Introduction

This is a howto for installation of postfix in a virtual environment

1) When you follow the steps explained in this document, instead of creating system accounts in
/etc/passwd file you will be able to create them in a MySQL database and keep those passwords
in clear text which means that you will be able to see your user's passwords. Passwords will not
be in encrypted form (Actually I may change this strategy very soon)
2) You will be able to define quota for your user´s mailboxes.
3) You can either give access to pop3, imap or webmail individually. e.g You give only webmail access
and deny usage of smtp and pop3 services.
4) With Squirrelmail webmail software, users can change their passwords by themselves and see
their disk usage for e-mails quotas.
5) Spamassassin software will filter spam and you will see spam messages rarely. It is a amazing
software.
6) Your users will use their e-mail addresses for authentication instead of username. What it means
is that, you will not write your username in login page of webmail. Instead, you will write e.g
user@domain.com email address.
7) You will be able to add, delete users, manage your domains and add,remove aliases from PostfixManager
software through web interface.
8) You will be able to create your ftp accounts in a MySQL database and let authentication to be done
through that database.
9) Since, DNS is the primary system that allows all these systems to work, you will also install and administer
Primary and a secondary DNS server and make this server more secure.
10) You will be able to redirect all your mails to an internal mail server or any other server
around the galaxy :) This way, your mail server can be a mail gateway for many servers. You can use
this gateway for spam and virus filtering.
11) And finally, your users will be protected by Amavisd-new and Clamav from viruses or worms.

TODO -

- maildrop will be removed and VDA patch will be used instead to provide quota capability -

- Sender Policy Framework will be included both for DNS and postfix -

-

Changelog

TODO

- SPF(Sender Policy Framework) integration into Postfix and BIND
- Mail list setup in virtual user setup.
-

Acknowledgement -

I would like to thank Mehdi Hassanpour for his help and support for this page and Huseyin Caglar,Dave Masslich,Tom Hipsz for their corrections. -

-

Concepts -

-

Requirements -

Please DO NOT SKIP THIS PART. THIS PART IS HIGHLY NECESSARY!

Download the following softwares into /usr/local location and extract those in this directory
as described below. For our setup to work, we have to add some users. These users will be used
by courier and courier-authlib packages. You must create an account named courier for this purpose.
Since /usr/local is only writable by root user, create a user called courier and give ownership of /usr/local
directory to courier like below;

Note: Don't think that I have chosen this account name because I like it. Courier package has been changed
a lot and you should use this account name for proper functioning of courier and courier-authlib.


# groupadd courier
# useradd courier -g courier -d /usr/local
# chown courier /usr/local

Then proceed all the steps below with courier user. If you see a dollar sign ( $ ) in command prompt,
please do that step as a unprevileged user(courier) ( not root, the King! ).
Otherwise you may encounter unexpected results. If you see a pound sign ( #) in the command prompt
do that step as root.

Note : Please use the latest versions of software below. These are the versions when
I have prepared this documentation. I hope new versions will not cause any problem
for your setup.

-

INSTALLATION

Many of the above softwares can be downloaded into your linux box with the help
of wget utility allowing you to resume your downloads. You will see the usage of this
utility below.
Throughout installation stages, you may see that some programs are already installed
in your system. If so, skip those installations please. The aim of this long document is not
only for showing the installation of postfix but also to introduce many aspects of
various programs not familiar to new linux users.
Now, the long journey for Postfix is about to begin, sit back and be ready. -

-

BIND - -

(If you have a working DNS server you can skip this DNS server setup part but
you may find useful information for taking bind into jail(chroot) environment)

Many administrators usually do not care much about DNS system. Once DNS doesn't
work, you understand its meaning. Even if your IP structure works, it makes no sense.
So we have to care DNS more than we do (deal?). Let's begin with a brief introduction
telling what DNS looks like ?

DNS INTRODUCTION:
In daily Internet usage, we use letters to write e-mail and web page addresses.
Internet is managed by routers (devices or software on a computer) and these devices control
the flow of information by examining the fields of IP packets, which designate where the packet
comes from and goes to .

