Posts Tagged postfix
Posted by mike Filed Under Cyrus-Imap with Comments Off
One nice feature of cyrus IMAP is that it does support quotas. Quotas are applied on the basis of the mailbox and any sub-mailboxes that do not have quotas. This means that a mailbox can only have or be a part of one quota. When mail arrives the quota is checked to verify that the mail will not cause the quota to be exceeded, THE MAIL WILL STILL BE DELEVERED; however, the user will be notified they are over the limit. If the mailbox is already over the limit when the mail arrives it will not be accepted.
Posted by mike Filed Under Multiple Domains with Comments Off
Mailbox Ownership
The mailboxes must each be owned by a user and connected to a group on the system. There are two directives which determine the ownership of mailboxes for users and groups.
virtual_uid_maps
virtual_gid_maps
It is possible to set a static map which means that one user will own all of the mailboxes of one domain. If you were setting up a static map with an account called vmail which had a UID of 1023 and a GID of 1024 you would setup the static map like this in the main.cf:
virtual_uid_maps = static:1023
virtual_gid_maps = static:1024
In order to set up different UIDs for each mailbox you would have to create a lookup file that would map addresses to the UIDs. In main.cf you must add a line that would access this file.
virtual_uid_maps = hash:/etc/postifix/virtual_uids
If you need the majority of mailboxes to be set up with one UID but several need static maps it would look like this:
virtual_uid_maps = hash:/etc/postifix/virtual_uids static:1023
Groups work the same way as the UIDs.
It is easier to create the UID and GID that are static this way:
Create the user virtual and group. Take note of the UID and GID.
useradd virtual -u 1000
groupadd virtual -g 1000
In this example if the UID and GID of virtual were 1000 this line in the main.cf would look like this.
virtual_uid_maps = static:1000
virtual_gid_maps = static:1000
Change the permissions on the vmail directory so virtual can read all mail.
chown -R virtual:virtual /var/spool/vhosts
chmod 700 /var/spool/vhosts
Permissions on Working Virtual Mailbox
drwx—— 8 virtual virtual 4096 Sep 17 13:14 .
drwxr-xr-x 8 virtual virtual 4096 Feb 9 2008 ..
drwxr-xr-x 2 virtual virtual 4096 Sep 17 13:14 cur
-rw——- 1 virtual virtual 168 Sep 17 13:13 dovecot.index
-rw——- 1 virtual virtual 20480 Sep 17 13:13 dovecot.index.cache
-rw——- 1 virtual virtual 1760 Sep 17 13:14 dovecot.index.log
-rw——- 1 virtual virtual 428 Sep 17 13:13 dovecot-uidlist
drwx—— 5 virtual virtual 4096 Sep 14 03:24 .Drafts
drwxr-xr-x 2 virtual virtual 4096 Sep 17 13:13 new
drwx—— 5 virtual virtual 4096 Sep 14 03:24 .Sent
-rw——- 1 virtual virtual 18 Feb 9 2008 subscriptions
drwxr-xr-x 2 virtual virtual 4096 Sep 17 13:13 tmp
drwx—— 5 virtual virtual 4096 Feb 9 2008 .Trash
Posted by mike Filed Under Security with Comments Off
When you set up Postfix it is a critical service for your organization. It is important that you set up a way to verify that the mail server is up and running. Nagios 3 provides an easy set up to allow you to monitor your mail server. This tutorial will help you understand how to add mail service checks for your Postfix Mail Server. If you need help in setting up Nagios 3 please check THIS ARTICLE.
Step #1: Add a Host
An easy way to start setting up hosts is to choose a web server to monitor.
