postfix/access
236 echo "Enabling SPAM Access list in Postfix..."
237 postmap /etc/postfix/access
242 # Begin $rc_base/init.d/postfix
244 # Based on sysklogd script from LFS-3.1 and earlier.
245 # Rewritten by Gerard Beekmans - gerard@linuxfromscratch.org
247 source /etc/sysconfig/rc
252 echo "Starting Postfix..."
253 /usr/sbin/postfix start > /dev/null 2>&1
258 echo "Stopping Postfix..."
259 /usr/sbin/postfix stop > /dev/null 2>&1
264 echo "Reloading Posfix..."
265 /usr/sbin/postfix reload > /dev/null 2>&1
275 echo "Usage: $0 {start|stop|reload|restart}"
280 # End $rc_base/init.d/postfix
282 Runlevels - You will need to select the runlevel you want to run postfix at. Use the
283 the following command to achieve this. Change the ?? to the # you want to use.
285 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc0.d/K??postfix
286 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc3.d/S??postfix
287 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc4.d/S??postfix
288 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc5.d/S??postfix
289 ln -sf /etc/rc.d/init.d/postfix /etc/rc.d/init.d/rc6.d/K??postfix
296 You will need to edit the autenticate.c file before compiling. This will make procmail work
297 with Maildir style mailboxes.
299 Change to the /usr/src/procmail-3.22/src directory
301 cp authenticate.c authenticate.c.backup
302 sed -e 's|#define MAILSPOOLHOME "/.mail"|#define MAILSPOOLHOME "/Maildir/"|g' \
303 authenticate.c.backup > authenticate.c
305 Change to the /usr/src/procmail-3.22 directory
306 echo "" | make BASENAME=/usr install
308 More information will be discussed in the Procmail Recipes section
315 Change to the /usr/src/courier-imap-1.4.6 directory
317 These commands need to be run by a user other than root.
319 ./configure --prefix=/usr/courier \
320 --sysconfdir=/etc/courier \
321 --with-piddir=/var/run \
324 --without-authuserdb \
325 --without-authmysql \
326 --enable-workarounds-for-imap-client-bugs
329 These commands need to be run by the root users
332 make install-configure
336 Configuration File - /etc/courier/imapd
338 Edit this file. The last line of the file has the following information in it.
344 If you also want a POP3 server edit - /etc/courier/pop3d
346 The last line of the file has the following information in it.
352 Configuration File - /etc/courier/authdaemonrc
354 Verify that the authmodulelist="authshadow"
358 cp /usr/courier/libexec/imapd.rc /etc/rc.d/init.d/courier-imap
359 cp /usr/courier/libexec/pop3d.rc /etc/rc.d/init.d/courier-pop3
361 Runlevels - You will need to select the runlevel you want to run courier at. Use the
362 the following command to achieve this. Change the ?? to the # you want to use.
364 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc0.d/K??courier-imap
365 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc3.d/S??courier-imap
366 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc4.d/S??courier-imap
367 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc5.d/S??courier-imap
368 ln -sf /etc/rc.d/init.d/courier-imap /etc/rc.d/init.d/rc6.d/K??courier-imap
370 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc0.d/K??courier-pop3
371 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc3.d/S??courier-pop3
372 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc4.d/S??courier-pop3
373 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc5.d/S??courier-pop3
374 ln -sf /etc/rc.d/init.d/courier-pop3 /etc/rc.d/init.d/rc6.d/K??courier-pop3
379 For security reasons this package cannot be compiled. This will give you complete
380 antivirus protection.