If you don't know how a packet resembles, here is the well known IP Packet Header :)
-

-

You see that there are two fields "Source IP Address" and "Destination IP Address"
in the IP packet. These source and destination fields can only have 32 bit addresses in IPv4.
In another word, these fields cannot be composed of letters. This means
that we should find a way of converting these human readable words and letters
(web page addresses, email domains) to the the form where routers can understand
to route the packet to its intended destination.
Have you ever asked where these IP addresses come from and let the routing
possible?
In this stage, DNS acts the leading role which makes this conversion possible. When you
write a web page address such as linux.org into your browser, here what happens;
(As a side note: We assume that you write this URL in a browser in Linux, since it
seems that Windows doesn't respect TTL(Time To Live) values and cache responses from
DNS server for a constant periof of 24 Hours. For a more detailed explanation visit this page )
if you want to learn someting how a browser in linux cache data visit this page -
How does name resolution work ?
Assume we have written yonlendir.com.tr in our browser

1) The application first checks some special database. For example, if you use a web browser,
your browser first check its internal memory cache before asking the query to DNS server.
if there is an answer, no need to ask further.
2) Application checks /etc/resolv.conf file for nameserver entries to perform the query.
3) Lets say that application got nameserver addresss as 212.23.1.1
4) 212.23.1.1 name server first checks its cache whether there is an entry with the
related query or not. If it has the answer, no further query
5) Then name server checks to determine that this domain is local or not. Meaning
that, this ns server is responsible for that domain or not.
6) If not, ns server 212.23.1.1 takes Top Level Domain (TLD) part .tr and queries a root server
for this .tr domain to learn which server is responsible for it and got the answer
ns1.metu.edu.tr with IP address of 144.122.199.90
7) Then the process is going on like a chain. 212.23.1.1 name server then askes for .com.tr
domain for that, who is responsible for com.tr. This goes on until reaching the final
name server which has the authoritive answer for yonlendir.com.tr
8) After receiving final record answer 212.23.1.1 name server caches this data for further
queries.


Now we are going to install BIND ( Berkeley Internet Name Daemon) and create our
domains for our Postfix virtual system to work. Since running this daemon as root can be dangerous,
we will put this daemon into a jail environment.( In this environment, daemon is restricted to live
in a predefined directory location like a prisoner in jail:)

#cd /usr/local
#wget -c ftp://ftp.isc.org/isc/bind9/9.3.0/bind-9.3.0.tar.gz
#tar zxf bind-9.3.0.tar.gz
#cd bind-9.3.0
#./configure --prefix=/usr/local/bind
#make
#make install
#mkdir -p /usr/local/bind/{etc,namedb,dev,var/run}
(The above command creates all necessary directories in one step - You can use curly brackets for this purpose)

/usr/local/bind/etc/named.conf -

options {
directory "/namedb";
version "I do not give any version info";
pid-file "/var/run/named.pid";
allow-transfer { none ;};
};

zone "." IN {
type hint;
file " /etc/named.root ";
};

#cd /usr/local/bind/etc
#wget ftp://ftp.internic.com/domain/named.root

#/usr/local/bind/sbin/named -u named -t /usr/local/bind -c /etc/named.conf -

Check that daemon is started or not -

#ps aux - grep -v grep - grep named

/usr/local/bind/etc/named.conf -

zone "test.com" {
type master ;
file "test.com.zone";
allow-query {any;};
allow-update { none; };
};

/usr/local/bind/namedb/test.com.zone

$TTL 14400

@ IN SOA ns1.test.com. gyilmaz.test.com. (
2005030601 ; serial
7200 ; Refresh
7200 ; Retry
604800 ; Expire
86400 ) ; Minimum

test.com. IN NS ns1.test.com.
test.com. IN A 144.122.211.1
mail.test.com. IN A 144.122.211.1
test.com. IN A 144.122.211.1
test.com. IN MX 5 mail.test.com.
webmail.test.com. IN A 144.122.211.1
securewebmail.test.com. IN A 144.122.211.2

This is our test.com zone file. Zone files need TTL (time to live) values. These values define
how long other DNS servers should cache your name information without asking your
DNS server again. If this TTL value is 86400 secs , once a name server asks IP address
of test.com, it will not ask your server for the next 86400 secs (1 day :)
ns1.test.com in SOA line is the name server responsible for this domain name and gyilmaz.test.com is the
administrator e-mail address for this domain. Be careful it is an e-mail address (gyilmaz@test.com)
but you must put "." instead of @ character.
DON'T FORGET TO ADD DOTS AT THE END OF EACH DOMAIN NAME TOO.
Another thing, you have to increment serial number by one in each change of this file.
Important line for our mail server is ;
test.com. IN MX 5 mail.test.com.

