| 1 | <?xml version='1.0' encoding='UTF-8'?> |
1 | <?xml version='1.0' encoding='UTF-8'?> |
| 2 | <!-- $Header: /var/cvsroot/gentoo/xml/htdocs/doc/en/virt-mail-howto.xml,v 1.39 2004/12/10 17:32:41 neysx Exp $ --> |
2 | <!-- $Header: /var/cvsroot/gentoo/xml/htdocs/doc/en/virt-mail-howto.xml,v 1.50 2006/04/09 07:42:45 fox2mike Exp $ --> |
| 3 | <!DOCTYPE guide SYSTEM "/dtd/guide.dtd"> |
3 | <!DOCTYPE guide SYSTEM "/dtd/guide.dtd"> |
| 4 | |
4 | |
| 5 | <guide link="/doc/en/virt-mail-howto.xml"> |
5 | <guide link="/doc/en/virt-mail-howto.xml"> |
| 6 | <title>Virtual Mailhosting System with Postfix Guide</title> |
6 | <title>Virtual Mailhosting System with Postfix Guide</title> |
| 7 | |
7 | |
| … | |
… | |
| 12 | <mail link="ezra@revoltltd.org">Ezra Gorman</mail> |
12 | <mail link="ezra@revoltltd.org">Ezra Gorman</mail> |
| 13 | </author> |
13 | </author> |
| 14 | <author title="Editor"> |
14 | <author title="Editor"> |
| 15 | <mail link="klasikahl@gentoo.org">Zack Gilburd</mail> |
15 | <mail link="klasikahl@gentoo.org">Zack Gilburd</mail> |
| 16 | </author> |
16 | </author> |
|
|
17 | <author title="Editor"> |
|
|
18 | <mail link="seather@scygro.za.net">Scygro</mail> |
|
|
19 | </author> |
| 17 | |
20 | |
| 18 | <abstract> |
21 | <abstract> |
| 19 | This document details how to create a virtual mailhosting system based upon |
22 | This document details how to create a virtual mailhosting system based upon |
| 20 | postfix, mysql, courier-imap, and cyrus-sasl. |
23 | postfix, mysql, courier-imap, and cyrus-sasl. |
| 21 | </abstract> |
24 | </abstract> |
| 22 | |
25 | |
| 23 | <version>1.0.16</version> |
26 | <version>1.0.27</version> |
| 24 | <date>2004-12-06</date> |
27 | <date>2006-04-09</date> |
| 25 | |
28 | |
| 26 | <!-- |
29 | <!-- |
| 27 | Contents |
30 | Contents |
| 28 | |
31 | |
| 29 | I. Introduction |
32 | I. Introduction |
| … | |
… | |
| 82 | needs. Consider investigating <uri>http://www.qmail.org/</uri> and |
85 | needs. Consider investigating <uri>http://www.qmail.org/</uri> and |
| 83 | <uri>http://www.exim.org/</uri> to explore your options. |
86 | <uri>http://www.exim.org/</uri> to explore your options. |
| 84 | </p> |
87 | </p> |
| 85 | |
88 | |
| 86 | <p> |
89 | <p> |
| 87 | The following packages are used in this setup: apache, courier-imap, pam_mysql, |
90 | The following packages are used in this setup: apache, courier-imap, courier-authlib |
| 88 | postfix, mod_php, phpmyadmin, squirrelmail, cyrus-sasl, mysql, php, and |
91 | postfix, mod_php, phpmyadmin, squirrelmail, cyrus-sasl, mysql, php, and |
| 89 | mailman. |
92 | mailman. |
| 90 | </p> |
93 | </p> |
| 91 | |
94 | |
| 92 | <p> |
95 | <p> |
| 93 | Make sure to turn on the following USE variables in <path>/etc/make.conf</path> |
96 | Make sure to turn on the following USE variables in <path>/etc/make.conf</path> |
| 94 | before compiling the packages: <c>USE="mysql pam-mysql imap libwww maildir |
97 | before compiling the packages: <c>USE="mysql imap libwww maildir |
| 95 | sasl ssl"</c>. Otherwise you will most likely have to recompile things to |
98 | sasl ssl"</c>. Otherwise you will most likely have to recompile things to |
| 96 | get the support you need for all the protocols. Further, it's a good idea to |
99 | get the support you need for all the protocols. Further, it's a good idea to |
| 97 | turn off any other mail and network variables, like ipv6. |
100 | turn off any other mail and network variables, like ipv6. |