You will need to edit /etc/nagios3/Define your host, give it a host name and an alias, be sure to have the correct IP Address. Use the check_http command which will monitor your web server on port 80 tcp. This is a much easier way to monitor a web server using icmp because you have to modify so many firewalls to allow icmp.
define host{
use generic-host
host_name mail
alias mail
address 192.168.5.12
check_command check_smtp
max_check_attempts 10
notification_interval 120
notification_period 24×7
notification_options d,u,r
contact_groups admins
}
Step #2: Add Host to a Service
Edit the /etc/nagios3/conf.d/generic-service_nagios2.cfg. If you are using the same service you can just add the second host to the host_name line. This will make it very easy to add a number of hosts to modify. Note two host names listed.
define service{
use generic-service
host_name mail
service_description SMTP
check_command check_smtp
}
Step #3: Check Configuration and Restart
You will want to run this command to check your pre-flight check to verify you do not have typos or other errors.
nagios -v /etc/nagios3/nagios.cfg
This should result in no errors and no warnings before you proceed.
Now restart nagios and the web server for nagios.
/etc/init.d/nagios3 restart
/etc/init.d/apache2 restart
Now access the web interface of Nagios at:
http://your_ip_address/nagios3
You should see that the service is being monitored.
Posted by mike Filed Under Spam Control with 2 Comments
SpamAssassin will use tests to check mail headers, the body, IP Addresses and checksums to locate patterns that indicate SPAM. So SpamAssassin will use pattern-based scores for checking patters that are found in headers, the body or attachments and it will use network-based tests that use DNS lookups or access RBL lists.
If you look in the /usr/share/spamassassin directory you will see a list of the tests that are performed by SpamAssassin.
The tests which are used by SpamAssassin and thus amavisd are located in /usr/share/spamassassin. These consist of over 1000 tests on various parts of the email that arrives. It also includes checks for known spammers. There are thousands of rules that are set up in the /usr/share/spamassassin directory. Each test file contains a number of rules that will be performed. The test files are basically self explanatory but here is some additional information that will help. Ratware are programs that are used by spammers to send their email. These specially designed programs have signatures that will be detected. The 10_misc.cf is a file that defines the templates that are used to report spam. The 20_compensate.cf file creates negative scores for good values in mail that indicate that the mail is not spam. The 50_scores.cf is the file that contains the scores for each rule. 60_whitelist.cf is where common addresses are listed. Here is a list of the directory.
# ls /usr/share/spamassassin/
10_misc.cf 25_accessdb.cf 30_text_nl.cf
20_advance_fee.cf 25_antivirus.cf 30_text_pl.cf
20_anti_ratware.cf 25_body_tests_es.cf 30_text_pt_br.cf
20_body_tests.cf 25_body_tests_pl.cf 50_scores.cf
20_compensate.cf 25_dcc.cf 60_awl.cf
20_dnsbl_tests.cf 25_dkim.cf 60_whitelist.cf
20_drugs.cf 25_domainkeys.cf 60_whitelist_dk.cf
20_fake_helo_tests.cf 25_hashcash.cf 60_whitelist_dkim.cf
20_head_tests.cf 25_pyzor.cf 60_whitelist_spf.cf
20_html_tests.cf 25_razor2.cf 60_whitelist_subject.cf
20_meta_tests.cf 25_replace.cf languages
20_net_tests.cf 25_spf.cf sa-update-pubkey.txt
20_phrases.cf 25_textcat.cf sa-update.cron
20_porn.cf 25_uribl.cf triplets.txt
20_ratware.cf 30_text_de.cf user_prefs.template
20_uri_tests.cf 30_text_fr.cf
23_bayes.cf 30_text_it.cf
Here is an example taken from the 20_head_tests.cf file. Note that some tests require a specific version which is listed at the top. The test is listed in CAPS with underscores followed by the regular expression used to evaluate the rule that is listed. The line underneath provides a description of the rule. The score for each rule is listed in 50_scores.cf.