This line says that mails sent for test.com domain must be sent to mail.test.com
machine which has the IP address of 144.122.211.1 . Number 5 is the priority value and it is only
meaningful when there are two mail servers co-exist. Now.increment your serial number for the
first time and reload your bind DNS server. Let's do it.. -

#kill -1 `pidof named` -

Informational Note: For those who are new to Linux, I would like to explain the command issued above. Backtick
sign ( ` ) in linux allows you to run a command. This allows you to take output of a command and use that
output as an input of an another command. In the example above, pidof command is the command which gives
the process ID of named program. Output of `pidof named` command becomes an input for kill -1 command.
By this way, you don't have to write " ps ax " and learn process ID of the program and use kill command.
This saves your time.

We have sent a HUP signal to named daemon and dns server reloaded its configuration file.
Now it knows what the mail exchanger (responsible mail server) is for test.com domain .
Let's ask it to new dns server whether it knows or not. -

#host -t mx test.com 127.0.0.1
test.com mail is handled by 5 mail.test.com. -

We have asked for the mail exhanger of test.com and DNS server said that mail.test.com is
responsible for test.com domain. Now we have a fully functional DNS server which can
answer for our new domain.We can go to the next step to accept mail in our mail server.

options {
directory "/namedb";
version "I do not give any version info";
pid-file "/var/run/named.pid";
allow-transfer { none ;};
};

zone "." IN {
type hint;
file "named.root";
};
zone "test.com" {
type slave ;
masters { 144.122.211.1; };
file "test.com.zone";
allow-query {any;};
allow-update { none; };
}; -

Have you noticed the change in named.conf file? This time, instead of writing " master " to the
type line, we have written " slave " since this domain is slave and retrieve its record sets from the
master server.
Ok we have set up our secondary server and it is ready for transferring zone information but
Is master server ready for accepting zone transfer requests coming from this secondary server ?
No.. we should tell the master server to accept AXFR (transfer type) requests originated
from 212.154.2.4 IP address. Now open named.conf file in the primary server and change ; - line -

allow-transfer { none ;};

allow-transfer { 212.154.2.4 ;}; -

This line permits transfer requests from 212.154.2.4 secondary name server. When you make any
little change to test.com domain in the primary server, change will be reflected to the secondary server
as a notify. So you will not have to make the same change on the secondary server.
When you add another domain to the primary server, you have to add configuration lines for
your new domain to the named.conf file of secondary server as mentioned above. Reload servers and
you will see that secondary server copies zone files from the master and write those new zone files
under /namedb directory. It is amazing , isn't it ? :)

SECURITY OF DNS SERVERS -
I would want to do more on security of these primary and secondary server setups but I know that
when I add more functionality, things are getting more complex and the probability of making mistakes
increases:) I don't want this document to be a error-rich document. I just would like to tell some parts that
you should consider below;

1) RFCs suggest that you should not provide caching services on the server that provides
authoritive data for zones. Your cache-only server and authoritive server serving your zones
should not be on the same server. For example, you should not use these authoritive servers
in your /etc/resolv.conf files for cache purposes. This is not recommended from the security
point of view. You can read requirements for root servers RFC.

2) We have installed our DNS servers to serve both authoritive data and cache information. I have just
done this to demonstrate how this system works. To disable caching service of these servers
you can remove;
zone "." IN {
type hint;
file "named.root";
};
these lines. When you remove these lines, DNS server will not be aware of root servers' IP addresses
and can not answer for NS queries for zones that it is not currenly authoritive for. It is a nice trick right :)

3) You should also disable recursive queries on your DNS server. You don't have to make all queries
recursively. Your servers don't have to do all the stuff for queries. This will also save bandwidth, if you
have lack of it. Add this line to named.conf in between options block.

allow-recursion { none; } ;

This way, you will not provide recursive service to any resolver and every resolver will only
receive NS IP addresses of the next responsible DNS server for that zone and not the answer of
the query.

4) If you are a ultra secure person :) , you can also disable any query except your zone files from any client.
This way, your server will say "CONNECTION REFUSED" to the resolvers which want to query other
domains that you are not responsible for. If you had paid attention there is a line
allow-query {any;};
in every zone block that I have added. This says that, server allows any query for this domain. When you add
allow-query { none; };
line to options block of named.conf file , DNS server will not allow any query other than your domains and
refuse connections.

I know that these options have close relations when doing their task. When you mainly use DNS, you can discover
how they are needed.

One of my aims was to write a good "Secure DNS" document. I hope I did small percent of what I wanted
I think this DNS information is a little more for a postfix document but I believe that when DNS is not configured
properly, there is no way of a MTA to work.


