I have get the permission to copy paste this great guide and keep it updated. The Guide will soon come in a updated version on this homepage.

Link to the Original is online here: http://www.bowe.id.au/michael/isp/webmail-server.htm

INSTALL UCSPI-TCP

INSTALL DAEMONTOOLS

INSTALL QMAIL
Download the required files

Unzip the sources, apply the required patches, compile

Edit qmail-smtpd.c and change the code on the straynewline function (around line 54) from 451 to 553
Without this you will get nasty loops forming when a remote servers sends you an message with invalid formatting. By default qmail will says something like  “I am not going to accept that message at the moment, you can try again later”. However in my experience the sending server will try sending the same message again a few seconds later, and this will go around and around in a loop for days on end – consuming valuable bandwidth and resources. By changing the error code to 553, it is making the error be permanent ie “I am not going to accept that message, don’t try sending it again”

Remove the sendmail package, and link in qmail’s replacement utility

The qmailctl script contains all the various commands that will allow us to control our qmail daemons. Put it in with the other qmail binaries. Also link it into /usr/bin so it will be in our “path” for easy access

Setup the /etc/tcp.smtp file
This file controls who is allowed to send and/or relay mail on this server
An example configuration follows :

Setup the /etc/tcp.pop3  file
This file controls who is allowed to access the POP3 services on this server
An example configuration follows :

Now we have created our tcp.smtp and tcp.pop3 files, we need to compile them into the cdb database format that the tcpserver program can read

Adjust various aspects of the qmail configuration to suite our tastes :

Create / configure the various qmail run scripts :

Change run script so it fits yours setup

At this point the qmail daemons should be running. A good way to verify this is to use this command :

If all is well, you should be able to see something like this :

Note the 3 qmail daemons : qmail-send, qmail-smtpd, qmail-pop3d, as well as their associated logging processes. If there is anything wrong with your install, an error message will generally be visible on the “readproctitle” line

You can control the qmail daemons by using the qmailctl program. You can just type that command without any parameters and it will display the available options eg start, stop, status, doqueue

---

VPOPMAIL

https://sourceforge.net/projects/vpopmail

Make the user accounts

Download and unpack the source

Setup the MySQL support in the vpopmail sources

Now, build the program

Notes :
The   “–enable-mysql-limits” configuration option is fairly new. I plan to update my guide to use this function at some point in the near future once I have done some testing etc of this functionality

I used to recommend the –disable-many-domains switch – which tells vpopmail to create one MySQL table per email domain. When I first started building vpopmail servers, I found this to be the most logical way, having each domain in its own table. However there has been some discussion about this config option on the vpopmail mailing lists, and it sound like this option may be removed at some point in the future.  If you have a lot of domains on your server, having each domain in its own table can hurt performance. I now agree that –enable-many-domains (which is the default) is probably the better choice

Review the contents of the file is used to set the default limits for any domains / mailboxes in the vpopmail system. Make sure it contains reasonable defaults for your system.

Optionally, nominate a “default domain”. Users in this domain can login to POP3 etc using just their username. Users from all other domains need to use their full email address as their login name.

Setup the quota warning message that is sent to users when they are at 90% quota

If you want, you can alter the standard message that gets sent to the sender in an overquota situation

OK, vpopmail is now installed!

Some example vpopmail commands :
To add a domain :

To add a mailbox:

To remove a mailbox

To remove a domain :

To change a user’s password

To lookup info about a user

Logging in via POP3
When your users are setting up their POP3 email clients (eg Outlook Express), they should use settings like this :
My incoming mail server is a POP3 server
Incoming mail server (POP3): pop3.yourdomain.com
Outgoing mail server (SMTP): smtp.yourdomain.com
POP3 account name : theirusername@yourdomain.com
Password: theirpassword

When you configured vpopmail, you had the opportunity to nominate a “default” domain. When users from the default domain authenticate, it is optional for them to add the @yourdomain.com onto the end of their username. If vpopmail sees that no domain has been specified by the user, then it will automatically perform the auth against the nominated default domain. If you are hosting multiple domains, then everyone who is NOT in the default domain MUST add their domain name onto the end of their username. (A small percentage of email programs eg Netscape Mail v4.7 do not permit the use of the @ symbol in account name. In this case you can use the % symbol instead of the @ symbol)

vpopmail roaming users :
With qmail, the typical way to control mail relaying is to put a list of rules into a file called tcp.smtp. The tcprules program is then used to compile this file into cdb database format with the output being stored in a file called tcp.smtp.cdb. The tcpserver program is configured (using the -x parameter) to read this file and thus know which SMTP clients are permitted to relay mail.

This type of configuration works well if there is a known range of IP addresses that are permitted to relay mail. eg the IP’s on the qmail server’s local LAN. However if the qmail server needs to provide outbound SMTP services for clients who may be connecting from any IP, you are going to run into problems. What is needed is some way to automate the process of granting users the ability to relay mail, without opening up access to all and sundry on the Internet.

vpopmail includes a solution for this problem. The solution is known as “roaming users” and is typically implemented with a technique known as “POP-before-SMTP”. Once a client has successfully authenticated via POP3, vpopmail will add the client’s IP to a list. vpopmail then merges this list with the contents of the tcp.smtp file and runs the tcprules program to compile a new version of the tcp.smtp.cdb file. Thus the client can now relay mail.

In addition to storing the client’s IP address, vpopmail will also store the time of authentication. The postmaster uses a cronjob on the qmail server to periodically (eg once per hour) run the clearopensmtp program. This program scans through the list of roaming clients and removes any entries that exceed the nominated age (eg 3 hours). This ensures that the list of IPs does not grow out of bounds, and that the roaming IPs are closed within a reasonable timeframe after being opened.

configure options for vpopmail that relate to roaming users :

Example /var/qmail/supervise/qmail-smtpd/run file :

Notes :

qmail servers are typically built with the tcp.smtp files being located in the /etc directory. This is not usually suitable for vpopmail roaming users, since the /etc directory will (should) not have write permissions for the vpopmail user. Therefore it is not going to be possible for vpopmail to write out updated versions of the tcp.smtp.cdb file. For use with roaming users, it is recommended that the tcp.smtp files are stored in ~vpopmail/etc

If a user auths, and their IP already exists in the roaming IP list, the timestamp for the entry is updated, but the tcprules program is not run. There is no need to rebuild the tcp.smtp.cdb file as the IP address is already permitted to relay. Rebuilding the file will only waste disk and CPU time.

If the vpopmail server is using the default cdb authentication backend, then the list of roaming IPs will be stored in a file called ~vpopmail/etc/open-smtp. If the vpopmail server is using the MySQL backend, the roaming IPs will be stored in a database table called relay. The SQL backend will give better performance on a busy server. Either way though, you should be cautious about enabling roaming user functionality on a very busy server, as a large amount of disk and CPU will be used with the continual rebuilding of the tcp.smtp.cdb file. If the server is busy enough you could run into nasty file locking issues which will cause vpopmail password authentication to intermittently fail. If you absolutely must have POP-before-SMTP functionality on your busy server, then there are only two possible solutions that I can think of  : 1) you could try putting the tcp.smtp files onto a RAM disk, or 2) use vpopmail’s MySQL auth backend plus use Matt Simerson’s tcpserver patch that allows all of the tcp.smtp files to be stored in MySQL

For POP-before-SMTP to work, the POP3 daemon will need to run under the tcpserver program. This is because vpopmail uses tcpserver’s TCPREMOTEIP environment variable to work out what IP address the POP3 user is connecting from.

Over time POP-before-SMTP is becoming a less favored way of allowing roaming users to relay mail. SMTP-Auth appears to becoming the more preferred option, as it scales much more easily on a busy server. However for a small to medium sized server, POP-before-SMTP is still quite a workable option. If you would like investigate the use of SMTP-Auth take a look at this patch http://www.fehcom.de/qmail/smtpauth.html#PATCHES

IMAP-before-SMTP is possible when using Courier-IMAP v3.x. However it only works when configured “–with-authvchkpw –without-authdaemon”. When running –without-authdaemon, Courier-IMAP’s authvchkpw code is able to make use of vpopmail’s roaming user functions to allow IMAP-before-SMTP functionality. IMAP-before-SMTP is not possible when Courier-IMAP has been complied –with-authdaemon, because in this mode the user’s IP address is not made available to the authvchkpw code (via the TCPREMOTEIP env var). Also note that in Courier-IMAP v4.x and later, –without-authdaemon functionality is no longer available thus preventing IMAP-before-SMTP from working.

---

AUTORESPONDER

Current development location : http://www.sourceforge.net/projects/qmailadmin

This package is a prerequisite for qmailadmin.

Download and unpack the source

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/autorespond-2.0.4.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/autorespond-2.0.4.tar.gz</a> tar xzf autorespond-2.0.4.tar.gz chown -R root.root autorespond-2.0.4 cd autorespond-2.0.4

1 2 3 4 5

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/autorespond-2.0.4.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/autorespond-2.0.4.tar.gz</a> tar xzf autorespond-2.0.4.tar.gz chown -R root.root autorespond-2.0.4 cd autorespond-2.0.4

Build the program

make make install

1 2	make make install

Notes :

Qmailadmin uses the autorespond program for both autoresponse (“mail robot” in qmailadmin-speak), and vacation response duties. However this is pretty badly FUBAR. Reason being is the autorespond.c is written to do duties as an autoresponse program only. “Out of the box” it doesn’t behave correctly when doing vacation response duties. The code inside the program can be easily tweaked to work correctly as a vacation responder, but this will break the autoresponder functionality. Unfortunately the settings are mutually exclusive. In my opinion the correct solution is to create two variations of this program, autorespond.c and vacation.c, install them both, and then tweak qmailadmin to call the right binary for the right job. I have opened a bug report on the qmailadmin sourceforge site to try and get this problem sorted out. If you read back through the qmailadmin and vpopmail archives, you will see the the autoresponder stuff is an ongoing saga 🙁

ps. Inter7 have got a modified version of the autorespond program, which I believe has been coded to work correctly as a vacation responder http://inter7.com/devel/autorespond-2.0.5.tar.gz

EZMLM / EZMLM-IDX

This package is a prerequisite for qmailadmin

ezmlm is mailing list software written by the author of qmail
ezmlm-idx is patch that adds extra features to the standard ezmlm program.