382 You can get a free license for this program. You apply for it at
383 http://www.antivir.de/order/privreg/order_e.htm
385 This will get you a key file.
389 Change to the /usr/src/avmailgate-2.0.0.6-Linux-glibc directory
393 This will ask you a series of questions. These questions relate to you specific system
399 This is an optional program that will pull mail from Hotmail.
403 Change to the /usr/src directory
405 mv gotmail-0.7.0 gotmail
408 mv *.1 /usr/share/man/man1
410 In the Cron section I will show you how to use this program.
415 This is an optional program that will pull mail from a POP3 server.
419 Change to the /usr/src/fetchmail-5.9.13 directory
421 ./configure --prefix=/usr \
422 --enable-fallback=procmail \
430 Config File - /~/fetchmail.rc
432 # Begin /~/.fetchmailrc
436 set logfile /var/log/fetchmail.log
438 # Get mail from ISP.com
445 is local_username here password local_password
447 # End /~/.fetchmailrc
449 In the Cron section I will show you how to use this program.
451 More information will be discussed in the Procmail Recipes section
458 Change to the /usr/src directory
465 # Configuration file for Anomy Sanitizer
468 # Do not log to STDERR:
471 # Don't insert log in the message itself:
474 # Advertisement to insert in each mail header:
475 header_info = X-Sanitizer: This mail was sanitized
479 # Enable filename based policy decisions:
482 # Protect against buffer overflows and null values:
485 # Replace MIME boundaries with our own:
488 # Fix invalid and ambiguous MIME boundaries, if possible:
491 # Trust signed and/or encrypted messages:
493 msg_pgp_warning = WARNING: Unsanitized content follows.\n
495 # Defang shell scripts:
498 # Defang active HTML:
501 # Defang UUEncoded files:
504 # Sanitize forwarded content too:
507 # Testing? Set to 1 for testing, 0 for production:
510 ## Warn user about unscanned parts, etc.
513 # Force all parts (except text/html parts) to
520 # Disable "score" based mail discarding:
524 msg_file_drop = \n*****\n
525 msg_file_drop += NOTE: An attachment named %FILENAME was deleted from
526 msg_file_drop += this message because was a windows executable.
527 msg_file_drop += Contact the system administrator for more information.
530 ## File attachment name mangling rules:
533 file_name_tpl = /var/quarantine/att-$F-$T.$$
535 # Number of rulesets we are defining:
537 file_default_policy = defang
539 # Delete probably nasty attachments:
540 file_list_1 = (?i)(winmail.dat)|
541 file_list_1 += (\.(vb[se]|exe|com|cab|dll|ocx|msi|cmd|bat|pif|lnk|hlp|ms[ip]|reg|asd))$
542 file_list_1_policy = drop
543 file_list_1_scanner = 0
545 # Allow known "safe" file types and those that can be
546 # scanned by the downstream virus scanner:
547 file_list_2 = (?i)\.(doc|dot|rtf|xls|ppt|xlw|jpg|gif|png|tiff?|txt|zip|tgz|gz)
548 file_list_2_policy = accept
549 file_list_2_scanner = 0
551 # Any attachment not listed above gets renamed.
553 More information will be discussed in the Procmail Recipes section
556 Spamassassin and Razor
558 Change to the /usr/src/razor-agents-2.14 directory
564 Change to the /usr/src/Mail-SpamAssassin-2.31 directory
572 /etc/mail/spamassassin/local.cf file you may need to specify email addresses that
573 are exempt from spam checking. Example to allow all emails from joe@isp.com you
574 would add the following line to the local.cf file
576 whitelist_from joe@isp.com
581 I will be using the user admin as the example here. You will need to do this for
582 all the users that you want to give mail access to. If you run this command as root
583 you will need to change the file permissions to the maildir manually, using the
584 following chmod utilizing 700 and chown user.user -R
586 Now we are getting to the actual mail directories. First you will need to create
587 a default mail directory.
589 maildirmake /home/admin/Maildir
591 This will create the main mail directory. Since we are also using spam checking I
592 would also create a Spam folder. Type it exactly like this.
594 maildirmake /home/admin/Maildir/.Spam
599 The procmail recipe I use will sort the mail, sanitize, and spam check all the emails
600 that enter the system. This file will need to be in all of the users home directory.
601 Permissions on this file must be set with the chmod utilizing 644.
605 # Begin /~/.procmailrc
609 MAILDIR=$HOME/Maildir/
612 LOGFILE=/var/log/procmailrc.log
618 * ^From:.*\<*@server.com> # Change server.com to your domain. This will bypass all
619 $DEFAULT # check if the mail is from the localdomain.