Now, lets first start with OPENSSL installation. -

OPENSSL

Just to remember, all untar operations are done under /usr/local directory -

#su - courier
$cd /usr/local
$wget -c openssl.org/source/openssl-0.9.7g.tar.gz
$tar -zxf openssl-0.9.7g.tar.gz
$cd openssl-0.9.7g
$./config shared
$make
$make test
#make install
# echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
#ldconfig -

APACHE -

$su - courier
$cd /usr/local
$wget -c apache.org/dist/httpd/httpd-2.0.53.tar.bz2
$tar -jxf httpd-2.0.53.tar.bz2
$cd httpd-2.0.53
$./configure --prefix=/usr/local/apache2 \
--enable-so --enable-ssl=shared --enable-rewrite=shared \
--with-ssl=/usr/local/ssl
$make
$su
#make install

Lets make directories and files secure

#cd /usr/local/apache2
#chown 0 . bin conf logs
#chgrp 0 . bin conf logs
#chmod 755 . bin conf logs
#chown 0 /usr/local/apache2/bin/httpd
#chgrp 0 /usr/local/apache2/bin/httpd
#chmod 511 /usr/local/apache2/bin/httpd -

Apache Security:
We should also prevent apache giving server version and type
information to the outside. By default apache gives information about its version
and some of application it uses. e.g php,openssl. We don't want to give this info
to the others right?

1)
Edit file:
/usr/local/apache2/conf/httpd.conf and find these two lines and modify them as below;
ServerTokens Prod
ServerSignature Off

2)
#UserDir public_html
Comment this UserDir line too.
- CREATE SSL CERTIFICATE: -

SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key -

INTO -

SSLCertificateFile /usr/local/apache2/conf/ssl.crt/webmail.crt
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/webmail.key -

Would you like to make these changes without manually editing ssl.conf file?
Here comes my perl solution:)

#cd /usr/local/apache2/conf/
#perl -pe 's/ server.crt /webmail.crt/g ; s/ server.key /webmail.key/g' ssl.conf > ssl.conf.tmp
#cp ssl.conf.tmp ssl.conf

Above commands contain regular expression which you should be so familiar if you
want to be a Linux system administrator. What it does is that, searching and replacing
server.crt and server.key statements with webmail.crt and webmail.key words.

This certificate file modification is just for apache2 to work for the time being. We will come back
to this subject later. More detailed ssl configuration about ssl virtualhost is written at the end
of the document in Virtualhost-SSL configuration part.

Now you can probably :) start apache-ssl safely with the command; -

#/usr/local/apache2/bin/apachectl startssl -

Apache is installed. Would you like to make a performance test on this fresh apache :) ?
There is a utility called " ab " in apache which allows us to make benchmarking. -

#/usr/local/apache2/bin/ab -n 100 -c 10 test.com/ -

Above command will make a performance test on apache. ( Don't forget to
write ending slash in the address, otherwise it won't work. - Paramater Meanings
" -c " stands for 10 multiple requests to perform at a time and
" -n " stands for number of requests. -

C-CLIENT (UW-IMAP)

We are going to install php with imap support to use our webmail but php
requires c-client library for this to work. For reference click -

#cd /usr/local
#wget -c ftp://ftp.cac.washington.edu/imap/imap.tar.Z
#tar -Zxf imap.tar.Z
#cd imap-2004c1
(YOUR DIRECTORY MAY BE DIFFERENT DEPENDING ON YOUR VERSION)
#make slx SSLTYPE=none
(Answer Y to the question asked when above command is issued)
#mkdir include
#mkdir lib
#cp c-client/*.h include/
#cp c-client/*.c lib/
#mv c-client/c-client.a lib/libc-client.a -

MySQL

It is time for MySQL database server setup. First we will do some
preparation for the server. Steps are explained below.
Attention: I recommend you to not to install 4.1.x version of MySQL . I have experienced problems in this version. -