| 98 | </p> |
101 | </p> |
| 99 | |
102 | |
| … | |
… | |
| 213 | <chapter> |
216 | <chapter> |
| 214 | <title>Courier-imap</title> |
217 | <title>Courier-imap</title> |
| 215 | <section> |
218 | <section> |
| 216 | <body> |
219 | <body> |
| 217 | |
220 | |
| 218 | <pre caption="Install courier-imap"> |
221 | <pre caption="Install courier-imap and courier-authlib"> |
| 219 | # <i>emerge courier-imap</i> |
222 | # <i>emerge courier-imap courier-authlib</i> |
| 220 | </pre> |
223 | </pre> |
| 221 | |
224 | |
| 222 | <pre caption="Courier-imap configuration"> |
225 | <pre caption="Courier-imap configuration"> |
| 223 | # <i>cd /etc/courier-imap</i> |
226 | # <i>cd /etc/courier-imap</i> |
| 224 | <comment>(If you want to use the ssl capabilities of courier-imap or pop3, |
227 | <comment>(If you want to use the ssl capabilities of courier-imap or pop3, |
| … | |
… | |
| 257 | <section> |
260 | <section> |
| 258 | <body> |
261 | <body> |
| 259 | |
262 | |
| 260 | <p> |
263 | <p> |
| 261 | Next we're going to install cyrus-sasl. Sasl is going to play the role of |
264 | Next we're going to install cyrus-sasl. Sasl is going to play the role of |
| 262 | actually passing your auth variables to pam, which will in turn pass that |
265 | actually passing your auth variables to courier-auth, which will in turn pass that |
| 263 | information to mysql for authentication of smtp users. For this howto, we'll |
266 | information to mysql for authentication of smtp users. For this howto, we'll |
| 264 | not even try to verify that sasl is working until mysql is set up and contains |
267 | not even try to verify that sasl is working until mysql is set up and contains |
| 265 | a test user. Which is fine since we'll be authenticating against mysql in the |
268 | a test user. Which is fine since we'll be authenticating against mysql in the |
| 266 | end anyway. |
269 | end anyway. |
| 267 | </p> |
270 | </p> |
| 268 | |
271 | |
| 269 | <note> |
|
|
| 270 | Now for some reason, sasl will not play nicely with pam against the shadow |
|
|
| 271 | file. I banged my head against this problem for, well, a long time. If anyone |
|
|
| 272 | knows why sasl will not auth against the shadow file in its current gentoo |
|
|
| 273 | incarnation, please <mail link="ken@kickasskungfu.com">email me</mail> as I'd |
|
|
| 274 | love to hear a solution to this. |
|
|
| 275 | </note> |
|
|
| 276 | |
|
|
| 277 | <pre caption="Configuring and installing the cyrus-sasl ebuild"> |
272 | <pre caption="Configuring and installing the cyrus-sasl ebuild"> |
| 278 | <comment>(We don't have ldap and we're using sasl's mysql capabilities |
|
|
| 279 | so we need to set the appropriate USE flags, but only if your USE flags |
|
|
| 280 | doesn't already contain the mysql USE flag and not the ldap one)</comment> |
|
|
| 281 | # <i>mkdir /etc/portage</i> |
|
|
| 282 | # <i>echo "dev-libs/cyrus-sasl -ldap mysql" >> /etc/portage/package.use</i> |
|
|
| 283 | # <i>emerge cyrus-sasl</i> |
273 | # <i>emerge cyrus-sasl</i> |
| 284 | </pre> |
274 | </pre> |
| 285 | |
275 | |
| 286 | <p> |
276 | <p> |
| 287 | Next, edit <path>/etc/sasl2/smtpd.conf</path>. |
277 | Next, edit <path>/etc/sasl2/smtpd.conf</path>. |
| 288 | </p> |
278 | </p> |
| 289 | |
279 | |
| 290 | <pre caption="Starting sasl"> |
280 | <pre caption="Starting sasl"> |
| 291 | # <i>nano -w /etc/sasl2/smtpd.conf</i> |
281 | # <i>nano -w /etc/sasl2/smtpd.conf</i> |
| 292 | pwcheck_method: auxprop |