EZMLM : http://cr.yp.to/ezmlm.html

EZMLM-IDX PATCH : http://www.ezmlm.org
(although I often find this site unresponsive, and so I use one of the mirrors instead like http://www.glasswings.com.au/ezmlm/)

Download and unpack the ezmlm sources

cd /usr/local/src wget <a href="http://cr.yp.to/software/ezmlm-0.53.tar.gz">http://cr.yp.to/software/ezmlm-0.53.tar.gz</a> tar xzf ezmlm-0.53.tar.gz chown -R root.root ezmlm-0.53

1 2 3 4

cd /usr/local/src wget <a href="http://cr.yp.to/software/ezmlm-0.53.tar.gz">http://cr.yp.to/software/ezmlm-0.53.tar.gz</a> tar xzf ezmlm-0.53.tar.gz chown -R root.root ezmlm-0.53

wget <a href="http://www.bowe.id.au/michael/ftp/Sources/Linux/WebMail/ezmlm-idx-0.40.tar.gz">http://www.bowe.id.au/michael/ftp/Sources/Linux/WebMail/ezmlm-idx-0.40.tar.gz</a> tar xzf ezmlm-idx-0.40.tar.gz chown -R root.root ezmlm-idx-0.40

1 2 3

wget <a href="http://www.bowe.id.au/michael/ftp/Sources/Linux/WebMail/ezmlm-idx-0.40.tar.gz">http://www.bowe.id.au/michael/ftp/Sources/Linux/WebMail/ezmlm-idx-0.40.tar.gz</a> tar xzf ezmlm-idx-0.40.tar.gz chown -R root.root ezmlm-idx-0.40

Merge the sources together

cp -R ezmlm-idx-0.40/* ezmlm-0.53/ # (you need to press y quite a few times to allow the patch files to overwrite the original files)

1 2	cp -R ezmlm-idx-0.40/* ezmlm-0.53/ # (you need to press y quite a few times to allow the patch files to overwrite the original files)

cd ezmlm-0.53 patch &lt; idx.patch

1 2	cd ezmlm-0.53 patch < idx.patch

Build the program

make make man make setup

1 2 3

make make man make setup

QMAILADMIN

Original Authors : http://www.inter7.com/qmailadmin
Current Development location  : https://sourceforge.net/projects/qmailadmin/

Description :

The domain postmaster can use this tool to view all the accounts on the domain as well as add/remove accounts, forwards, auto-responders etc.

Domains users can use this tool to modify their own user settings only. ie mailbox password, real name, forwards, vacations.

This tool does not let you create new domains.

Download and unpack the source

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/qmailadmin-1.2.9.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/qmailadmin-1.2.9.tar.gz</a> tar xzf qmailadmin-1.2.9.tar.gz chown -R root.root qmailadmin-1.2.9 cd qmailadmin-1.2.9

1 2 3 4 5

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/qmailadmin-1.2.9.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/qmailadmin/qmailadmin-1.2.9.tar.gz</a> tar xzf qmailadmin-1.2.9.tar.gz chown -R root.root qmailadmin-1.2.9 cd qmailadmin-1.2.9

(Optional) Make a small mod that affects the look of the qmailadmin login page

edit the lang/en file, and change record 112 “Username” rather than “User Account”
(We found our users knew what to type as their “Username”, but didn’t know what to type as a “User Account”)

Build the program

./configure \ --enable-htmldir=/usr/local/apache/htdocs \ --enable-cgibindir=/usr/local/apache/cgi-bin \ --enable-maxusersperpage=12 \ --enable-maxaliasesperpage=12 \ --disable-modify-quota \ --disable-ezmlm-mysql \ --disable-help

1 2 3 4 5 6 7 8

./configure \   --enable-htmldir=/usr/local/apache/htdocs \   --enable-cgibindir=/usr/local/apache/cgi-bin \   --enable-maxusersperpage=12 \   --enable-maxaliasesperpage=12 \   --disable-modify-quota \   --disable-ezmlm-mysql \   --disable-help

# note, I chose to have 12 accounts per page in the config above, # because this makes these particular screens fit nicely on my 1024*768 monitor

1 2	# note, I chose to have 12 accounts per page in the config above, # because this makes these particular screens fit nicely on my 1024*768 monitor

make make install-strip

1 2	make make install-strip

Test to see if it works

http://webmail.<span style="color: #ff0066;">yourdomain.com</span>/cgi-bin/qmailadmin

1	http://webmail.<span style="color: #ff0066;">yourdomain.com</span>/cgi-bin/qmailadmin

If you login a domain postmaster, then you should get the screens where you can view all and add/remove mailboxes, aliases, mailinglists etc on the domain. etc

If you login as a user, you can only access your own mailbox settings (eg password, forwards, vacation messages)

Setting limits :

You can setup limits on any domains where required by putting a .qmailadmin-limits file into the domain’s virtual dir (/home/vpopmail/domains/yourdomain.com). Make sure vpopmail user has read permissions for this file.

Syntax of .qmailadmin-limits file is as follows :

maxpopaccounts X maxforwards X maxmailinglists X maxautoresponders X

1 2 3 4

maxpopaccounts X maxforwards X maxmailinglists X maxautoresponders X

Set X to be the maximum desired number for that feature
Set X to be 0 if you want to disable that feature & menu item

There are also some other settings that can be specified in the .qmailadmin-limits file, refer to section 6 of the qmailadmin installation instructions (http://inter7.com/qmailadmin/install.txt) for more info

A bit of a long-winded misc note to myself :

(If you are setting up your vpopmail server for the first time, then this block of text has no relevance to you. You can skip straight past this waffle and go onto the next section…)

As of qmailadmin-1.0.21, you cant create “aliases” any more. What qmailadmin previously created as aliases, are now created as forwards. Aliases dump incoming mail for that aliased address directly into the recipient user’s Maildir. The problem with this is it bypassed any further “.qmail” processing, meaning that you ran into problems if you were trying to setup some of the more fancy things (like per-user SpamAssassin configurations?). Using forwards bypasses this problem as the message will get re-injected back into the queue for delivery.

However this change does cause some problems for sites that already have existing aliases in use. The problem is that when you go into qmailadmin-1.0.21 and select the forwards screen, all the existing aliases and forwards for that domain are displayed.

Problem # 1 : For mail that is being redirected to a local account, you can’t tell from this screen whether the user is getting alias or forward delivery. If you were trying to setup some tricky per-user stuff, then you are going to get variable results because some users may be configured as alias, and others are configured as forward, but you cant easily tell which is which from this screen

Problem # 2 : Up the top there is a count showing “[Used # / limit]”. This count relates to the number of forwards in use and the maxforwards qmailadmin-limits setting. The count ignores any existing aliases. This could potentially cause confusion for domain postmasters as you will be looking at a screen full of accounts and if some of them have been previously setup as aliases then it is going to be hard to reconcile the reported count against the number of accounts displayed on the screen

What is needed is some sort of utility that will scan and find existing aliases and convert them over to the now-preferred forward syntax…. That would keep the delivery method consistent for all users, and would also eliminate any problems with the qmailadmin-limits code

Note: As of qmailadmin-1.0.25, there is a tool for converting existing aliases to forwards. Look in the contrib dir for the tools called alias2forward.pl

valias processing :

qmailadmin v1.2.1 and later store aliases and autoresponders in valias table if vpopmail was compiled with –enable-valias. If you are upgrading from a previous version of QmailAdmin and used the –enable-valias option when building vpopmail, be sure to download vpopmail 5.4.1 or later and use the dotqmail2valias program to convert .qmail-alias files to valias table entries.

---

COURIER IMAP

http://www.courier-mta.org/imap/

Courier-IMAP is an IMAP server. Having an IMAP server is a prerequisite to be able run a IMAP-client WebMail system like SquirrelMail. Courier-IMAP is good choice because it has support for vpopmail authentication and maildir mailboxes.

Download and unpack the authentication library

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.58.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.58.tar.bz2</a> bunzip2 courier-authlib-0.58.tar.bz2 tar xf courier-authlib-0.58.tar chown -R root.root courier-authlib-0.58 cd courier-authlib-0.58

1 2 3 4 5 6

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.58.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.58.tar.bz2</a> bunzip2 courier-authlib-0.58.tar.bz2 tar xf courier-authlib-0.58.tar chown -R root.root courier-authlib-0.58 cd courier-authlib-0.58

Build the authentication library

./configure \ --prefix=/usr/local/courier-authlib \ --without-authpam \ --without-authldap \ --without-authpwd \ --without-authmysql \ --without-authpgsql \ --without-authshadow \ --without-authuserdb \ --without-authcustom \ --without-authcram \ --without-authpipe \ --with-authdaemon \ --with-authvchkpw

1 2 3 4 5 6 7 8 9 10 11 12 13 14

./configure \   --prefix=/usr/local/courier-authlib \   --without-authpam \   --without-authldap \   --without-authpwd \   --without-authmysql \   --without-authpgsql \   --without-authshadow \   --without-authuserdb \   --without-authcustom \   --without-authcram \   --without-authpipe \   --with-authdaemon \   --with-authvchkpw

# note, if you are running redhat/fedora, you may have to add a # --with-redhat # to the list of configuration settings above

1 2 3

# note, if you are running redhat/fedora, you may have to add a #   --with-redhat # to the list of configuration settings above

make make install make install-configure

1 2 3

make make install make install-configure

Review the settings for the authentication library

vi /usr/local/courier-authlib/etc/authlib/authdaemonrc

1	vi /usr/local/courier-authlib/etc/authlib/authdaemonrc

authmodulelist="authvchkpw" 1 authmodulelist="authvchkpw"