# cd /usr/local
#wget -c mysql.com/Downloads/MySQL-4.0/mysql-4.0.24.tar.gz
Create mysql user and group
#groupadd mysql
#useradd -g mysql mysql
Unpack mysql archive
# tar -zxf mysql-4.0.24.tar.gz Change your working directory to new mysql directory
#cd mysql-4.0.24/
Configure mysql with /usr/local/mysql base directory
#./configure --prefix=/usr/local/mysql
Build source files
#make
Install compiled files to the directory specified in prefix
#make install
Mysql uses a configuration file to determine some parameters on startup. It must be modified depending on your machine's capacity. Copy mysql configuration file and startup script for a medium sized system to /etc/my.cnf . Read my-*.cnf files for your own system on the untarred location of MySQL. Those files allow you to chose which file to use for your system.
#mkdir /etc/mysql/
#cp support-files/my-medium.cnf /etc/mysql/my.cnf
#cp support-files/mysql.server /etc/init.d/
#chmod 755 /etc/init.d/mysql.server
Go to base directory and create MySQL grant tables with mysql user (If this MySQL is your second
MySQL installation in your linux, defaults-file variable can be set to your new conf file)
#cd /usr/local/mysql
#bin/mysql_install_db --user=mysql
Change ownership of binaries to root and ownership of data directory to mysql user
#chown -R root .
#chown -R mysql var
#chgrp -R mysql .
Introduce new libraries to our Linux
#echo "/usr/local/mysql/lib/mysql" >> /etc/ld.so.conf
#ldconfig Start MySQL daemon
#/etc/init.d/mysql.server start
Connect to the MySQL server and give mysql root password. Since, there is no default root password
Please pay attention to this part, I have seen many who don't give any root password to their servers.
#/usr/local/mysql/bin/mysql -u root -

mysql> use mysql;
mysql> update user set password=Password(' 1234 ') where user='root';
mysql> flush privileges;
mysql>\q -

Now, MySQL will ask password for root user, enter password and your are in then exit and continue
to the rest of the setup. You will create some tables in this database server later.
#/usr/local/mysql/bin/mysql -u root -p
Add your mysql binaries path to your environmental variable PATH not to face with
mysql_config errors in courier imap compilation stage :) Don't forget to add this into your /etc/profile file -

#PATH=$PATH:/usr/local/mysql/bin
#export PATH
#echo "PATH=$PATH:/usr/local/mysql/bin" >> /etc/profile
#echo " export PATH" >> /etc/profile -

ZLIB INSTALLATION -

1.2.2 version is necessary for proper functioning of Clamav -

#cd /usr/local
#wget -c zlib.net/zlib-1.2.2.tar.gz
#tar -zxf zlib-1.2.2.tar.gz
#cd zlib-1.2.2
#./configure
#make
#make install -

BERKELEY DB

Berkeley DB is a requirement for Courier-imap server or Postfix.
If you have problems while installing postfix saying the file "db.h" isn't found
then visit postfix.org/LINUX_README.html - -

$cd /usr/local
$wget -c downloads.sleepycat.com/db-4.3.27.tar.gz
$tar -zxf db-4.3.27.tar.gz
$cd db-4.3.27/build_unix/
$../dist/configure --prefix=/usr/local/bdb
#make install
#echo "/usr/local/bdb/lib" >> /etc/ld.so.conf
#mkdir /usr/include/db
#ln -s /usr/local/bdb/include/db.h /usr/include/db/db.h
#ln -s /usr/local/bdb/include/db.h /usr/include/db.h
#ldconfig -

CYRUS SASL
Before installing CYRUS, you should know that mysql libraries are assumed to be
stored in /usr/local/mysql/lib/mysql and header files are in /usr/local/mysql/include/mysql
directories. If you are using Redhat, your mileage may differ a little bit. Yours will be probably
in /usr/lib/mysql or something like that. So don't panic if cyrus displays errors about libraries then start
looking for where your libraries are stored.
-

$cd /usr/local
$wget -c ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.20.tar.gz
$tar zxf cyrus-sasl-2.1.20.tar.gz
$cd cyrus-sasl-2.1.20
$export CPPFLAGS="-I/usr/local/mysql/include/mysql"
$./configure \
--enable-anon \
--enable-plain \
--enable-login \
--enable-sql \
--disable-krb4 \
--disable-otp \
--disable-cram \
--disable-digest \
--with-mysql=/usr/local/mysql/lib/mysql \
--without-pam \
--without-saslauthd \
--without-pwcheck \
--with-dblib=berkeley \
--with-bdb-libdir=/usr/local/bdb/lib \
--with-bdb-incdir=/usr/local/bdb/include \
--with-openssl=/usr/local/ssl \
--with-plugindir=/usr/local/lib/sasl2
$make
#make install
#ln -s /usr/local/lib/sasl2 /usr/lib/sasl2
#echo "/usr/local/lib/" >> /etc/ld.so.conf
#ldconfig -

POSTFIX
-

This the attention zone don't go witnout looking at these warnings;
Attention1: Many people reported me that they have experienced problems
installing postfix saying "the db.h file is not found " . I haven't received such an error
but you can have an answer for this error probably at postfix.org/LINUX_README.html - or one of the senders (Fraxon Hector Lubingu) told me that he solved this problem
with the commands below;
#ln -s /usr/local/bdb/include/db.h /usr/include/db/db.h
#ln -s /usr/local/bdb/include/db.h /usr/include/db.h