282 | mech_list: PLAIN LOGIN |
| 293 | auxprop_plugin: sql |
|
|
| 294 | sql_engine: mysql |
|
|
| 295 | sql_hostnames: localhost |
|
|
| 296 | sql_user: mailsql |
|
|
| 297 | sql_passwd: <comment><password></comment> |
|
|
| 298 | sql_database: mailsql |
|
|
| 299 | sql_select: select clear from users where email = '%u@%r' |
|
|
| 300 | mech_list: plain login |
|
|
| 301 | pwcheck_method: saslauthd |
283 | pwcheck_method: saslauthd |
| 302 | mech_list: LOGIN PLAIN |
284 | # <i>nano -w /etc/conf.d/saslauthd</i> |
| 303 | <comment>(It's important to turn off auth methods we are not using. |
285 | SASLAUTHD_OPTS="${SASLAUTH_MECH} -a rimap -r" |
| 304 | They cause problems for some mail clients.)</comment> |
286 | SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -O localhost" |
| 305 | # <i>/etc/init.d/saslauthd start</i> |
287 | # <i>/etc/init.d/saslauthd start</i> |
| 306 | </pre> |
288 | </pre> |
| 307 | |
289 | |
| 308 | </body> |
290 | </body> |
| 309 | </section> |
291 | </section> |
| … | |
… | |
| 395 | permit_sasl_authenticated, |
377 | permit_sasl_authenticated, |
| 396 | permit_mynetworks, |
378 | permit_mynetworks, |
| 397 | reject_unauth_destination |
379 | reject_unauth_destination |
| 398 | |
380 | |
| 399 | |
381 | |
|
|
382 | <comment>(The next two options enable outgoing encryption.)</comment> |
|
|
383 | smtp_use_tls = yes |
|
|
384 | smtp_tls_note_starttls_offer = yes |
| 400 | smtpd_use_tls = yes |
385 | smtpd_use_tls = yes |
| 401 | #smtpd_tls_auth_only = yes |
386 | #smtpd_tls_auth_only = yes |
| 402 | smtpd_tls_key_file = /etc/postfix/newreq.pem |
387 | smtpd_tls_key_file = /etc/postfix/newreq.pem |
| 403 | smtpd_tls_cert_file = /etc/postfix/newcert.pem |
388 | smtpd_tls_cert_file = /etc/postfix/newcert.pem |
| 404 | smtpd_tls_CAfile = /etc/postfix/cacert.pem |
389 | smtpd_tls_CAfile = /etc/postfix/cacert.pem |
| … | |
… | |
| 477 | # <i>mysql -u root -p mysql</i> |
462 | # <i>mysql -u root -p mysql</i> |
| 478 | mysql> <i>GRANT SELECT,INSERT,UPDATE,DELETE</i> |
463 | mysql> <i>GRANT SELECT,INSERT,UPDATE,DELETE</i> |
| 479 | -> <i>ON mailsql.*</i> |
464 | -> <i>ON mailsql.*</i> |
| 480 | -> <i>TO mailsql@localhost</i> |
465 | -> <i>TO mailsql@localhost</i> |
| 481 | -> <i>IDENTIFIED BY '$password';</i> |
466 | -> <i>IDENTIFIED BY '$password';</i> |
|
|
467 | Query OK, 0 rows affected (0.02 sec) |
| 482 | |
468 | |
| 483 | -> <i>quit</i> |
469 | mysql> <i>FLUSH PRIVILEGES;</i> |
|
|
470 | Query OK, 0 rows affected (0.00 sec) |
|
|
471 | |
|
|
472 | mysql> <i>quit</i> |
| 484 | <comment>(Verify that the new mailsql user can connect to the mysql server.)</comment> |
473 | <comment>(Verify that the new mailsql user can connect to the mysql server.)</comment> |
| 485 | |
474 | |
| 486 | # <i>mysql -u mailsql -p mailsql</i> |
475 | # <i>mysql -u mailsql -p mailsql</i> |
| 487 | </pre> |
476 | </pre> |
| 488 | |
477 | |
| … | |
… | |
| 670 | courier-imap and postfix. In all of the following examples, replace |
659 | courier-imap and postfix. In all of the following examples, replace |
| 671 | <c>$password</c> with the password you set for the mailsql mysql user. |
660 | <c>$password</c> with the password you set for the mailsql mysql user. |
| 672 | </p> |
661 | </p> |
| 673 | |
662 | |
| 674 | <pre caption="Configuring authentication"> |
663 | <pre caption="Configuring authentication"> |
| 675 | # <i>emerge pam_mysql</i> |
|
|
| 676 | # <i>nano -w /etc/pam.d/imap</i> |
|
|