<-- Authenticate via vpopmail 1 <-- Authenticate via vpopmail

Configure the authentication library so it is running all the time from bootup onwards

<span style="font-family: Courier New;">cp courier-authlib.sysvinit /etc/rc.d/init.d/courier-authlib chmod 744 /etc/rc.d/init.d/courier-authlib</span>

1 2	<span style="font-family: Courier New;">cp courier-authlib.sysvinit /etc/rc.d/init.d/courier-authlib chmod 744 /etc/rc.d/init.d/courier-authlib</span>

chkconfig --add courier-authlib

1	chkconfig --add courier-authlib

Then I like to use the ntsysv program to double-check that courier-authlib is set to launch at boot time

If you aren’t ready to reboot the server now, you can fire up the authentication libraries in the mean time with this command :

/etc/rc.d/init.d/courier-authlib start

1	/etc/rc.d/init.d/courier-authlib start

At this point the courier-authlib software should be running. A good way to verify this is to use this command :

ps axf

1

ps axf

And if all is well, you should be able to see something like this :

23689 ? S 0:00 /usr/local/courier-authlib/sbin/courierlogger -pid=/usr/local/courier-authlib/var/spool/ 23690 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23702 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23703 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23704 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23705 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23706 ? S 0:00 \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond

1 2 3 4 5 6 7

23689 ? S 0:00 /usr/local/courier-authlib/sbin/courierlogger -pid=/usr/local/courier-authlib/var/spool/ 23690 ? S 0:00  \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23702 ? S 0:00      \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23703 ? S 0:00      \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23704 ? S 0:00      \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23705 ? S 0:00      \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 23706 ? S 0:00      \_ /usr/local/courier-authlib/libexec/courier-authlib/authdaemond

FAM + Courier-IMAP on Redhat 7.3 doesnt seem very stable. On old Linux platforms, I would recommend you remove FAM before trying to install Courier-IMAP ( By the way, the alternative/replacement package GAMIN seems to works OK with Courier-IMAP on newer platforms like FC4/FC5/CentOS43)

rpm -e fam fam-devel

1	rpm -e fam fam-devel

Download and unpack the courier-IMAP source

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-imap-4.1.1.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-imap-4.1.1.tar.bz2</a> bunzip2 courier-imap-4.1.1.tar.bz2 tar xf courier-imap-4.1.1.tar chown -R root.root courier-imap-4.1.1 cd courier-imap-4.1.1

1 2 3 4 5 6

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-imap-4.1.1.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-imap-4.1.1.tar.bz2</a> bunzip2 courier-imap-4.1.1.tar.bz2 tar xf courier-imap-4.1.1.tar chown -R root.root courier-imap-4.1.1 cd courier-imap-4.1.1

Build the program

COURIERAUTHCONFIG=/usr/local/courier-authlib/bin/courierauthconfig \ CPPFLAGS=-I/usr/local/courier-authlib/include \ ./configure \ --prefix=/usr/local/courier-imap \ --disable-root-check \ --with-ssl

1 2 3 4 5 6

COURIERAUTHCONFIG=/usr/local/courier-authlib/bin/courierauthconfig \ CPPFLAGS=-I/usr/local/courier-authlib/include \ ./configure \   --prefix=/usr/local/courier-imap \   --disable-root-check \   --with-ssl

# note, if you are running redhat/fedora, you may have to add a # --with-redhat # to the list of configuration settings above

1 2 3

# note, if you are running redhat/fedora, you may have to add a #   --with-redhat # to the list of configuration settings above

make make install make install-configure

1 2 3

make make install make install-configure

The Courier-IMAP package includes 4 servers that can be individually enabled/disabled : IMAP, IMAP-SSL, POP3, POP3SSL. In this example, we are only using the IMAP server.

vi /usr/local/courier-imap/etc/imapd

1	vi /usr/local/courier-imap/etc/imapd

MAXDAEMONS=40 MAXPERIP=40 IMAP_EMPTYTRASH=Trash:7,Sent:30 IMAPDSTART=YES 1 2 3 4 MAXDAEMONS=40 MAXPERIP=40 IMAP_EMPTYTRASH=Trash:7,Sent:30 IMAPDSTART=YES

<-- Max number of IMAP daemons <-- All connections will be coming from single IP (SquirrelMail on localhost) <-- Enable automatic purging of mail from these folders <-- allow our init.d script (below) to boot up the imapd 1 2 3 4 <-- Max number of IMAP daemons <-- All connections will be coming from single IP (SquirrelMail on localhost) <-- Enable automatic purging of mail from these folders <-- allow our init.d script (below) to boot up the imapd

Configure Courier-IMAP so it is running all the time from bootup onwards

<span style="font-family: Courier New;">cp courier-imap.sysvinit /etc/rc.d/init.d/courier-imap chmod 744 /etc/rc.d/init.d/courier-imap</span>

1 2	<span style="font-family: Courier New;">cp courier-imap.sysvinit /etc/rc.d/init.d/courier-imap chmod 744 /etc/rc.d/init.d/courier-imap</span>

chkconfig --add courier-imap

1	chkconfig --add courier-imap

Then I like to use the ntsysv program to double-check that courier-imap is set to launch at boot time

If you aren’t ready to reboot the server now, you can fire up Courier-IMAP in the mean time with this command :

/etc/rc.d/init.d/courier-imap start

1	/etc/rc.d/init.d/courier-imap start

At this point the Courier-IMAP software should be running. A good way to verify this is to use this command :

ps axf

1

ps axf

And if all is well, you should be able to see something like this :

1030 ? S 0:02 /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1031 ? S 1:00 \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1032 ? S 0:59 \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1033 ? S 1:01 \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1035 ? S 1:02 \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1036 ? S 1:02 \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 17566 ? S 0:00 /usr/local/courier-imap/libexec/couriertcpd -address=0 -stderrlogger=/usr/local/courier- 17569 ? S 0:00 /usr/local/courier-authlib/sbin/courierlogger imapd

1 2 3 4 5 6 7 8

1030 ? S 0:02 /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1031 ? S 1:00  \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1032 ? S 0:59  \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1033 ? S 1:01  \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1035 ? S 1:02  \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 1036 ? S 1:02  \_ /usr/local/courier-imap/libexec/authlib/authdaemond.plain start 17566 ? S 0:00 /usr/local/courier-imap/libexec/couriertcpd -address=0 -stderrlogger=/usr/local/courier- 17569 ? S 0:00 /usr/local/courier-authlib/sbin/courierlogger imapd

---

SQUIRRELMAIL

www.squirrelmail.org

the text with yellow background is specific to using MySQL backend. if you don’t want to use MySQL backend, then just skip over these sections….

Go to the SquirrelMail download page, and save the latest source to /usr/local/src. In this example I have used :

squirrelmail-1.4.4.tar.gz

1	squirrelmail-1.4.4.tar.gz

Download and unpack all the sources

cd /usr/local/apache/htdocs tar xzf /usr/local/src/squirrelmail-1.4.4.tar.gz chown -R root.www squirrelmail-1.4.4 chmod -R 750 squirrelmail-1.4.4 ln -s squirrelmail-1.4.4 squirrelmail

1 2 3 4 5

cd /usr/local/apache/htdocs tar xzf /usr/local/src/squirrelmail-1.4.4.tar.gz chown -R root.www squirrelmail-1.4.4 chmod -R 750 squirrelmail-1.4.4 ln -s squirrelmail-1.4.4 squirrelmail

Create the required directory structure

mkdir /var/squirrelmail # create the data dir. This is where users personal preferences are stored if not using MySQL backend mkdir /var/squirrelmail/data # create the attach dir. This is where temp files for emails in progress are store mkdir /var/squirrelmail/attach

1 2 3 4 5

mkdir /var/squirrelmail # create the data dir. This is where users personal preferences are stored if not using MySQL backend mkdir /var/squirrelmail/data # create the attach dir. This is where temp files for emails in progress are store mkdir /var/squirrelmail/attach

cd squirrelmail cp data/default_pref /var/squirrelmail/data chown -R root.www /var/squirrelmail chmod -R 0770 /var/squirrelmail/data chmod -R 0730 /var/squirrelmail/attach

1 2 3 4 5

cd squirrelmail cp data/default_pref /var/squirrelmail/data chown -R root.www /var/squirrelmail chmod -R 0770 /var/squirrelmail/data chmod -R 0730 /var/squirrelmail/attach

SquirrelMail allows you to add your company logo to the login page. So whack a copy of your logo into the Apache images directory so it is available for SquirrelMail to use

cp /usr/local/src/yourcompanylogo-100.gif /usr/local/apache/htdocs/images

1	cp /usr/local/src/yourcompanylogo-100.gif /usr/local/apache/htdocs/images

Configure SquirrelMail

cd config perl conf.pl

1 2	cd config perl conf.pl

D. SET PRE-DEFINED SETTINGS FOR SPECIFIC IMAP SERVERS Choose Courier

1 2	D. SET PRE-DEFINED SETTINGS FOR SPECIFIC IMAP SERVERS   Choose Courier

1. ORGANIZATION PREFERENCES 1. Organization name : YourCompany WebMail 2. Organization Logo : /images/yourcompanylogo-100.gif 3. Org. Logo Height/Width : 100/100 4. Organization title : YourCompany WebMail (v$version) 7. Provider link : http://www.<span style="color: #ff0066;">yourdomain</span>.com 8. Provider name : YourCompany

1 2 3 4 5 6 7

1. ORGANIZATION PREFERENCES   1.  Organization name            : YourCompany WebMail   2.  Organization Logo            : /images/yourcompanylogo-100.gif   3.  Org. Logo Height/Width       : 100/100   4.  Organization title           : YourCompany WebMail (v$version)   7.  Provider link                : http://www.<span style="color: #ff0066;">yourdomain</span>.com   8.  Provider name                : YourCompany

2. SERVER SETTINGS 1. Domain : <span style="color: #ff0066;">yourdomain.com</span>

1 2	2. SERVER SETTINGS   1.  Domain                       : <span style="color: #ff0066;">yourdomain.com</span>

3. FOLDER DEFAULTS 15. Default Unseen Type : 2

1 2	3. FOLDER DEFAULTS   15. Default Unseen Type          : 2

4. GENERAL OPTIONS 1. Data directory : /var/squirrelmail/data 2. Attachment directory : /var/squirrelmail/attach 5. Usernames in lower case : true 7. Hide SM attributions : true 11. Allow server-side sorting : false ( Note, server-sorting is faster, but I personally find the sort results to be not as "intuitive" compared with when you let SquirrelMail do the sorting. If you toggle this option on/off and compare the resultant displays in SquirrelMail you will see what I mean. For example if you server-sort the FROM column then the sort will be done senders email address, whereas if you let SquirrelMail do the sort then column will be sorted on senders name. I would suggest you try toggling this option on and off to make your own decision on which sorting method provides the better results.)

