Linux Help
guides forums blogs
Home Desktops Distributions ISO Images Logos Newbies Reviews Software Support & Resources Linuxhelp Wiki

Welcome Guest ( Log In | Register )



Advanced DNS Management
New ZoneEdit. New Managment.

FREE DNS Is Back

Sign Up Now
> Installing A Postfix Mail Server, On RHEL or Clones (Like WBEL / CentOS)
hughesjr
post May 17 2004, 10:31 PM
Post #1


Its GNU/Linuxhelp.net
*******

Group: Admin
Posts: 3,433
Joined: 25-July 03
From: Corpus Chrsiti, TX, USA
Member No.: 1,151



This is going to be a Postfix mail server install on WhiteBox Enterprise Linux (or another RHEL clone like TaoLinux or CentOS). There are several items in that install that could be removed if absolutely necessary ... however, I will only remove sendmail, because I am going to install PostFix as the MTA.

This install is as lean as possible, and does not contain a GUI. You will need to know how to use an editor in console mode. There are several, I use vi ... nano is also in this install. Either can be used ... please become familiar with a console editor before attempting this install. You will see steps that say edit file /xxx/xxxx ... you should use your perferred editor to do these steps.

All commands are done at the command prompt as root.

Here is the procedure.

1. Perform at least a minimum WBEL (or CentOS, or TaoLinux) install per this Guide.

Steps 2 - 4 are deleted ... they are now included in the above guide.

5. Now we need to install, or verify installed all the packages that we need for setting up Postfix with SASL, SMTP AUTH, IMAP and POP3. This will install all the required packages:

yum install postfix imap imap-devel cyrus-sasl cyrus-sasl-gssapi cyrus-sasl-md5 cyrus-sasl-plain cyrus-sasl-devel

{the above is all one line with a space between each name (if it wraps)}

6. Now we need to remove sendmail, since postfix is the new MTA.

yum remove sendmail

7. Now is a good time to discuss what needs to be set up for naming. There are specific naming requirements for an e-mail server. The first is the name of the server itself. In WBEL, there are 2 places the server name needs to be ... and it needs to be the same in each place. The places are:

a. The file /etc/sysconfig/network ... mine says this:
CODE
NETWORKING=yes
HOSTNAME=mail.home.local


(mail is the computer name .... home.local is the domain name.)

b. The file /etc/hosts needs the same entry ... here is my /etc/hosts:
CODE
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
192.168.0.29 mail.home.local


8. Another requirement for a mail server is to have an DNS MX record for the domain (in my case home.local) that points to the e-mail server (in my case mail.home.local). This domain is not real outside my test network, it does work inside my network (on a 192.168.0.0 network) because I have a DNS server for testing. You would need to add (or have your service provider add) an MX record for your domain. Here is what a dig lookup looks like for my MX record on home.local.
QUOTE
dig -t mx home.local

; <<>> DiG 9.2.2 <<>> -t mx home.local
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16265
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;home.local.                    IN      MX

;; ANSWER SECTION:
home.local.            3600    IN      MX      10 mail.home.local.

;; ADDITIONAL SECTION:
mail.home.local.        3600    IN      A      192.168.0.29

;; Query time: 2 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Mon May 17 21:12:39 2004
;; MSG SIZE  rcvd: 65


The question in the question section is home.local's mx record ... the answer sections says home.local's email server is mail.home.local ... and the additional section says mail.home.local is 192.168.0.29. I have a seperate A record for 192.168.0.29 tied to the name mail.home.local in the DNS server.

In order for your e-mail server to really work (to recieve mail from the internet), you need a real domain name that you own, an IP address, and a valid DNS MX record and A record pointing to your mail server. You can use services like zoneedit.com and dyndns.org (or others) to apply a domain name to a dynamic IP address (like a cable or DSL account) ... then setup A and MX records there.

9. Once you have your MX and A DNS records set, you are ready to configure your Postfix ... first we will edit the file /etc/postfix/main.cf and setup the important parameters. I am only going to list the parameters to get one fully functional domain working ... where there is no relaying except for users who have logged on. I will only discuss the parameters that need changing from the default:

myhostname = mail.home.local

mydomain = home.local

myorigin = $mydomain

inet_interfaces = $myhostname

mydestination = $myhostname, $mydomain, localhost

local_recipient_maps = unix:passwd.byname $alias_maps

unknown_local_recipient_reject_code = 550

mynetworks_style = subnet

(this will allow me to relay mail on my 192.168.0.0/255.255.255.0 subnet ... if you only own 1 IP ... you will leave this remarked out and use mynetworks_style = host instead.