require_version 3.001007
header HEAD_LONG eval:check_msg_parse_flags(‘truncated_header’)
describe HEAD_LONG Message headers are very long
# partial messages; currently-theoretical attack
# unsurprisingly this hits 0/0 right now.
header FRAGMENTED_MESSAGE Content-Type =~ /\bmessage\/partial/i
describe FRAGMENTED_MESSAGE Partial message
header MISSING_HB_SEP eval:check_msg_parse_flags(‘missing_head_body_separator’)
describe MISSING_HB_SEP Missing blank line between message header and body
header UNPARSEABLE_RELAY eval:check_relays_unparseable()
tflags UNPARSEABLE_RELAY userconf
describe UNPARSEABLE_RELAY Informational: message has unparseable relay lines
Each test looks similar to what you see here. These are header test so they start with the work “header” followed by the name of the test in CAPS. The actual expression of the test is on the right hand side. The first one is a regular expression that shows that there is not real name in the header. The second line is a description of the test. The second test listed shows that the From is a blank line and tests for that with a regular expression.
header NO_REAL_NAME From =~ /^["\s]*\<?\S+\@\S+\>?\s*$/
describe NO_REAL_NAME From: does not include a real name
header FROM_BLANK_NAME From =~ /(?:\s|^)”" <\S+>/i
describe FROM_BLANK_NAME From: contains empty name
Each test has a score that is associated with it in the 50_scores.cf file which is also located in /usr/share/spamassassin. The score adds to the email total score which determines if it is Spam.
score NO_REAL_NAME 0 0.550 0 0.961
The scores have 4 fields. The first is the score added is if a matching message has both the network and Bayesian tests are not in use. In NO_REAL_NAME this is 0. The second score is when network tests are in use and Bayesian tests are not in use. The third score is when Bayesian tests are in use but network tests are not. The final score is when both network tests and Bayesian are in use.
score FROM_BLANK_NAME 1.659 1.467 0.936 1.534
Posted by mike Filed Under Spam Control with Comments Off
One way you may choose to manage the mail that comes to the Postfix server is to use the locales which is a part of Spamassassin. If you cannot read other languages there is really no need to run them through your mail system. So for example if you wanted to limit email to English you would edit the:
/etc/mail/spamassassin/local.cf
ok_locales en
This will treat any mail in character sets other than Western as spam. Here are the option that you have:
en – Western character sets in general
ja – Japanese character sets
ko – Korean character sets
ru – Cyrillic character sets
th – Thai character sets
zh – Chinese (both simplified and traditional) character sets
all – Allow all character sets
This is an easy setting to help clean up mail that you cannot read anyway.
Posted by mike Filed Under Squirrelmail with Comments Off
IMAP offers the flexibility that most people want with email. Access mail from different computers, locations and also access from PDAs, TV, etc. IMAP by default stores mail on a central server that provides access to a mail account from anywhere in the world.
SquirrelMail is a standards-based program that offers you an easy way to set up an IMAP web based email server. It is written in PHP4 and provides support for both IMAP and SMTP. One advantage of SquirrelMail is that the javaScript is an option not a requirement for users making it more browser compatible. The setup on a CentOS or RHEL server is an effective way to provide email access to roaming users from an office or from home.
Requirements
In order to use Squirrelmail you must have installed:
Apache
PHP4.1.2 or better
IMAP
Browser – cookies must be enabled
Install
SquirrelMail has become an option for install on most Linux distributions.
Centos
yum install squirrelmail
Ubuntu
apt-get install squirrelmail
SquirrelMail is installed in /usr/share/squirrelmail typically.
Some directories for queuing & attachments are set up in /var/lib.
The config files are found in /etc/squirrelmail.
A config file for httpd is added to /etc/http/conf.d which creates the alias, webmail for SquirrelMail. The webmail alias allows you to access SquirrelMail by using the link, http://example.org/webmail
This will then bring up the login for the server. A cron job is activated to purge the attachments directory.