1 2 3 4 5 6 7 8 9 10 11 12

4. GENERAL OPTIONS   1.  Data directory               : /var/squirrelmail/data   2.  Attachment directory         : /var/squirrelmail/attach   5.  Usernames in lower case      : true   7.  Hide SM attributions         : true   11. Allow server-side sorting    : false   ( Note, server-sorting is faster, but I personally find the sort results to be not as "intuitive"    compared with when you let SquirrelMail do the sorting. If you toggle this option on/off and compare    the resultant displays in SquirrelMail you will see what I mean. For example if you server-sort the    FROM column then the sort will be done senders email address, whereas if you let SquirrelMail do the    sort then column will be sorted on senders name. I would suggest you try toggling this    option on and off to make your own decision on which sorting method provides the better results.)

6. ADDRESS BOOKS 2. Use Javascript Address Book Search : True

1 2	6. ADDRESS BOOKS   2. Use Javascript Address Book Search : True

9. DATABASE 1. DSN for address book : mysql://<em>squirreluser</em>:<em>squirrelpassword</em>@localhost/squirrelmail 3. DSN for preferences : mysql://<em>squirreluser</em>:<em>squirrelpassword</em>@localhost/squirrelmail

1 2 3

9. DATABASE   1.  DSN for address book : mysql://<em>squirreluser</em>:<em>squirrelpassword</em>@localhost/squirrelmail   3.  DSN for preferences  : mysql://<em>squirreluser</em>:<em>squirrelpassword</em>@localhost/squirrelmail

Now Save and quit the config program

1	Now Save and quit the config program

Create the necessary database and tables in MySQL, so that SquirrelMail can store the address books and user preferences there :

cd /usr/local/mysql/bin

1	cd /usr/local/mysql/bin

./mysql --password="<em>mysql-root-</em><em>pwd</em>"

1	./mysql --password="<em>mysql-root-</em><em>pwd</em>"

CREATE DATABASE squirrelmail;

1	CREATE DATABASE squirrelmail;

GRANT select,insert,update,delete ON squirrelmail.* TO <em>squirreluser</em>@localhost IDENTIFIED BY '<em>squirrelpassword</em>';

1 2	GRANT select,insert,update,delete ON squirrelmail.* TO <em>squirreluser</em>@localhost IDENTIFIED BY '<em>squirrelpassword</em>';

USE squirrelmail;

1	USE squirrelmail;

CREATE TABLE address ( owner varchar(128) DEFAULT '' NOT NULL, nickname varchar(16) DEFAULT '' NOT NULL, firstname varchar(128) DEFAULT '' NOT NULL, lastname varchar(128) DEFAULT '' NOT NULL, email varchar(128) DEFAULT '' NOT NULL, label varchar(255), PRIMARY KEY (owner,nickname), KEY firstname (firstname,lastname) );

1 2 3 4 5 6 7 8 9 10

CREATE TABLE address (   owner varchar(128) DEFAULT '' NOT NULL,   nickname varchar(16) DEFAULT '' NOT NULL,   firstname varchar(128) DEFAULT '' NOT NULL,   lastname varchar(128) DEFAULT '' NOT NULL,   email varchar(128) DEFAULT '' NOT NULL,   label varchar(255),   PRIMARY KEY (owner,nickname),   KEY firstname (firstname,lastname) );

CREATE TABLE userprefs ( user varchar(128) DEFAULT '' NOT NULL, prefkey varchar(64) DEFAULT '' NOT NULL, prefval blob DEFAULT '' NOT NULL, PRIMARY KEY (user,prefkey) );

1 2 3 4 5 6

CREATE TABLE userprefs (   user varchar(128) DEFAULT '' NOT NULL,   prefkey varchar(64) DEFAULT '' NOT NULL,   prefval blob DEFAULT '' NOT NULL,   PRIMARY KEY (user,prefkey) );

quit

1

quit

You can define what default SquirrelMail settings that users will receive when they log in.

For MySQL backend

cd /usr/local/apache/htdocs/squirrelmail # replace the default preferences definition in the db_prefs file # with our own customised defaults. # Open the file, scroll down and replace the existing "var $default" # entry (on line 102) with our customised version shown below vi functions/db_prefs.php

1 2 3 4 5 6

cd /usr/local/apache/htdocs/squirrelmail # replace the default preferences definition in the db_prefs file # with our own customised defaults. # Open the file, scroll down and replace the existing "var $default" # entry (on line 102) with our customised version shown below vi functions/db_prefs.php

var $default = Array('chosen_theme' =&gt; '../themes/default_theme.php', 'show_html_default' =&gt; '1', 'language' =&gt; 'en_US', 'use_javascript_addr_book' =&gt; '1', 'left_size' =&gt; '140', 'left_refresh' =&gt; '3600', 'show_username' =&gt; '1', 'show_username_pos' =&gt; 'top', 'order1' =&gt; '1', 'order2' =&gt; '2', 'order3' =&gt; '3', 'order4' =&gt; '5', 'order5' =&gt; '4', 'order6' =&gt; '6');

1 2 3 4 5 6 7 8 9 10 11 12 13 14

var $default = Array('chosen_theme' => '../themes/default_theme.php',   'show_html_default' => '1',   'language' => 'en_US',   'use_javascript_addr_book' => '1',   'left_size' => '140',   'left_refresh' => '3600',   'show_username' => '1',   'show_username_pos' => 'top',   'order1' => '1',   'order2' => '2',   'order3' => '3',   'order4' => '5',   'order5' => '4',   'order6' => '6');

Or, if you aren’t running MySQL backend for SquirrelMail, you can adjust the default preferences like this :

vi /var/squirrelmail/data/default_pref :

1	vi /var/squirrelmail/data/default_pref :

show_html_default=1
language=en_US
use_javascript_addr_book=1
left_size=140
left_refresh=3600
show_username=1
show_username_pos=top
order1=1
order2=2
order3=3
order4=5
order5=4
order6=6

Setup periodic purging of the “attach” directory

When SquirrelMail users are composing a message that has attachment(s), the attachment is temporarily stored in the /var/squirrelmail/attach directory.  When the user sends the message, the associated temp files will get deleted.

However sometimes the temp files do not get deleted (eg if the user closes their browser mid-compose?).  Since the permissions on this directory are setup (as a security measure) to prevent the webserver from listing the files in this directory, there is no way for Apache/SquirrelMail to do a periodic scan/purge of old files.

So we are going to setup a daily crontab to clean up any attachments that get left hanging around

crontab -e

1	crontab -e

# delete any files that are more than 2 days old from the SquirrelMail attachment dir 0 0 * * * find /var/squirrelmail/attach/* -atime +2 -exec /bin/rm {} \;

1 2	# delete any files that are more than 2 days old from the SquirrelMail attachment dir 0 0 * * * find /var/squirrelmail/attach/* -atime +2 -exec /bin/rm {} \;

Install the quota_usage plugin so users can see their mailbox quota usage

cd /usr/local/src wget <a href="http://www.squirrelmail.org/plugins/quota_usage-1.2.tar.gz">http://www.squirrelmail.org/plugins/quota_usage-1.2.tar.gz</a> wget <a href="http://www.squirrelmail.org/plugins/compatibility-1.3.tar.gz">http://www.squirrelmail.org/plugins/compatibility-1.3.tar.gz</a>

1 2 3

cd /usr/local/src wget <a href="http://www.squirrelmail.org/plugins/quota_usage-1.2.tar.gz">http://www.squirrelmail.org/plugins/quota_usage-1.2.tar.gz</a> wget <a href="http://www.squirrelmail.org/plugins/compatibility-1.3.tar.gz">http://www.squirrelmail.org/plugins/compatibility-1.3.tar.gz</a>

cd /usr/local/apache/htdocs/squirrelmail/plugins tar xzf /usr/local/src/quota_usage-1.2.tar.gz cp quota_usage/config.php.sample quota_usage/config.php chown -R root.www quota_usage chmod -R o-rx quota_usage

1 2 3 4 5

cd /usr/local/apache/htdocs/squirrelmail/plugins tar xzf /usr/local/src/quota_usage-1.2.tar.gz cp quota_usage/config.php.sample quota_usage/config.php chown -R root.www quota_usage chmod -R o-rx quota_usage

# qmailadmin and the other tools all classify a 1Mb as 1048576 bytes (1024 * 1024 ) # Fix up the quota_plugin so it works with the same units. # Otherwise your quota would show as 20M in qmailadmin, and 21M in SquirrelMail :-/ vi quota_usage/functions.php

1 2 3 4

# qmailadmin and the other tools all classify a 1Mb as 1048576 bytes (1024 * 1024 ) # Fix up the quota_plugin so it works with the same units. # Otherwise your quota would show as 20M in qmailadmin, and 21M in SquirrelMail  :-/ vi quota_usage/functions.php

Go to line 43 and change the value 1000000 to 1048576

1	Go to line 43 and change the value 1000000 to 1048576

tar xzf /usr/local/src/compatibility-1.3.tar.gz chown -R root.www compatibility chmod -R o-rx compatibility