| 677 | <comment>(Comment out the existing auth lines and add the following as shown.)</comment> |
|
|
| 678 | |
|
|
| 679 | #auth required pam_nologin.so |
|
|
| 680 | #auth required pam_stack.so service=system-auth |
|
|
| 681 | #account required pam_stack.so service=system-auth |
|
|
| 682 | #session required pam_stack.so service=system-auth |
|
|
| 683 | |
|
|
| 684 | auth optional pam_mysql.so host=localhost db=mailsql user=mailsql \ |
|
|
| 685 | passwd=$password table=users usercolumn=email passwdcolumn=clear crypt=0 |
|
|
| 686 | account required pam_mysql.so host=localhost db=mailsql user=mailsql \ |
|
|
| 687 | passwd=$password table=users usercolumn=email passwdcolumn=clear crypt=0 |
|
|
| 688 | |
|
|
| 689 | # <i>nano -w /etc/pam.d/pop3</i> |
|
|
| 690 | # <i>nano -w /etc/pam.d/smtp</i> |
|
|
| 691 | <comment>(Make the same changes to the pop3 and smtp files.)</comment> |
|
|
| 692 | </pre> |
|
|
| 693 | |
|
|
| 694 | <p> |
|
|
| 695 | Next, we need to edit courier's authentication config's. |
|
|
| 696 | </p> |
|
|
| 697 | |
|
|
| 698 | <pre caption="Configuring authentication"> |
|
|
| 699 | # <i>nano -w /etc/courier-imap/authdaemonrc</i> |
664 | # <i>nano -w /etc/courier/authlib/authdaemonrc</i> |
| 700 | authmodulelist="authmysql authpam" |
665 | authmodulelist="authmysql authpam" |
| 701 | |
666 | |
| 702 | # <i>nano -w /etc/courier-imap/authdaemond.conf</i> |
|
|
| 703 | AUTHDAEMOND="authdaemond.mysql" |
|
|
| 704 | |
|
|
| 705 | # <i>nano -w /etc/courier-imap/authmysqlrc</i> |
667 | # <i>nano -w /etc/courier/authlib/authmysqlrc</i> |
| 706 | MYSQL_SERVER localhost |
668 | MYSQL_SERVER localhost |
| 707 | MYSQL_USERNAME mailsql |
669 | MYSQL_USERNAME mailsql |
| 708 | MYSQL_PASSWORD $password |
670 | MYSQL_PASSWORD $password |
| 709 | MYSQL_DATABASE mailsql |
671 | MYSQL_DATABASE mailsql |
| 710 | MYSQL_USER_TABLE users |
672 | MYSQL_USER_TABLE users |
| … | |
… | |
| 716 | MYSQL_LOGIN_FIELD email |
678 | MYSQL_LOGIN_FIELD email |
| 717 | MYSQL_HOME_FIELD homedir |
679 | MYSQL_HOME_FIELD homedir |
| 718 | MYSQL_NAME_FIELD name |
680 | MYSQL_NAME_FIELD name |
| 719 | MYSQL_MAILDIR_FIELD maildir |
681 | MYSQL_MAILDIR_FIELD maildir |
| 720 | |
682 | |
| 721 | # <i>/etc/init.d/authdaemond restart</i> |
683 | # <i>/etc/init.d/courier-authlib restart</i> |
| 722 | # <i>/etc/init.d/saslauthd restart</i> |
684 | # <i>/etc/init.d/saslauthd restart</i> |
| 723 | </pre> |
685 | </pre> |
| 724 | |
686 | |
| 725 | <p> |
687 | <p> |
| 726 | We're almost there I promise! Next, set up the rest of the necessary config's |
688 | We're almost there I promise! Next, set up the rest of the necessary config's |
| … | |
… | |
| 890 | <section> |
852 | <section> |
| 891 | <body> |
853 | <body> |
| 892 | |
854 | |
| 893 | <pre caption="Install squirrelmail"> |
855 | <pre caption="Install squirrelmail"> |
| 894 | # <i>emerge squirrelmail</i> |
856 | # <i>emerge squirrelmail</i> |
| 895 | <comment>(I like to add a link to the htdocs space for a shorter url.)</comment> |
857 | <comment>(Install squirrelmail to localhost so that it's accessed by http://localhost/mail) |
|
|
858 | (Substitute 1.4.3a-r2 with the version you use)</comment> |
| 896 | |
859 | |
| 897 | # <i>ln -s /var/www/localhost/htdocs/squirrelmail/ /var/www/localhost/htdocs/mail</i> |
860 | # <i>webapp-config -I -h localhost -d /mail squirrelmail 1.4.3a-r2</i> |
| 898 | # <i>cd /var/www/localhost/htdocs/mail/config</i> |
861 | # <i>cd /var/www/localhost/htdocs/mail/config</i> |