Since I am testing this setup on a Gentoo environment, the above commands don't work
for me. I don't have a /usr/include/db directory but if you have, these solution suggestions
may have a meaning for you.
-

Attention2 : If compiling postfix fails with ; - undefined reference to `pthread_condattr_setpshared'
undefined reference to `pthread_mutexattr_destroy'
undefined reference to `pthread_mutexattr_init'
undefined reference to `pthread_mutex_trylock'

Add the "-lpthread " library to the "make makefiles" command.
This means that your make makefiles command will be ;

make makefiles 'CCARGS=-DHAS_MYSQL \
-I/usr/local/mysql/include/mysql -DUSE_SASL_AUTH \
-I/usr/local/include/sasl -I/usr/local/bdb/include \
-DUSE_TLS -I/usr/local/ssl/include/openssl ' \
'AUXLIBS=-L/usr/local/mysql/lib/mysql -lmysqlclient \
-lz -lm -L/usr/local/lib -lsasl2 -L/usr/local/bdb/lib\
-L/usr/local/ssl/lib -lssl -lcrypto -lpthread ' '

instead of the one written below.

I hope you will not face with any problems other than these. Since I have
implemented this documentation, I have mainly received these error reports
from those who used this document. Now start installing postfix, if you receive
any errors return here and try to find the answer.

#cd /usr/local
#groupadd postfix -g 1000
#useradd postfix -u 1000 -g 1000
#groupadd postdrop
$wget -c ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.2.2.tar.gz
$tar -zxf postfix-2.2.2.tar.gz
$cd postfix-2.2.2
$ make makefiles 'CCARGS=-DHAS_MYSQL \
-I/usr/local/mysql/include/mysql -DUSE_SASL_AUTH \
-I/usr/local/include/sasl -I/usr/local/bdb/include \
-DUSE_TLS -I/usr/local/ssl/include/openssl ' \
'AUXLIBS=-L/usr/local/mysql/lib/mysql -lmysqlclient \
-lz -lm -L/usr/local/lib -lsasl2 -L/usr/local/bdb/lib\
-L/usr/local/ssl/lib -lssl -lcrypto'
#make install -

Postfix will ask some configuration questions. If you don't use sendmail,
don't hesitate to accept default values.

AddType application/x-httpd-php .php
AddType application/x-httpd-php .phtml
AddType application/x-httpd-php .php3 - Add also index.php to DirectoryIndex in httpd.conf so that apache can search for
index.php by default when a directory is requested.

DirectoryIndex index.html index.html.var index.php

Restart your apache and now you have ssl and php enabled apache. Keep installing :) don't get bored I know it is very long:) but I tried to eliminate most mistakes. I hope this helps you a little bit.

#/usr/local/apache2/bin/apachectl restart -
COURIER AUTHENTICATION LIBRARY

Courier has been changed a lot. I sometimes become tired to update this document. It changes really fast.You must install this authentication library for proper functioning.

#su - courier
$wget -c kent.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.55.tar.bz2
$tar -jxf courier-authlib-0.55.tar.bz2
$cd courier-authlib-0.55
$./configure \
--with-mysql-libs=/usr/local/mysql/lib/mysql\
--with-mysql-includes=/usr/local/mysql/include/mysql/ \
--with-authmysql --with-authmysql=yes
$make
#make install
#make install-configure - COURIER IMAP

Here are some important paramaters that we should reherse
before going further.

1) You have to extract courier-imap archive as a standard user and compile it with the same user
as well. I am not joking. Courier-imap documentation wants us to do it in this way.
2) If you use redhat instead of gentoo or slackware, you have to add " --with-redhat " text to the
configure step below.
3) Configure step of courier-imap takes a bit time. Don't think that this step has entered into a loop
in fact it hasn't.