1 2 3

tar xzf /usr/local/src/compatibility-1.3.tar.gz chown -R root.www compatibility chmod -R o-rx compatibility

cd ../config perl conf.pl 8. Plugins choose quota_usage choose compatibility

1 2 3 4 5

cd ../config perl conf.pl 8. Plugins       choose quota_usage       choose compatibility

Optionally, Setup SSL mode at login time

cd /usr/local/src wget <a href="http://www.squirrelmail.org/plugins/secure_login-1.0-1.2.8.tar.gz">http://</a><a href="http://www.squirrelmail.org/plugins/secure_login-1.2-1.2.8.tar.gz">www.squirrelmail.org/plugins/secure_login-1.2-1.2.8.tar.gz</a>

1 2	cd /usr/local/src wget <a href="http://www.squirrelmail.org/plugins/secure_login-1.0-1.2.8.tar.gz">http://</a><a href="http://www.squirrelmail.org/plugins/secure_login-1.2-1.2.8.tar.gz">www.squirrelmail.org/plugins/secure_login-1.2-1.2.8.tar.gz</a>

cd /usr/local/apache/htdocs/squirrelmail/plugins tar xzf /usr/local/src/secure_login-1.2-1.2.8.tar.gz cp secure_login/config.php.sample secure_login/config.php chown -R root.www secure_login chmod -R o-rx secure_login

1 2 3 4 5

cd /usr/local/apache/htdocs/squirrelmail/plugins tar xzf /usr/local/src/secure_login-1.2-1.2.8.tar.gz cp secure_login/config.php.sample secure_login/config.php chown -R root.www secure_login chmod -R o-rx secure_login

cd ../config perl conf.pl 8. Plugins, and choose secure_login

1 2 3

cd ../config perl conf.pl 8. Plugins, and choose secure_login

Optionally, modify SquirrelMail so that it will any failed login attempts to the syslog

modify squirrelmail/functions/imap_general.php

search for the line that has “Unknown user or password incorrect”
above this line add :

syslog(LOG_MAIL|LOG_NOTICE,"Squirrelmail login failed for Username : $username, Password : $password");

1	syslog(LOG_MAIL|LOG_NOTICE,"Squirrelmail login failed for Username : $username, Password : $password");

now failed SquirrelMail logins will be logged to /var/log/maillog  🙂

We also added some code to squirrelmail/src/login.php to add a notes page to the login screen. We inserted this chunk just before the line that says “do_hook(‘login_bottom’);

echo "&lt;BR&gt;&lt;CENTER&gt;". "&lt;TABLE BORDER=1 WIDTH=75%&gt;&lt;TR&gt;&lt;TD ALIGN=CENTER&gt;&lt;FONT FACE=Arial SIZE=2&gt;". "&lt;P&gt;&lt;B&gt;&lt;FONT SIZE=3&gt;IMPORTANT NOTES REGARDING THE WEBMAIL SYSTEM&lt;/FONT&gt;&lt;/B&gt;&lt;/P&gt;". "&lt;P&gt;&lt;B&gt;AUTOMATIC MAIL DELETION&lt;/B&gt;&lt;/P&gt;". "&lt;P&gt;The mail server will automatically delete mail from the&lt;BR&gt; ". "following folders after the specified number of days :&lt;br&gt;". "Trash Folder - 7 days, Sent Folder - 30 days". "&lt;P&gt;&lt;B&gt;POP3 MAIL CLIENTS&lt;/B&gt;&lt;/P&gt;". "&lt;P&gt;If you check your mail using a POP3 mail client (such as Outlook Express),&lt;BR&gt; ". "it will download and delete the mail from your WebMail inbox.&lt;/P&gt;". "&lt;P&gt;If you want to be able to download the mail using POP3 and also&lt;BR&gt; ". "leave it on the server so you can see it with WebMail, you will need&lt;BR&gt; ". "to adjust the settings in your POP3 client to tell it not to delete&lt;BR&gt; ". "mail after downloading.&lt;/P&gt;". "&lt;P&gt;For example, to configure this in Outlook Express you would go to&lt;br&gt; ". "&lt;i&gt;Tools -&gt; Accounts -&gt; Mail -&gt; Properties -&gt; Advanced&lt;/i&gt;&lt;BR&gt; ". "and then tick the box&lt;BR&gt;&lt;i&gt;'Leave a copy of message on server'&lt;/i&gt;&lt;P&gt;". "&lt;/FONT&gt;". "&lt;/TD&gt;&lt;TR&gt;&lt;/TABLE&gt;&lt;/CENTER&gt;";

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

echo "<BR><CENTER>". "<TABLE BORDER=1 WIDTH=75%><TR><TD ALIGN=CENTER><FONT FACE=Arial SIZE=2>". "<P><B><FONT SIZE=3>IMPORTANT NOTES REGARDING THE WEBMAIL SYSTEM</FONT></B></P>". "<P><B>AUTOMATIC MAIL DELETION</B></P>". "<P>The mail server will automatically delete mail from the<BR> ". "following folders after the specified number of days :<br>". "Trash Folder - 7 days, Sent Folder - 30 days". "<P><B>POP3 MAIL CLIENTS</B></P>". "<P>If you check your mail using a POP3 mail client (such as Outlook Express),<BR> ". "it will download and delete the mail from your WebMail inbox.</P>". "<P>If you want to be able to download the mail using POP3 and also<BR> ". "leave it on the server so you can see it with WebMail, you will need<BR> ". "to adjust the settings in your POP3 client to tell it not to delete<BR> ". "mail after downloading.</P>". "<P>For example, to configure this in Outlook Express you would go to<br> ". "<i>Tools -> Accounts -> Mail -> Properties -> Advanced</i><BR> ". "and then tick the box<BR><i>'Leave a copy of message on server'</i><P>". "</FONT>". "</TD><TR></TABLE></CENTER>";

Now, another cosmetic change… : modify the squirrelmail/src/login.php and change the wording of “Name:” to “Email address:”.

Next, we setup a default document in the web servers root, to redirect our customers through to the SquirrelMail login page. That way when people want to access the WebMail tool they can point their browser to “http://webmail.yourdomain.com” and they will get automatically redirected through to the SquirrelMail directory

vi /usr/local/apache/htdocs/index.html

1	vi /usr/local/apache/htdocs/index.html

&lt;HTML&gt; &lt;HEAD&gt; &lt;TITLE&gt;Redirect to WebMail login screen...&lt;/TITLE&gt; &lt;META HTTP-EQUIV="refresh" CONTENT="1; url=http://webmail.<span style="color: #ff0066;">yourdomain.com</span>/squirrelmail/"&gt; &lt;/HEAD&gt; &lt;BODY&gt; Redirecting to the WebMail login screen...&lt;br&gt; &lt;a href=squirrelmail/&gt;Click here if you are not automatically redirected&lt;/a&gt; &lt;/BODY&gt; &lt;/HTML&gt;

1 2 3 4 5 6 7 8 9 10

&lt;HTML&gt; &lt;HEAD&gt; &lt;TITLE&gt;Redirect to WebMail login screen...&lt;/TITLE&gt; &lt;META HTTP-EQUIV="refresh" CONTENT="1; url=http://webmail.<span style="color: #ff0066;">yourdomain.com</span>/squirrelmail/"&gt; &lt;/HEAD&gt; &lt;BODY&gt; Redirecting to the WebMail login screen...&lt;br&gt; &lt;a href=squirrelmail/&gt;Click here if you are not automatically redirected&lt;/a&gt; &lt;/BODY&gt; &lt;/HTML&gt;

---

SPAM AND VIRUS CHECKING

OK, now you have a working mail server.. You have loaded all your users and they are giving the new system a good workout. Everything is running nice and smoothly. You sit back and think “my job is done!”

Until… users starting coming to you and saying… “Hey, this new mail server is really good… But how do I block out all these viruses and spam?”… Uh oh…!

Well, luckily the answer is relatively easy….. The qmail-scanner program lets us easily implement anti-spam and anti-virus. Installation instructions follow :

OPTIONAL : RAZOR V2

http://razor.sourceforge.net

If Razor is installed, SpamAssassin will automatically include it in the list of tests run. We found that Razor is quite accurate in identifying spam, and it only added small amount of extra CPU load on the server, so it is definitely worth installing. Note though, that I believe the licensing of Razor states that it isn’t free for commercial use – so you should probably check the docs before deciding whether you wish to enable this function or not

Compile and install :

# install the pre-requisite modules for razor perl -MCPAN -e shell

1 2	# install the pre-requisite modules for razor perl -MCPAN -e shell

#(enter your way through all the questions. The only one you will likely have to answer is regarding your Continent/Country)

1	#(enter your way through all the questions. The only one you will likely have to answer is regarding your Continent/Country)

# tell the cpan shell to follow the dependency tree and automatically grab any required modules o conf prerequisites_policy follow

1 2	# tell the cpan shell to follow the dependency tree and automatically grab any required modules o conf prerequisites_policy follow

# make sure you have some of the basic tools needed to get the CPAN downloads working smoothly install LWP MD5

1 2	# make sure you have some of the basic tools needed to get the CPAN downloads working smoothly install LWP MD5

# install the razor pre-requisites now install Net::Ping Net::DNS Time::HiRes Digest::SHA1 Getopt::Long File::Copy Digest::Nilsimsa URI::Escape

1 2	# install the razor pre-requisites now install Net::Ping Net::DNS Time::HiRes Digest::SHA1 Getopt::Long File::Copy Digest::Nilsimsa URI::Escape

quit

1

quit

# now install the actual razor software wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/razor/razor-agents-2.77.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/razor/razor-agents-2.77.tar.bz2</a>

1 2	# now install the actual razor software wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/razor/razor-agents-2.77.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/razor/razor-agents-2.77.tar.bz2</a>

bunzip2 razor-agents-2.77.tar.bz2 tar xf razor-agents-2.77.tar chown -R root.root razor-agents-2.77 cd razor-agents-2.77

1 2 3 4

bunzip2 razor-agents-2.77.tar.bz2 tar xf razor-agents-2.77.tar chown -R root.root razor-agents-2.77 cd razor-agents-2.77

perl Makefile.PL make make test make install cd ..