| 899 | # <i>perl ./conf.pl</i> |
862 | # <i>perl ./conf.pl</i> |
| 900 | <comment>(Change your Organization, Server, and Folder settings for squirrelmail. |
863 | <comment>(Change your Organization, Server, and Folder settings for squirrelmail. |
| 901 | Now you should be able to login to squirrelmail, again - with your full email address, |
864 | Now you should be able to login to squirrelmail, again - with your full email address, |
| 902 | and use your new webmail setup.)</comment> |
865 | and use your new webmail setup.)</comment> |
| … | |
… | |
| 921 | </p> |
884 | </p> |
| 922 | |
885 | |
| 923 | <p> |
886 | <p> |
| 924 | One further note, current versions of mailman install to /usr/local/mailman. If |
887 | One further note, current versions of mailman install to /usr/local/mailman. If |
| 925 | you're like me and wish to change the default install location, it can be |
888 | you're like me and wish to change the default install location, it can be |
| 926 | overridden in the ebuild filoe by changing the INSTALLDIR variable. |
889 | overridden in the ebuild file by changing the INSTALLDIR variable. |
| 927 | </p> |
|
|
| 928 | |
|
|
| 929 | <pre caption="/usr/portage/net-mail/mailman/mailman-$ver.ebuild"> |
|
|
| 930 | # <i>nano -w /usr/portage/net-mail/mailman/mailman-$ver.ebuild</i> |
|
|
| 931 | MAILGID="280" |
|
|
| 932 | <comment>(Set MAILGID to the mailman group instead of nobody |
|
|
| 933 | This is needed for postfix integration.)</comment> |
|
|
| 934 | </pre> |
890 | </p> |
| 935 | |
891 | |
| 936 | <pre caption="Install mailman"> |
892 | <pre caption="Install mailman"> |
| 937 | # <i>emerge mailman</i> |
893 | # <i>emerge mailman</i> |
| 938 | <comment>(This package is currently masked as well, so you'll need to unmask it or give |
|
|
| 939 | emerge an explicit path to the ebuild. Once it's installed, follow the directions |
|
|
| 940 | in the README.gentoo.gz *except* do not add your aliases to /etc/mail/aliases. |
|
|
| 941 | We will instead be linking the entire alias db into postfix.)</comment> |
|
|
| 942 | |
|
|
| 943 | # <i>zless /usr/share/doc/mailman-$ver/README.gentoo.gz</i> |
|
|
| 944 | </pre> |
894 | </pre> |
| 945 | |
895 | |
| 946 | <pre caption="Setting defaults: Mailman/Defaults.py"> |
896 | <pre caption="Setting defaults: Mailman/Defaults.py"> |
| 947 | # <i> nano -w /var/mailman/Mailman/Defaults.py</i> |
897 | # <i> nano -w /var/mailman/Mailman/Defaults.py</i> |
| 948 | <comment>(Change the values below to reflect your primary domain, virtuals will be set next.)</comment> |
898 | <comment>(Change the values below to reflect your primary domain, virtuals will be set next.)</comment> |
| … | |
… | |
| 1030 | <title>Content Filtering and Anti-Virus</title> |
980 | <title>Content Filtering and Anti-Virus</title> |
| 1031 | <section> |
981 | <section> |
| 1032 | <body> |
982 | <body> |
| 1033 | |
983 | |
| 1034 | <p> |
984 | <p> |
| 1035 | Coming soon...it would be done already but I need some perl help and testing to |
985 | For content filtering and Anti-Virus, please consult our <uri |
| 1036 | make it so. If you'd like to volunteer for that, please email me. |
986 | link="/doc/en/mailfilter-guide.xml">mail filtering gateway guide</uri>. |
| 1037 | </p> |
987 | </p> |
| 1038 | |
988 | |
| 1039 | </body> |
989 | </body> |
| 1040 | </section> |
990 | </section> |
| 1041 | </chapter> |
991 | </chapter> |
Parent Directory
| 
Revision Log
| 
Patch