relay_domains = $mydestination

mail_spool_directory = /var/spool/mail


That is all the original stuff that needed changing .... here are the items added for SASL / SMTP AUTH (added to the bottom of the /etc/postfix/main.cf file):

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, check_relay_domains


Also in the bottom of the /etc/postfix/main.cf file, you can add a setting for max mail box size and max attachment size ... I will assume 20mb max attachment and 100mb max mailbox size...here is what to add for that:

message_size_limit = 20971520
mailbox_size_limit = 104857600


Here is my current /etc/postfix/main.cf file for this install ...
http://www.hughesjr.com/wbel/postfix/main.cf.txt

10. Now we need to turn on IMAP, POP3, IMAPs, POP3s. All these are optional. You want to edit the following files in the directory /etc/xinetd.d:

ipop3
pop3s
imap
imaps


For the services you want to turn on, change the line:

disable = yes

to

disable = no

I turned on imap, imaps, pop3s ... but not ipop3.

To restart xinetd,issue the command:

/etc/init.d/xinetd restart

11. Next we want to get saslauthd working. We need to edit the file /etc/sysconfig/saslauthd and make sure it says this:

MECH=pam

Next we need to edit the file /usr/lib/sasl2/smtpd.conf and make sure it says:

pwcheck_method: saslauthd

Now we need to set postfix as the MTA ... do this:

alternatives --config mta

... select postfix (on my setup the number 1)

Now we need to start the saslauthd service with this command:

/etc/init.d/saslauthd restart
(if it wan't previously running, the first shutdown may fail .. but the start should say [OK].

restart postfix with the command:

/etc/init.d/postfix restart

12. Next we need to make sure postfix and saslauthd will start on reboot in at least modes 3,4,5 ... to do this issue the following command:

chkconfig --list | grep postfix

The output should be similar to this:
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off

Then do:
chkconfig --list | grep saslauthd

It should also look like this:
saslauthd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

If it is off all across the board, issue this command:

chkconfig saslauthd on

Then redo the chkconfig --list | grep saslauthd command ... it should now be good.

Now we should check pop and imap services with the command:

chkconfig --list | grep pop

and

chkconfig --list | grep imap

The services pop3 and imap services you want to start should say on, the ones you don't want should say off.

13. If you have iptables on, you can adjust the open ports with the command:

redhat-config-securitylevel-tui

Select enable and then Customize ...

You will need to open imap:tcp imaps:tcp pop3:tcp pop3s:tcp https:tcp in the bottom, as well as checking ssh and www at the top (that includes the later squirrelmail addon as well) and it allows you to ssh into the box ... or you can use the below file in /etc/sysconfig/iptables:

http://www.hughesjr.com/wbel/postfix/iptables.txt

This is a very basic iptables that is fairly secure for the e-mail server as a standalone machine inside your network ... security of your server is your call, not mine, this is just a suggested iptables that should allow you to have an e-mail server that works and is fairly secure.

14. In order to use PAM (ie, normal linux users with passwd / shadow usernames and passwords) as your SMTP authentication method, you MUST allow (and use) PLAIN text or Login as your Mail Client authenication method.

There is an indicated security problem with some older software concerning the permissions of the /var/spool/mail directory ... the error in /var/log/maillog is:

Mailbox vulnerable - directory /var/spool/mail must have 1777 protection

According to the RedHat mailing list, this is not really a problem ... although the fetchmail and ipop3d software included with RHEL and the clones think it is. You can ignore the error ... or ... you can use the command:

chmod 1777 /var/spool/mail

Either solution is acceptable.

15. In this setup, all users who have accounts on this server with a password can send and receive e-mail.

16. I am going to close this topic for posting ... if you have questions about this guide or your implementation of it, please post a topic in the Technical support forum.

I will next add httpd (apache), php and squirrelmail to this server in another post, so your users can also have webmail.


--------------------
Johnny Hughes
hughesjr@linuxhelp.net
Enterprise Alternatives: CentOS, WhiteBoxEL
Favorite Workstation Distros (in order): CentOS, Gentoo, Debian Sarge, Ubuntu, Mandrake, FedoraCore, Slackware, SUSE
Favorite Server Distros (in order): CentOS, WhiteBoxEL, Debian Sarge, Slackware, Mandrake, FedoraCore, Gentoo, SUSE
Go to the top of the page
 
+Quote Post

Posts in this topic


Closed TopicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 



RSS Lo-Fi Version Time is now: 23rd November 2017 - 10:49 PM