1 2 3 4 5

perl Makefile.PL make make test make install cd ..

The Razor programs will now be installed in /usr/bin. In particular, SpamAssassin makes use of the program called : “razor-check”

Last job is to create the Razor configuration files (they get put into /etc/razor/) by using these commands :

razor-admin -d -create -home=/etc/razor

1	razor-admin -d -create -home=/etc/razor

If your server is going to be busy, then I would recommend you edit the razor config file and turn down the debugging level a bit :

vi /etc/razor/razor-agent.conf

1	vi /etc/razor/razor-agent.conf

debuglevel=1

1	debuglevel=1

SPAMASSASSIN

http://www.spamassassin.org

Description :

SpamAssassin is program that scans email messages using a set of rules, and then assigns a score. If the score is higher than your nominated limit, then the message will be tagged as spam.

# tell the cpan shell to follow the dependency tree and automatically grab any required modules o conf prerequisites_policy follow

1 2	# tell the cpan shell to follow the dependency tree and automatically grab any required modules o conf prerequisites_policy follow

# make sure we have all the SpamAssassin prerequisites installed install Digest::SHA1 HTML::Parser Storable MIME::Base64 DB_File Net::DNS Net::SMTP Mail::SPF::Query IP::Country::Fast BerkeleyDB

1 2	# make sure we have all the SpamAssassin prerequisites installed install Digest::SHA1 HTML::Parser Storable MIME::Base64 DB_File Net::DNS Net::SMTP Mail::SPF::Query IP::Country::Fast BerkeleyDB

exit

1

exit

Download and compile

wget <a href="http://apache.mirror.pacific.net.au/spamassassin/source/Mail-SpamAssassin-3.1.2.tar.gz">http://apache.mirror.pacific.net.au/spamassassin/source/Mail-SpamAssassin-3.1.2.tar.gz</a>

1	wget <a href="http://apache.mirror.pacific.net.au/spamassassin/source/Mail-SpamAssassin-3.1.2.tar.gz">http://apache.mirror.pacific.net.au/spamassassin/source/Mail-SpamAssassin-3.1.2.tar.gz</a>

tar xzf Mail-SpamAssassin-3.1.2.tar.gz chown -R root.root Mail-SpamAssassin-3.1.2 cd Mail-SpamAssassin-3.1.2

1 2 3

tar xzf Mail-SpamAssassin-3.1.2.tar.gz chown -R root.root Mail-SpamAssassin-3.1.2 cd Mail-SpamAssassin-3.1.2

perl Makefile.PL make make install cd ..

1 2 3 4

perl Makefile.PL make make install cd ..

“make install” creates the following main files :

/usr/bin/spamassassin &lt;- This is the command-line version of the SpamAssassin program

1	/usr/bin/spamassassin            <- This is the command-line version of the SpamAssassin program

/usr/bin/spamc &lt;- Daemonised SpamAssassin client /usr/bin/spamd &lt;- Daemonised SpamAssassin server

1 2	/usr/bin/spamc                   <- Daemonised SpamAssassin client /usr/bin/spamd                   <- Daemonised SpamAssassin server

/usr/share/spamassassin/ &lt;- The SpamAssassin logic/filter files live here /etc/mail/spamassassin/local.cf &lt;- sitewide configuration settings

1 2	/usr/share/spamassassin/         <- The SpamAssassin logic/filter files live here /etc/mail/spamassassin/local.cf  <- sitewide configuration settings

Test to see if the installation was successful. (Watch the output from the script. SpamAssassin will add headers to the message. In particular look for the “X-Spam-Status: ” and see if it correctly tags the message with a Yes or No)

spamassassin -t &lt; sample-nonspam.txt spamassassin -t &lt; sample-spam.txt

1 2	spamassassin -t < sample-nonspam.txt spamassassin -t < sample-spam.txt

To improve security, modify the configuration of the spamd daemon so it runs under its own uid

Create a spamd user for the spamd process to run as

groupadd spamd useradd -g spamd spamd

1 2	groupadd spamd useradd -g spamd spamd

Modify / create the spamd configuration file

vi /etc/sysconfig/spamassassin

1	vi /etc/sysconfig/spamassassin

# Hint : if you want to enable SpamAssassin debugging # (the debug output goes to /var/log/maillog) then use : # SPAMDOPTIONS="-x -u spamd -H /home/spamd -d -D" # Don't leave debugging turned on unnecessarily though, # because it will slow down a busy server. # # Otherwise, for normal operation (debugging disabled) use following combo : # -x means not to look for any per-user preferences ( since all our users are virtual) # -u means to run as userid spamd # -H tells the addon apps like .razor to store all their files into eg /home/spamd/.razor # -d tells spamd to run as a daemon SPAMDOPTIONS="-x -u spamd -H /home/spamd -d"

1 2 3 4 5 6 7 8 9 10 11 12

# Hint : if you want to enable SpamAssassin debugging # (the debug output goes to /var/log/maillog) then use : # SPAMDOPTIONS="-x -u spamd -H /home/spamd -d -D" # Don't leave debugging turned on unnecessarily though, # because it will slow down a busy server. # # Otherwise, for normal operation (debugging disabled) use following combo : # -x means not to look for any per-user preferences ( since all our users are virtual) # -u means to run as userid spamd # -H tells the addon apps like .razor to store all their files into eg /home/spamd/.razor # -d tells spamd to run as a daemon SPAMDOPTIONS="-x -u spamd -H /home/spamd -d"

Configure the spamd daemon so it is running all the time from bootup onwards

cp spamd/redhat-rc-script.sh /etc/rc.d/init.d/spamd chmod 700 /etc/rc.d/init.d/spamd cd ..

1 2 3

cp spamd/redhat-rc-script.sh /etc/rc.d/init.d/spamd chmod 700 /etc/rc.d/init.d/spamd cd ..

chkconfig --add spamd

1	chkconfig --add spamd

Then I like to use the ntsysv program to double-check that spamd is set to launch at boot time

Setup the SpamAssassin configuration

vi /etc/mail/spamassassin/local.cf

1	vi /etc/mail/spamassassin/local.cf

# Define the sensitivity level. required_score 5

1 2	# Define the sensitivity level. required_score 5

# Allow SpamAssassin to rewrite the subject line of any messages it classifies as spam # This is the value that will prepended to the subject line of messages classified as spam rewrite_header Subject [SPAM]

1 2 3

# Allow SpamAssassin to rewrite the subject line of any messages it classifies as spam # This is the value that will prepended to the subject line of messages classified as spam rewrite_header Subject [SPAM]

# Put spam analysis reports into to the headers of the message (rather than the body) report_safe 0

1 2	# Put spam analysis reports into to the headers of the message (rather than the body) report_safe 0

# Enable SpamAssassin's RBL checking features : # Although we have already done some RBL filtering earier in qmail's rblsmtpd program, # it is still recommended to turn on RBL checking in SpamAssassin, as it will run # checks against a variety of different RBL sources, and the results will help # tag spam more accurately skip_rbl_checks 0 # If we haven't received a response from the RBL server in X seconds, then skip that test rbl_timeout 3

1 2 3 4 5 6 7 8

# Enable SpamAssassin's RBL checking features : # Although we have already done some RBL filtering earier in qmail's rblsmtpd program, # it is still recommended to turn on RBL checking in SpamAssassin, as it will run # checks against a variety of different RBL sources, and the results will help # tag spam more accurately skip_rbl_checks 0 # If we haven't received a response from the RBL server in X seconds, then skip that test rbl_timeout 3

# You can nominate any netblocks that you control, and contain mailservers that # you trust. IE you control the mailservers in these netblocks so there is no # need to be running RBL checks against these particular servers. # You should include all the netblocks used by email clients on your local lan. # Also make sure you include any netblocks that host your mail servers. trusted_networks 127.0.0.1 trusted_networks 123.123.123.0/24

1 2 3 4 5 6 7

# You can nominate any netblocks that you control, and contain mailservers that # you trust. IE you control the mailservers in these netblocks so there is no # need to be running RBL checks against these particular servers. # You should include all the netblocks used by email clients on your local lan. # Also make sure you include any netblocks that host your mail servers. trusted_networks 127.0.0.1 trusted_networks 123.123.123.0/24

# Enable auto-learning use_bayes 1 bayes_auto_learn 1 # we are going to run a single global bayes db for all users ( rather than a db per user) bayes_path /home/spamd/.spamassassin/bayes

1 2 3 4 5

# Enable auto-learning use_bayes 1 bayes_auto_learn 1 # we are going to run a single global bayes db for all users ( rather than a db per user) bayes_path /home/spamd/.spamassassin/bayes

# Enable auto-whitelisting use_auto_whitelist 1

1 2	# Enable auto-whitelisting use_auto_whitelist 1

Just to make sure the bayes database directory will be setup correctly :

mkdir /home/spamd/.spamassassin chown -R spamd.spamd /home/spamd/.spamassassin

1 2	mkdir /home/spamd/.spamassassin chown -R spamd.spamd /home/spamd/.spamassassin

If you wish to view all the possible configuration options, use this command :

perldoc Mail::SpamAssassin::Conf

1	perldoc Mail::SpamAssassin::Conf

Enable the razor functions

vi /etc/mail/spamassassin/v310.pre

1	vi /etc/mail/spamassassin/v310.pre

#uncomment the following line :

1	#uncomment the following line :

loadplugin Mail::SpamAssassin::Plugin::Razor2

1	loadplugin Mail::SpamAssassin::Plugin::Razor2

OK, the SpamAssassin software is now fully installed!