/etc/cron.daily/squirrelmail.cron
Posted by mike Filed Under Filters with Comments Off
Listed here are a number of header checks that do work but they are ineffective for the most part. Here is the problem. When you look at these examples they have a Subject that you are searching for. As a result you will be writing header checks until the day you die, not good. My thinking is that you will want to discard this methodology for header checks that are more general and throw a wider net over the problem. Two reason for this are; first you have SpamAssassin or some other program to do actual Spam testing later. Second, you need to preserver resources on your Postfix mail server. Actually this is the most important aspect of what you are doing is trying to save yourself money and time by reducing the load on your server. If you place too many header checks in Postfix you will begin to see a speed loss and resource loss.
So review your header checks and make sure you are using each line wisely.
/^Subject: Get Viagra Online Now !!!/ REJECT
/^Subject: ENLARGE YOUR PACAKGE GUARANTEED/ REJECT
/^Subject: Add REAL Inches To Your Package! GUARANTEED/ REJECT
/^Subject: At Last, Herbal V, the All Natural Alternative!/ REJECT
/^Subject: Have Hair Loss? We Can Help You!\.\.Read on\.\./ REJECT
/^Subject: Pill to Increase Your Ejaculation by \d{3}%/ REJECT
/^Subject: free trial herbal viagra good for men and women/ REJECT
/^Subject: STAYING POWER/ REJECT
/^Subject: Isn\’t It Time You Solved Your \”little\” Problem\?\s*\d{2,6}/ REJECT
/^Subject: Non Prescription Alternative to Viagra/ REJECT
# financial / money
/^Subject: INSTANT Daily PAY!/ REJECT
/^Subject: INSTANT Pay to \$\d{2,3} A Day!/ REJECT
/^Subject: The easiest way to make money on the internet!/ REJECT
/^Subject: INTEREST RATES HAVE DROPPED/ REJECT !
/^Subject: Make Money In Your Sleep! / REJECT
/^Subject: Lowest Rates In Years! / REJECT
/^Subject: make money now!!!!!/ REJECT
/^Subject: HOME-BASED BUSINESSES / REJECT
/^Subject: Sick of paying and paying and staying in debt? / REJECT
/^Subject: Recession Hurts!/ REJECT
/^Subject: Got Debt\?\s*Cut Your Bills in HALF!/ REJECT
/^Subject: Double your policy at No Extra Cost!/ REJECT
/^Subject: Make \d{2}% Yearly Fully Secured!/ REJECT
/^Subject: Have tax problems?\s*\[\w{4,6}\]/ REJECT
/^Subject: Got a Mortgage\?\s{1,9}\d.\d{2}% Fixed Rate Mortgage/ REJECT
/^Subject: Rates Have Fallen Again!\s{1,9}\d.\d{2}% Fixed Rate Mortgage/ REJECT
/^Subject: Take Advantage of Falling Interest Rates!/ REJECT
/^Subject: Double Your Life Insurance at NO EXTRA COST!/ REJECT
/^Subject: Got Debt\?.*\[\w{4,6}\\]/ REJECT
/^Subject: Are you in debt\?\s*\[\w{4,6}\\]/ REJECT
/^Subject: Refinance rates as low as \d.\d{2}%/ REJECT
/^Subject: Hot Casino Action – \d{2,3}% Bonus/ REJECT
/^Subject: Double your policy at No Extra Cost!/ REJECT
/^Subject: Need More Life Insurance\? Double it for No Extra Cost/ REJECT
/^Subject: Did you get your money\?/ REJECT
/^Subject: Tired of dropping stock prices\?\d{1,6}/ REJECT
/^Subject: \d{2,6}\s*Work From Home / REJECT
/^Subject: Debt Consolidation.\s*\[\w{4,6}\]/ REJECT