622 | /usr/anomy/bin/sanitizer.pl /usr/anomy/anomy.conf
629 * ^X-Spam-Status: Yes
632 # Accept all the rest to default mailbox
638 You can also have it sort email that come in from the gotmail and fetchmail script. Here is
639 a modified procmailrc file that will sort emails from gotmail and fetchmail. You will have to
640 issue an additonal makemaildir command. Here is the command line for the examples I show.
642 maildirmake /home/admin/Maildir/.Hotmail
643 maildirmake /home/admin/Maildir/.isp
644 maildirmake /home/admin/Maildir/.isp2
646 After you have made the Maildir directories make sure that the user that owns then is the
647 same user that the mail is intended for. In this case
649 chown admin.admin /home/admin/Maildir -R
650 chmod 700 /home/admin/Maildir -R
654 # Begin /~/.procmailrc
658 MAILDIR=$HOME/Maildir/
661 LOGFILE=/var/log/procmailrc.log
667 * ^From:.*\<*@server.com> # Change server.com to your domain. This will bypass all
668 $DEFAULT # check if the mail is from the localdomain.
671 | /usr/anomy/bin/sanitizer.pl /usr/anomy/anomy.conf
678 * ^X-Spam-Status: Yes
682 * ^TO_user@hotmail.com
693 # Accept all the rest to default mailbox
702 This program will allow you to filter IMAP messages like procmail, but that is not why
703 I use it. It also allows you to delete emails that are old. The imapfilterrc file must
704 chmod with 700 and belong to the user who's home dir it is in.
708 Change to the /usr/src/imapfilter-0.7.3 directory
710 cp Makefile Makefile.org
711 sed -e 's|/usr/local|/usr|g' \
712 Makefile.org > Makefile
718 The only catch to this configuration file is that it requires a username and
719 password. It lives in the home directory of the users. This will only delete
720 the messages older than 7 days from the Spam folder only. It will not touch
727 # Some program options, such as log file and non-response server timeout.
729 logfile = /var/log/imapfilter.log
734 ##########################
735 # Accounts and mailboxes #
736 ##########################
738 # Each account has a number of folders/mailboxes which are grouped under
739 # an alias name. Folders belong to the last preceding account. A mailbox
740 # can belong to many mailbox groups.
744 # Connects to "imap1.mail.server" at port 143, as "user1" and
745 # using password "secret1".
747 # Mailboxes that exist at "imap1.mail.server" include: "INBOX", "woody",
748 # "linux-mailist", etc. and are grouped in various ways.
750 account account1 username:password@mail.server.com:143
758 # Filters are completely independent from any account or folder settings.
759 # The mask command may be ommited. If no masks are declared inside
760 # a filter entry, then all messages are matched.
771 # Last, there is the definition of the jobs where user combines
772 # folders and filters _already_ defined, and specifies which filters
773 # should be applied to which folders.
781 This will give a basic setup for wget.
783 ./configure --prefix=/usr \
784 --sysconfdir=/etc/wget
788 Some users may need to change the #passive_ftp = off to passive_ftp = on
793 This will give a basic setup for nail. Do to the setup, this is only
794 used to send email and not to receive. Nail is not Maildir compatible.
795 You can use mutt or pine to read emails from a IMAP folder
797 ./configure --prefix=/usr \
798 --with-sendmail=/usr/sbin/sendmail
801 ln -sf /usr/bin/nail /usr/bin/mail
807 This will give a basic setup for fcron. Follow the fcron instruction during the fcron
812 ./configure --prefix=/usr \
814 --with-sendmail=/usr/sbin \
815 --with-piddir=/var/run \
816 --sysconfdir=/etc/fcron
820 Mail Related Cron Events
822 To update the spamlist use the following commands as root
826 add the following line
828 %hourly 01 /etc/postfix/spam_access_list
830 To use gotmail to get Hotmail and fetchmail to get other ISP's mail
834 add the following line
836 %hourly 02 /usr/gotmail/gotmail -u username -p password -f linuxusername@server.com --delete --silent