Any mail that SpamAssassin classifies as spam will have [SPAM] added to the subject line.  You should now probably setup some docs for your users showing them how they can use message filtering rules in their email client. You can see our message filtering guides here

If you aren’t ready to reboot the server now, you can fire up spamd in the mean time with this command :

/etc/rc.d/init.d/spamd start

1	/etc/rc.d/init.d/spamd start

If all goes well you will see some output like this :

9721 ? S 0:01 /usr/bin/spamd -x -u spamd -H /home/spamd -d

1	9721 ? S 0:01 /usr/bin/spamd -x -u spamd -H /home/spamd -d

(Note that spam filtering isn’t actually operational on your server yet, you need to use the qmail-scanner program to feed mail through the SpamAssassin scripts)

CLAM ANTI-VIRUS

http://www.clamav.net

Clam antivirus can run in two different modes. Either as a normal command line scanner, or as a client/daemon pair.

When working as a command line scanner, you perform your scanning using the program “clamscan”. If a complex program like a virus scanner is run repetitively (ie being launched for every email that passes through your system), it chews up a lot of CPU/disk resources. To get around this issue you can launch Clam as a daemon (clamd). This is where a copy of Clam is launched and stays active in the background. You then do your scanning using the clamdscan client, which is only small, thus making it fast to launch/run. The client sends commands to the daemon, and the daemon will take care of scanning the message and returning the results to the client. (The same technique is used by SpamAssassin where you can use the full spamassassin command line version, or the spamc/spamd client/daemon pair).

In a busy environment, there is no doubt that the client/daemon method is the best way to go

groupadd clamav useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav

1 2	groupadd clamav useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.tar.gz</a> tar xzf clamav-0.88.tar.gz chown -R root.root clamav-0.88 cd clamav-0.88 ./configure make make install

1 2 3 4 5 6 7 8

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.tar.gz</a> tar xzf clamav-0.88.tar.gz chown -R root.root clamav-0.88 cd clamav-0.88 ./configure make make install

Customise the clamd configuration file

vi /usr/local/etc/clamd.conf

1	vi /usr/local/etc/clamd.conf

# make sure you comment out the "example" line

1	# make sure you comment out the "example" line

LogSyslog FixStaleSocket User clamav

1 2 3

LogSyslog FixStaleSocket User clamav

Configure clamd so it is running all the time from bootup onwards

cp contrib/init/RedHat/clamd /etc/rc.d/init.d/ chmod 744 /etc/rc.d/init.d/clamd

1 2	cp contrib/init/RedHat/clamd /etc/rc.d/init.d/ chmod 744 /etc/rc.d/init.d/clamd

chkconfig --add clamd

1	chkconfig --add clamd

Then I like to use the ntsysv program to double-check that clamd is set to launch at boot time

If you aren’t ready to reboot the server now, you can fire up clamd in the mean time with this command :

/etc/rc.d/init.d/clamd start

1	/etc/rc.d/init.d/clamd start

At this point the clamd software should be running. A good way to verify this is to use this command :

ps axf

1

ps axf

And if all is well, you should be able to see something like this :

18144 ? S 0:00 /usr/local/sbin/clamd

1	18144 ? S 0:00 /usr/local/sbin/clamd

Setup the freshclam configuration file

vi /usr/local/etc/freshclam.conf

1	vi /usr/local/etc/freshclam.conf

# make sure you comment out the "example" line LogSyslog DatabaseOwner clamav DatabaseMirror db.au.clamav.net (where "au" matches <em>your</em> country code) NotifyClamd

1 2 3 4 5

# make sure you comment out the "example" line LogSyslog DatabaseOwner clamav DatabaseMirror db.au.clamav.net  (where "au" matches <em>your</em> country code) NotifyClamd

Configure freshclam to start on boot

vi /etc/rc.d/rc.local

1	vi /etc/rc.d/rc.local

/usr/local/bin/freshclam -d

1	/usr/local/bin/freshclam -d

Launch freshclam now

/usr/local/bin/freshclam -d

1	/usr/local/bin/freshclam -d

At this point the freshclam software should be running. A good way to verify this is to use this command :

ps axf

1

ps axf

And if all is well, you should be able to see something like this :

18144 ? S 0:00 /usr/local/sbin/clamd

1	18144 ? S 0:00 /usr/local/sbin/clamd

QMAIL-SCANNER

http://qmail-scanner.sourceforge.net

Description :

Qmail-Scanner is an add-on that enables a qmail server to scan messages for certain characteristics. It is typically used for its anti-virus protection functions, in which case it is used in conjunction with commercial (or open source) virus scanners. It also capable of blocking email that contains specific strings in particular headers, or particular attachment filenames or types (e.g. *.VBS attachments).

Install the required supporting modules for Qmail-Scanner

TNEF unpacker

<a href="http://sourceforge.net/projects/tnef/">http://sourceforge.net/projects/tnef/</a>

1	<a href="http://sourceforge.net/projects/tnef/">http://sourceforge.net/projects/tnef/</a>

cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/tnef/tnef-1.3.4.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/tnef/tnef-1.3.4.tar.gz</a>

1 2	cd /usr/local/src wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/tnef/tnef-1.3.4.tar.gz">http://optusnet.dl.sourceforge.net/sourceforge/tnef/tnef-1.3.4.tar.gz</a>

tar xzf tnef-1.3.4.tar.gz chown -R root.root tnef-1.3.4 cd tnef-1.3.4 ./configure make make install cd ..

1 2 3 4 5 6 7

tar xzf tnef-1.3.4.tar.gz chown -R root.root tnef-1.3.4 cd tnef-1.3.4 ./configure make make install cd ..

ReformatMIME (from the Maildrop package)

<a href="http://sourceforge.net/projects/courier">http://sourceforge.net/projects/courier</a>

1	<a href="http://sourceforge.net/projects/courier">http://sourceforge.net/projects/courier</a>

cd /usr/local/src wget <a href="http://prdownloads.sourceforge.net/courier/maildrop-2.0.1.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/maildrop-2.0.1.tar.bz2</a>

1 2	cd /usr/local/src wget <a href="http://prdownloads.sourceforge.net/courier/maildrop-2.0.1.tar.bz2">http://optusnet.dl.sourceforge.net/sourceforge/courier/maildrop-2.0.1.tar.bz2</a>

bunzip2 maildrop-2.0.1.tar.bz2 tar xf maildrop-2.0.1.tar chown -R root.root maildrop-2.0.1.tar cd maildrop-2.0.1 ./configure make make install-strip make install-man cd ..

1 2 3 4 5 6 7 8 9

bunzip2 maildrop-2.0.1.tar.bz2 tar xf maildrop-2.0.1.tar chown -R root.root maildrop-2.0.1.tar cd maildrop-2.0.1 ./configure make make install-strip make install-man cd ..

A “Qmail-Scanner ST patch” has been released by Salvatore Toribio, which greatly extends the functionality of qmail-scanner. The patch adds extra features to help deal with spam (such as dropping messages that exceed a certain SpamAssassin score). We are going to use this patch, as it makes qmail-scanner much more useful.

cd /usr/local/src

1	cd /usr/local/src

# Grab the qmail-scanner source wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmail-scanner/qmail-scanner-1.25.tgz">http://optusnet.dl.sourceforge.net/sourceforge/qmail-scanner/qmail-scanner-1.25.tgz</a> tar xzf qmail-scanner-1.25.tgz chown -R root.root qmail-scanner-1.25

1 2 3 4

# Grab the qmail-scanner source wget <a href="http://optusnet.dl.sourceforge.net/sourceforge/qmail-scanner/qmail-scanner-1.25.tgz">http://optusnet.dl.sourceforge.net/sourceforge/qmail-scanner/qmail-scanner-1.25.tgz</a> tar xzf qmail-scanner-1.25.tgz chown -R root.root qmail-scanner-1.25

# Grab and apply the qmail-scanner-st patch wget <a href="http://toribio.apollinare.org/qmail-scanner/download/q-s-1.25st-20050406.patch.gz">http://toribio.apollinare.org/qmail-scanner/download/q-s-1.25st-20050406.patch.gz</a> gunzip q-s-1.25st-20050406.patch.gz patch -p0 &lt; q-s-1.25st-20050406.patch

1 2 3 4

# Grab and apply the qmail-scanner-st patch wget <a href="http://toribio.apollinare.org/qmail-scanner/download/q-s-1.25st-20050406.patch.gz">http://toribio.apollinare.org/qmail-scanner/download/q-s-1.25st-20050406.patch.gz</a> gunzip q-s-1.25st-20050406.patch.gz patch -p0 &lt; q-s-1.25st-20050406.patch

cd qmail-scanner-1.25

1	cd qmail-scanner-1.25

Now at this point, I would recommend you spend some time reading the qmail-scanner documentation. And once you have read that, take a look at the qmail-scanner-st patch doco

Next, create a user and group for the qmailscanner to run under

groupadd qscand useradd -c "Qmail-Scanner Account" -g qscand -s /bin/false qscand

1 2	groupadd qscand useradd -c "Qmail-Scanner Account" -g qscand -s /bin/false qscand

For qmailscanner to work correctly with clamav, you need to adjust clamav to run under the qscand username

vi /usr/local/etc/clamd.conf

1	vi /usr/local/etc/clamd.conf

# look for the line that says "User clamav" and replace with User qscand

1 2	# look for the line that says "User clamav" and replace with User qscand

/etc/rc.d/init.d/clamd restart

1	/etc/rc.d/init.d/clamd restart

Configure Qmail-Scanner :

# Here are the settings we used at our site for configuring Qmail-Scanner : # # configure Qmail-Scanner to work in the following manner : # - notify a nominated admin each time a virus is detected # (in this case it will be virusadmin@<span style="color: #ff0066;">yourdomain.com</span>) # - use the client/server version of Clam AV for anti-virus scanning. # - enable support for spamc/spamd in "verbose" mode. # Qmail-Scanner can run spamd in "fast" mode or "verbose" mode. # You can read more about this at the <a href="http://qmail-scanner.sourceforge.net/FAQ.php">Qmail-Scanner FAQ page</a>. # I would recommend that you use verbose mode as this allows you to get access to # the full reporting/tagging features that SpamAssassin can provide. It costs you # a fraction more CPU power, but provides a much greater range of features. # - Use a medium level of sensitivity when blocking mail due to broken MIME formatting # # THE COMMANDS HIGHLIGHTED IN BLUE BELOW ARE FROM THE QMAIL-SCANNER-ST PATCH # - sa-delete sets the point that spam mail is autodeleted. # <em>sa-delete</em> is a relative value to the SpamAssassin <em>required_hits</em>. # so in our case, the spam will be deleted at a score of 10