$cd /usr/local
$wget -c easynews.dl.sourceforge.net/sourceforge/courier/courier-imap-4.0.2.tar.bz2
$tar jxf courier-imap-4.0.2.tar.bz2
$cd courier-imap-4.0.2
$ ./configure --enable-workarounds-for-imap-client-bugs \
--with-authchangepwdir --enable-unicode --with-trashquota
$make
#make install
#make install-configure
-

NOTE: If you encounter some problems while receving mail from pop3 or imap server
of courier please consult to courier-imap bug page inter7.com/courierimap/BUGS.txt

#groupadd vmail -g 1001
#useradd vmail -u 1001 -g 1001
#su - courier
$wget -c easynews.dl.sourceforge.net/sourceforge/courier/maildrop-1.8.0.tar.bz2
$tar -jxf maildrop-1.8.0.tar.bz2
$cd maildrop-1.8.0
$export CPPFLAGS="-I/usr/local/mysql/include"
$export LDFLAGS="-L/usr/local/mysql/lib"
$./configure --enable-maildirquota \
--enable-maildrop-uid=1001 \
--enable-maildrop-gid=1001 \
--with-trashquota
$make
#make install
#chown root /usr/local/bin/maildrop
#chmod u+s /usr/local/bin/maildrop

# export LANG=en_US
# perl -MCPAN -e shell
cpan> o conf prerequisites_policy ask
cpan> install Mail::SpamAssassin
cpan> q
# echo "export LANG=en_US" >> /etc/profile

#mysql -u root -p1234
mysql>CREATE DATABASE mail;
mysql>GRANT all privileges on mail.* TO vmailuser@localhost IDENTIFIED BY 'password123' ;
mysql>GRANT all privileges on mail.* TO vmailuser@127.0.0.1 IDENTIFIED BY 'password123' ;
mysql>GRANT all privileges on mail.* TO vmailuser@ mail.test.com IDENTIFIED BY 'password123' ;
mysql>\q
-

We have created our database and user, now it is time to insert data to our new database.
Write the lines written below in the box into a file called virtual_user.sql after paying attention
to the warnings below.

WARNING:
Please read these warnings before creating tables below. Since there may be some
default values which you may want to set for future use.

1) UID and GID values in postfix_users table which will be created below, must be the same as
vmail system user's IDs. i.e users that we have added with useradd commands to /etc/password file
In my setup vmail user ID and GID 1001. You can see that I have set these values in virtual_user.sql
file.
(For newbies: These id and gid numbers are 3. and 4. fields in /etc/passwd file)

2) There are four fields providing great flexibility in postfix_users table. Two of these fields ;

disablepop3 : If this field's value is " 1 " for a user, that user can not log in to his pop3 account instead
you recieve a message something like " POP3 access is disabled " . If the field is " 0 " pop3 access is allowed.
disableimap : When this field's value is "1 " for a user, that user can not log into his imap account and
recieve a message somethink like "IMAP access is disabled". If the field is "0" imap access is allowed.
We can't use disablewebmail field, if we don't use Sqwebmail software. But you can disable webmail
access, by disabling imap for a user through squirrelmail. Indirectly, this is what I do for my setup since
we don't use Sqwebmail.

3) By default in this setup, users are allowed to send e-mails by relaying through your mail
server after a successful sasl authentication. You can ask me that if user's authentication is
successful then we should allow him to send email through our smtp server. Is this always true?
What if you want your users to send mails through only webmail? Then you need an extra field.
Instead I have added an extra field to postfix_users table so that I can enable or disable smtp usage
based on where user entered into my system.
If smtpaccess field in postfix_users table is " N ", users can not use your smtp server for sending mail
even after succesfull authentication. This is a solution for me to provide sending mail through only webmail
and not to allow all users to send their mails using my mail server. I hope you understood what I am
trying to do. If you didn't, you will see how it is necessary when you use this system.

Save these lines in this box to virtual_user.sql file

CREATE TABLE postfix_alias (
id int(11) unsigned NOT NULL auto_increment,
alias varchar(128) NOT NULL default '',
destination varchar(128) NOT NULL default '',
PRIMARY KEY (id)
) TYPE=MyISAM;

CREATE TABLE postfix_relocated (
id int(11) unsigned NOT NULL auto_increment,
email varchar(128) NOT NULL default '',
destination varchar(128) NOT NULL default '',
PRIMARY KEY (id)
) TYPE=MyISAM;

CREATE TABLE postfix_transport (
id int(11) unsigned NOT NULL auto_increment,
domain varchar(128) NOT NULL default '',
destination varchar(128) NOT NULL default '',
PRIMARY KEY (id),
UNIQUE KEY domain (domain)
) TYPE=MyISAM;

CREATE TABLE postfix_virtual_domains (
id int(11) unsigned NOT NULL auto_increment,
domain varchar(128) NOT NULL default '',
destination varchar(128) NOT NULL default '',
PRIMARY KEY (id),
UNIQUE KEY domain (domain)
) TYPE=MyISAM;