837 %hourly 03 /usr/bin/fetchmail
839 To use imapfilter to delete old messages
843 %nightly 00 01 /usr/bin/imapfilter
849 This will setup openssl to work with Courier and Fetchmail
851 Change to /usr/src/openssl-0.9.6d directory
853 ./config --prefix=/usr --openssldir=/etc/openssl shared
855 make MANDIR=/usr/man install
858 Optional program pop-before smtp
860 This program allow your remote users to send email from a remote location.
861 It allows this by capturing their current IP after they have done a POP or
862 IMAP transfer from courier. The IP only stays active for a time that you
865 Here is the basic compile and configuration for pop-before-smtp
870 cp pop-before-smtp.conf pop-before-smtp.conf.org
871 sed -e 's|grace = 2h|grace = 30m|g' \
872 -e 's|log_file = /var/log/mail.log|log_file = /var/log/mail.log|g' \ # Change to your log file
873 pop-before-smtp.conf.org > pop-before-smtp.conf
874 rm -rf pop-before-smtp.conf.org
876 Now you will need to configure postfix to use the file
878 You will need to edit your main.cf file and add the following line
879 smtpd_recipient_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/pop-before-smtp, check_relay_domains
884 # Begin $rc_base/init.d/pop-before-smtp
886 # Based on sysklogd script from LFS-3.1 and earlier.
887 # Rewritten by Gerard Beekmans - gerard@linuxfromscratch.org
889 source /etc/sysconfig/rc
894 echo "Clearing POP Before SMTP File..."
895 rm -rf /etc/postfix/pop-before-smtp
897 echo "Starting POP Before SMTP..."
898 /usr/bin/pop-before-smtp &
903 echo "Stopping Pop Before SMTP..."
904 killproc /usr/bin/pop-before-smtp
918 echo "Usage: $0 {start|stop|restart|status}"
923 # End $rc_base/init.d/pop-before-smtp
926 Runlevels - You will need to select the runlevel you want to run postfix at. Use the
927 the following command to achieve this. Change the ?? to the # you want to use.
929 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc0.d/K??pop-before-smtp
930 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc3.d/S??pop-before-smtp
931 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc4.d/S??pop-before-smtp
932 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc5.d/S??pop-before-smtp
933 ln -sf /etc/rc.d/init.d/pop-before-smtp /etc/rc.d/init.d/rc6.d/K??pop-before-smtp
938 --- Outlook Express ---
940 If you are using Outlook Express Clients. Here is how you would configure them.
942 Setup an IMAP account. Follow the prompts until you get a message. Would you like
943 to Download folders from the mail server you added. Click on NO. If you have not
944 exited from the account creation screen you can continue to the next step.
946 Then go to Tools -=> Accounts -=> Select the Account You just made -=> Properties
948 Go to the IMAP tab. In the Root folder path type INBOX.
950 --- Pine 4.10 or greater ---
952 Go to Pine's Main Menu. Select Setup then Configure. Go down to "inbox-path" setting
953 set it (hostname) INBOX
955 --- Netscape Messenger ---
957 Uncheck the opton Show only subscribed folders in the Advanced tab.
959 Under "Personal Namespace" enter "INBOX."
961 --- Shared Folders ---
963 If you are using shared folders the same steps apply, but I would create a separate
964 account and using the above information. All you have to do is change INBOX to
970 Here are the necessary permissions needed for some of the rc files
971 and the commands to correct them.
973 chmod 600 .procmailrc
974 chmod 710 .fetchmailrc
975 chmod 600 .imapfilterrc
977 Here are the necssary permissions for unifed logging of all of the
980 chmod 666 /var/log/procmail.log
981 chmod 666 /var/log/imapfilter.log
982 chmod 666 /var/log/fetchmail.log
983 chmod 666 /var/log/anomy.log
985 Mail suggestions to giffordj@linkline.com
987 New Version of this document can be viewed from
988 http://www.jg555.com/cvs