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

# Here are the settings we used at our site for configuring Qmail-Scanner : # # configure Qmail-Scanner to work in the following manner : #   - notify a nominated admin each time a virus is detected #     (in this case it will be virusadmin@<span style="color: #ff0066;">yourdomain.com</span>) #   - use the client/server version of Clam AV for anti-virus scanning. #   - enable support for spamc/spamd in "verbose" mode. #     Qmail-Scanner can run spamd in "fast" mode or "verbose" mode. #     You can read more about this at the <a href="http://qmail-scanner.sourceforge.net/FAQ.php">Qmail-Scanner FAQ page</a>. #     I would recommend that you use verbose mode as this allows you to get access to #     the full reporting/tagging features that SpamAssassin can provide. It costs you #     a fraction more CPU power, but provides a much greater range of features. #   - Use a medium level of sensitivity when blocking mail due to broken MIME formatting # #   THE COMMANDS HIGHLIGHTED IN BLUE BELOW ARE FROM THE QMAIL-SCANNER-ST PATCH #   - sa-delete sets the point that spam mail is autodeleted. #     <em>sa-delete</em> is a relative value to the SpamAssassin <em>required_hits</em>. #     so in our case, the spam will be deleted at a score of 10

./configure \ --admin virusadmin \ --domain <span style="color: #ff0066;">yourdomain.com</span> \ --admin-fromname "<span style="color: #ff0066;">yourdomain.com</span> Postmaster" \ --local-domains "<span style="color: #ff0066;">yourdomain.com</span>" \ --scanners clamdscan,verbose_spamassassin \ --fix-mime 1 \ --debug no \ --sa-delete 5 \ --sa-reject yes \ --install

1 2 3 4 5 6 7 8 9 10 11

./configure \   --admin virusadmin \   --domain <span style="color: #ff0066;">yourdomain.com</span> \   --admin-fromname "<span style="color: #ff0066;">yourdomain.com</span> Postmaster" \   --local-domains "<span style="color: #ff0066;">yourdomain.com</span>" \   --scanners clamdscan,verbose_spamassassin \   --fix-mime 1 \   --debug no \   --sa-delete 5 \   --sa-reject yes \   --install

Note : If the install fails with an error like this :

<span style="font-family: Courier New; font-size: x-small;">Redhat hosts need to have perl-suidperl installed to get setuid support</span>

1	<span style="font-family: Courier New; font-size: x-small;">Redhat hosts need to have perl-suidperl installed to get setuid support</span>

Then you will need to do something like this (this example for Redhat 7.3) :

cd /usr/local/src wget <a href="http://redhat.pacific.net.au/redhat/redhat-7.3-en/os/i386/RedHat/RPMS/perl-suidperl-5.6.1-34.99.6.i386.rpm">http://redhat.pacific.net.au/redhat/redhat-7.3-en/os/i386/RedHat/RPMS/perl-suidperl-5.6.1-34.99.6.i386.rpm</a> rpm -ivh perl-suidperl-5.6.1-34.99.6.i386.rpm

1 2 3

cd /usr/local/src wget <a href="http://redhat.pacific.net.au/redhat/redhat-7.3-en/os/i386/RedHat/RPMS/perl-suidperl-5.6.1-34.99.6.i386.rpm">http://redhat.pacific.net.au/redhat/redhat-7.3-en/os/i386/RedHat/RPMS/perl-suidperl-5.6.1-34.99.6.i386.rpm</a> rpm -ivh perl-suidperl-5.6.1-34.99.6.i386.rpm

Edit the perscanner file which is used to block mail that contains particular strings. perlscanner is a tool that is included with qmail-scanner, and it is executed after all the other anti-virus scanners have run (eg clamscan). This system provides a good failsafe in case some new virus comes along that the virus-scanner cant detect yet. perlscanner is perfect for blocking those virus-prone attachments that have no legitimate purpose in email.

vi /var/spool/qscan/quarantine-events.txt

1	vi /var/spool/qscan/quarantine-events.txt

Uncomment the following lines :

.lnk SIZE=-1 LNK files not allowed per Company security policy .wsh SIZE=-1 WSH files not allowed per Company security policy .vbs SIZE=-1 VBS files not allowed per Company security policy .scr SIZE=-1 SCR files not allowed per Company security policy .hta SIZE=-1 HTA files not allowed per Company security policy .pif SIZE=-1 PIF files not allowed per Company security policy .cpl SIZE=-1 CPL files not allowed per Company security policy

1 2 3 4 5 6 7

.lnk SIZE=-1 LNK files not allowed per Company security policy .wsh SIZE=-1 WSH files not allowed per Company security policy .vbs SIZE=-1 VBS files not allowed per Company security policy .scr SIZE=-1 SCR files not allowed per Company security policy .hta SIZE=-1 HTA files not allowed per Company security policy .pif SIZE=-1 PIF files not allowed per Company security policy .cpl SIZE=-1 CPL files not allowed per Company security policy

# rebuild the perlscanner database setuidgid qmaild /var/qmail/bin/qmail-scanner-queue.pl -g

1 2	# rebuild the perlscanner database setuidgid qmaild /var/qmail/bin/qmail-scanner-queue.pl -g

Any SMTP sessions that are dropped (due to network outages/etc) may lead to files lying around in /var/spool/qmailscan . Running /var/qmail/bin/qmail-scanner-queue.pl -z at least once daily will ensure such files are deleted when they’re over 30 hours old. We will make a cronjob to do that :

crontab -e

1	crontab -e

0 0 * * * /var/qmail/bin/qmail-scanner-queue.pl -z

1	0 0 * * * /var/qmail/bin/qmail-scanner-queue.pl -z

Now define what mail is to be sent through the Qmail-Scanner, also make sure that your qmail-smtpd script allocates sufficient resources to support the needs of Qmail-Scanner + Antivirus + SpamAssassin. At our site, we have configured Qmail-Scanner to virusscan all messages (ie inbound and outbound mail). We did this by setting up our our /var/qmail/supervise/qmail-smtpd/run file like this :

vi /var/qmail/supervise/qmail-smtpd/run

1	vi /var/qmail/supervise/qmail-smtpd/run

#!/bin/sh <strong># when QMAILQUEUE is set, all mail will be sent to the nominated script QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE</strong> QMAILDUID=`id -u qmaild` NOFILESGID=`id -g qmaild` <strong># softlimit needs to be set at something large such as 15000000 # to allow virusscanning software to run successfully </strong>exec /usr/local/bin/softlimit -m <strong>15000000</strong> \ /usr/local/bin/tcpserver \ -v -x /etc/tcp.smtp.cdb \ -c 20 -R -u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \ ... and the rest of the file snipped ...

1 2 3 4 5 6 7 8 9 10 11 12 13 14

#!/bin/sh <strong># when QMAILQUEUE is set, all mail will be sent to the nominated script QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE</strong>   QMAILDUID=`id -u qmaild` NOFILESGID=`id -g qmaild`   <strong># softlimit needs to be set at something large such as 15000000 # to allow virusscanning software to run successfully </strong>exec /usr/local/bin/softlimit -m <strong>15000000</strong> \ /usr/local/bin/tcpserver \   -v -x /etc/tcp.smtp.cdb \   -c 20 -R -u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \ ... and the rest of the file snipped ...

Restart the qmail-smtpd service :

svc -d /service/qmail-smtpd svc -u /service/qmail-smtpd

1 2	svc -d /service/qmail-smtpd svc -u /service/qmail-smtpd

However, if you don’t want to virusscan all mail, you can selectively nominate which IP ranges should or shouldn’t be checked by setting the QMAILQUEUE variable via your /etc/tcp.smtp file rather than inside the supervise/qmail-smtpd/run file. Refer to the Qmail-Scanner home page for setup examples.

QMAIL-SCANNER / SPAMASSASSIN NOTES :

How can I tell if SpamAssassin is working?

Each time SpamAssassin processes a message, it will log some information to /var/log/maillog (score, message size, time taken to process)

Not all mail gets passed through SpamAssassin

We have configured our supervise/qmail-smtpd/run script so that it runs Qmail-Scanner for every mail message. This means all incoming and outgoing mail will get virus-checked. However this doesn’t necessarily mean that every message passing through Qmail-Scanner will also get sent through SpamAssassin.

Qmail-Scanner has been coded so that messages are only passed onto SpamAssassin if the RELAYCLIENT variable from tcp.smtp is not set. The idea behind this to reduce load on the system by not running SpamAssassin on mail originated by your users.

It is possible to force SpamAssassin checking for local users if you choose by setting QS_SPAMASSASSIN=”on” for the appropriate entries in your tcp.smtp file

You can read more about this subject at the Qmail-Scanner FAQ page

Is it possible to configure per-user settings for SpamAssassin?

It depends on your configuration. We believe it will be possible to implement an interface so that vpopmail users can turn SpamAssassin checking on/off, and also set their own custom required_hits. We are hoping to store these settings as additional columns in the vpopmail MySQL database… Stay tuned and we will post more info as it comes to hand

Can I make it so that all the spam get sent to my a SPAM or TRASH folder?

Yes, have a look at this example, or take a look at the $smaildir option in the qmail-scanner-st patch

Qmail-scanner’s quarantine directory

Each virus infect mail message gets quarantines into the following directory :

/var/spool/qmailscan/quarantine/new

1	/var/spool/qmailscan/quarantine/new

So you will need to periodically purge the files from that dir, or else your hard disk will eventually fill up!

eg setup a crontab entry like this :

0 * * * * find /var/spool/qmailscan/quarantine/new -type f -mtime +30 -exec rm '{}' \;

1	0 * * * * find /var/spool/qmailscan/quarantine/new -type f -mtime +30 -exec rm '{}' \;