/^Subject: Mortgage interest rates are lowered AGAIN/ REJECT
/^Subject: Re: Easy money! Muy dinero! \(/ REJECT
/^Subject: Feel the Excitement of CyberXCasino/ REJECT
/^Subject: Free Loan Quotations\.\.\.\.\.Lower your Rate!/ REJECT
/^Subject: Free Vacation$/ REJECT
/^Subject: GUARANTEED MONTHLY INCOME- Join FREE NOW!/ REJECT
/^Subject: Is your mortgage APR as low as \d.\d{2}/ REJECT
/^Subject: Tired of the 40 X 40.*\?/ REJECT
/^Subject: NEVER REPAY, FREE CASH GRANTS\.*\s*\d{2,7}$/ REJECT
/^Subject: Are You Making \$\w{2,}\+ A Month Online\?\s*\d{2,7}$/ REJECT
/^Subject: Secure Your Financial Future!$/ REJECT
/^Subject: \d{2,3}% OFF Your Life Insurance/ REJECT
# piracy
/^Subject: Copy Your Favorite DVD Movies !!!/ REJECT
/^Subject: EASILY COPY ANY DVD MOVIE FOR FREE!/ REJECT
/^Subject: Favorite Movie not on DVD?/ REJECT
# random
/^Subject: Try this, it really works! / REJECT
/^Subject: Increased Emotional Stability / REJECT
/^Subject: Free Travel/ REJECT
/^Subject: Chart Returns – Charles Taylor / REJECT
/^Subject: You could search for a year and\.\.\.\.\./ REJECT
/^Subject: Escape the Ordinary\.\.\.\.\.\.New Opportunity for you\.\./ REJECT
/^Subject: This Is What You’ve Been Waiting For\..*\d{2,6}/ REJECT
/^Subject: Get Rid of those Paper Piles!\s*\d{2,6}/ REJECT
/^Subject: Imaging Software for the Home.*\d{2,6}/ REJECT
/^Subject: End static on the cell/ REJECT
/^Subject: Free Trials & HBC Updates!/ REJECT
/^Subject: Free Trials from Home Business Connection/ REJEC
/^Subject: Fw: Marketing your product or service just got easier!/ REJECT
/^Subject: Re: I did not hear back from you$/ REJECT
/^Subject: Safe, Easy Snoring Solution!\s*\w{2,7}/ REJECT
# search engines
/^Subject: Search Engine Bids Are Now Half Price!/ REJECT
/^Subject: Guaranteed Top Ten Search Engine Placement!!\s*\d{2,7}/ REJECT
# spamware / email addresses
/^Subject: \d{2,3} Million Fresh Email Addresses/ REJECT
/^Subject: \d{2,3} Million Email Addresses – \$\d{2,3}/ REJECT
/^Subject: Internet Marketing Works! -\w{48}/ REJECT
/^Subject: Lets Learn How to market successfully!\s*\d{2,7}/ REJECT
# spyware
/^Subject: Investigate Anyone or Anything now!/ REJECT
/^Subject: NEW!! Find out ANYTHING about ANYONE w\/ your PC!/ REJECT
# paranoia
/^Subject: Protect yourself from Small pox and Anthrax Naturally\s*\w{2,7}/ REJECT
# just plain unrealistic
/^Subject: Boost Your Windows Reliability/ REJECT
/^Subject: Give Windows Operating System A Boost In Reliability!/ REJECT
Posted by mike Filed Under Statistics with 2 Comments
This tutorial will show you how to set up your log statistics to be mailed to you every night so you know what is happening with your Postfix Mail Server.
Set up a cron job so that it will run at 11:55 PM, just before midnight as you want to get all of the logs for that day. Be sure to give enough time for the script to run before the next day. Here is the line to use if you have install pflogsumm at /usr/pflogsumm, see this article for installation.
As root run:
crontab -e
Now add this line with your email at the end. Note the \ which indicates a line break.