CREATE TABLE postfix_users (
id int(11) unsigned NOT NULL auto_increment,
email varchar(128) NOT NULL default '',
clear varchar(128) NOT NULL default '',
crypt varchar(128) NOT NULL default '',
name tinytext NOT NULL,
uid int(11) unsigned NOT NULL default ' 1001 ',
gid int(11) unsigned NOT NULL default ' 1001 ',
homedir tinytext NOT NULL,
maildir tinytext NOT NULL,
quota tinytext NOT NULL,
access enum('Y','N') NOT NULL default 'Y',
postfix enum('Y','N') NOT NULL default 'Y',
disablepop3 char(1) NOT NULL default ' 0 ',
disableimap char(1) NOT NULL default ' 0 ',
disablewebmail char(1) NOT NULL default '0',
sharedgroup varchar(128) NOT NULL default '0',
smtpaccess enum('Y','N') NOT NULL default 'Y',

PRIMARY KEY (id),
UNIQUE KEY email (email)
) TYPE=MyISAM;

CREATE TABLE postfix_virtual (
id int(11) unsigned NOT NULL auto_increment,
email varchar(128) NOT NULL default '',
destination varchar(128) NOT NULL default '',
PRIMARY KEY (id)
) TYPE=MyISAM;

CREATE TABLE postfix_access (
id int(10) unsigned NOT NULL auto_increment,
source varchar(128) NOT NULL default '',
access varchar(128) NOT NULL default '',
type enum('recipient','sender','client') NOT NULL default 'recipient',
PRIMARY KEY (id)
) TYPE=MyISAM ;

- Lets create our new table

#mysql -u root -p1234 mail < virtual_user.sql


DIRECTORY STRUCTURE

Asume that you are using sendmail and you want to convert your directory structure to Maildir - format from mbox format. Because our new system use Maildir format, each email will be stored
in seperate files not in a big file which is the case in mbox format.
Each user will have a mail directory. e.g : you have an e-mail john@test.com.
Mail directory for this user will be "/home/vmail/test.com/john/Maildir " . By this way, all users's mail
directories will be created under their domain directory(test.com). This is so great, you keep users
of the same domain under the same directory.

CREATING DIRECTORIES FOR VIRTUAL SYSTEM

#mkdir /home/vmail
#chown vmail:vmail /home/vmail
#chmod 700 /home/vmail
-
POSTFIX

open /etc/postfix/master.cf file and change

flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}

into
flags=Ru user=vmail argv=/usr/local/bin/maildrop -d ${recipient}

Note: Don't forget the leading two spaces in this file.

After that,
open /etc/postfix/main.cf file and add the lines below in the box to the end of this file.

WARNING: Texts seperated by commas in main.cf must be written in one line.
Please be careful.

myhostname = mail.test.com
mydomain = test.com
mydestination = $myhostname
local_recipient_maps = $alias_maps $virtual_mailbox_maps unix:passwd.byname
home_mailbox = Maildir/

smtpd_sasl_auth_enable = yes
smtpd_sasl2_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,
check_recipient_access mysql:/etc/postfix/mysql-recipient.cf,reject_unauth_destination,permit
# The above line must be fitted in one line DONT FORGET
smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-sender.cf
smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-client.cf

alias_maps = mysql:/etc/postfix/mysql-aliases.cf
relocated_maps = mysql:/etc/postfix/mysql-relocated.cf

transport_maps = mysql:/etc/postfix/mysql-transport.cf
maildrop_destination_recipient_limit = 1
virtual_transport = maildrop
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-domains.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual.cf
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-maps.cf
virtual_uid_maps = mysql:/etc/postfix/mysql-virtual-uid.cf
virtual_gid_maps = mysql:/etc/postfix/mysql-virtual-gid.cf

# If you want to use TLS add three lines below
smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/postfix/postfix.pem
smtpd_tls_key_file = $smtpd_tls_cert_file


# OPTIONAL PART
smtpd_helo_required = yes
disable_vrfy_command = yes
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_etrn_restrictions = reject
-
Details about some directives declared in main.cf file:

info@mycompany.com sales@company.com info@othercompany.com info@other.dcom 
You need to get Postfix to start using the new database using the postmap command. 
 You must do 
 cd /etc/postfix 
 postmap hash:/etc/postfix/virtusertable - Catch All

smtpd_recipient_restrictions = reject_invalid_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, reject_unauth_pipelining permit_mynetworks, reject_non_fqdn_hostname 

spammer.com REJECT anotherspammer.com REJECT