55 23 * * * /usr/pflogsumm/./pflogsumm.pl -u 5 -h 5 –problems_first -d today \
/var/log/maillog | mail -s “PostFix Report `date`” \someemail@somewhere.com
Here is an example
Postfix log summaries for Nov 13
Grand Totals
————
messages
19 received
16 delivered
0 forwarded
1 deferred (5 deferrals)
1 bounced
16 rejected (50%)
0 reject warnings
0 held
0 discarded (0%)
69610 bytes received
66259 bytes delivered
10 senders
9 sending hosts/domains
6 recipients
6 recipient hosts/domains
message deferral detail
———————–
smtp (total: 5)
3 hjeigb.info[69.64.157.16]: Connection refused
2 conversation with hjeigb.info[216.52.184.243] timed out while …
message bounce detail (by relay)
——————————–
none (total: 1)
1 Host not found
message reject detail
———————
cleanup
header (total: 2)
1 Content-Type: text/html; charset=”iso-2022-jp”
1 Content-Type: text/plain;??charset=”gb2312″
RCPT
blocked using sbl-xbl.spamhaus.org (total: 2)
1 125.187.32.174
1 konstantynow.mm.pl
Helo command rejected: need fully-qualified hostname (total: 
2 122.198.44.5
1 59.151.193.207
1 123.131.179.188
1 221.205.192.210
1 59.25.194.72
1 ppp85-141-130-24.pppoe.mtu-net.ru
1 117.104.245.29
Relay access denied (total: 4)
1 parestaurant.org
1 92.80.72.159
1 92.113.111.226
1 122.198.44.5
message reject warning detail: none
message hold detail: none
message discard detail: none
smtp delivery failures
———————-
connection refused (total: 3)
3 hjeigb.info
Warnings
——–
smtpd (total: 5)
1 99.178.220.164: hostname adsl-99-178-220-164.dsl.irvnca.sbcglob…
1 92.113.111.226: hostname 226-111-113-92.pool.ukrtel.net verific…
1 117.104.245.29: hostname 29.245.104.117.ids.service.eastern-tel…
1 Unable to look up MX host for pure1-mail.net: Host not found
1 Unable to look up MX host for amota8.co.il: Host not found
Fatal Errors: none
Panics: none
Master daemon messages: none
Per-Hour Traffic Summary
time received delivered deferred bounced rejected
——————————————————————–
0000-0100 2 1 1 1 1
0100-0200 3 3 1 0 3
0200-0300 3 2 1 0 2
0300-0400 4 4 1 0 0
0400-0500 3 2 0 0 4
0500-0600 4 4 1 0 6
0600-0700 0 0 0 0 0
0700-0800 0 0 0 0 0
0800-0900 0 0 0 0 0
0900-1000 0 0 0 0 0
1000-1100 0 0 0 0 0
1100-1200 0 0 0 0 0
1200-1300 0 0 0 0 0
1300-1400 0 0 0 0 0
1400-1500 0 0 0 0 0
1500-1600 0 0 0 0 0
1600-1700 0 0 0 0 0
1700-1800 0 0 0 0 0
1800-1900 0 0 0 0 0
1900-2000 0 0 0 0 0
2000-2100 0 0 0 0 0
2100-2200 0 0 0 0 0
2200-2300 0 0 0 0 0
2300-2400 0 0 0 0 0
Host/Domain Summary: Message Delivery (top 5)
sent cnt bytes defers avg dly max dly host/domain
——– ——- ——- ——- ——- ———–
3 8124 0 5.8 s 7.9 s yahoo.com
7 4175 0 3.2 s 3.2 s news.espacopublico.com.br
Host/Domain Summary: Messages Received (top 5)
msg cnt bytes host/domain
——– ——- ———–
3 6481 gmail.com
2 14562 alicensing.com
2 3238 chasey.com
top 5 Senders by message count
——————————
3 from=<>
2 c19remove@alicensing.com
2 ash22@chasey.com
top 5 Recipients by message count
———————————
1 noreply@news.espacopublico.com.br
top 5 Senders by message size
—————————–
17328 sophiew@ubi.com
14562 c19remove@alicensing.com
11353 from=<>
5238 noreply@news.espacopublico.com.br
top 5 Recipients by message size
——————————–
4175 noreply@news.espacopublico.com.br
« Older Entries
Newer Entries »
