Email System For The Home Network - Version 2.1

[ViceClown]

I followed the latest version of this guide last week w/ great success! The only thing I changed was the smtp_client restrictions so I could receive mail to my domain. Im still working out the LAN SSL warning (localhost) but once I get that fixed I'll be all set. Thanks very much to Beowulf for putting this guide together. It's exactly what I've been looking for. I think that with a little more fleshing out in a few areas this post could / should be converted into a guide under the Gentoo docs for setting up an email server solution.

Great job, Beowulf!!

[brown]

ok just a note but postfix-2.0.19-r2 seems to remove the "newaliases" command

[Benzman]

If I try to send mail over an other pc I get the same mail from outlook. And here's the output in /var/log/messages:

Code: Select all

postfix/postfix-script: starting the Postfix mail system
postfix/master[12314]: daemon started -- version 2.0.19
postfix/smtpd[12323]: match_string: mynetworks ~? debug_peer_list
postfix/smtpd[12323]: match_string: mynetworks ~? fast_flush_domains
postfix/smtpd[12323]: match_string: mynetworks ~? mynetworks
postfix/smtpd[12323]: match_string: relay_domains ~? debug_peer_list
postfix/smtpd[12323]: match_string: relay_domains ~? fast_flush_domains
postfix/smtpd[12323]: match_string: relay_domains ~? mynetworks
postfix/smtpd[12323]: match_string: relay_domains ~? permit_mx_backup_networks
postfix/smtpd[12323]: match_string: relay_domains ~? qmqpd_authorized_clients
postfix/smtpd[12323]: match_string: relay_domains ~? relay_domains
postfix/smtpd[12323]: match_string: permit_mx_backup_networks ~? debug_peer_list
postfix/smtpd[12323]: match_string: permit_mx_backup_networks ~? fast_flush_domains
postfix/smtpd[12323]: match_string: permit_mx_backup_networks ~? mynetworks
postfix/smtpd[12323]: match_string: permit_mx_backup_networks ~? permit_mx_backup_networks
postfix/smtpd[12323]: maps_append: proxy:unix:passwd.byname
postfix/smtpd[12323]: connect to subsystem private/proxymap
postfix/smtpd[12323]: send attr request = open
postfix/smtpd[12323]: send attr table = unix:passwd.byname
postfix/smtpd[12323]: send attr flags = 64
postfix/smtpd[12323]: private/proxymap socket: wanted attribute: status
postfix/smtpd[12323]: input attribute name: status
postfix/smtpd[12323]: input attribute value: 0
postfix/smtpd[12323]: private/proxymap socket: wanted attribute: flags
postfix/smtpd[12323]: input attribute name: flags
postfix/smtpd[12323]: input attribute value: 80
postfix/smtpd[12323]: private/proxymap socket: wanted attribute: (list terminator)
postfix/smtpd[12323]: input attribute name: (end)
postfix/smtpd[12323]: dict_proxy_open: connect to map=unix:passwd.byname status=0 server_flags=0120
postfix/smtpd[12323]: dict_open: proxy:unix:passwd.byname
postfix/smtpd[12323]: maps_append: hash:/etc/mail/aliases
postfix/smtpd[12323]: dict_open: hash:/etc/mail/aliases
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? debug_peer_list
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? fast_flush_domains
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? mynetworks
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? permit_mx_backup_networks
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? qmqpd_authorized_clients
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? relay_domains
postfix/smtpd[12323]: match_string: smtpd_access_maps ~? smtpd_access_maps
postfix/smtpd[12323]: starting TLS engine
postfix/smtpd[12323]: watchdog_create: 0x80a73f8 18000
postfix/smtpd[12323]: watchdog_stop: 0x80a73f8
postfix/smtpd[12323]: watchdog_start: 0x80a73f8
postfix/smtpd[12323]: connection established
postfix/smtpd[12323]: master_notify: status 0
postfix/smtpd[12323]: name_mask: resource
postfix/smtpd[12323]: name_mask: software
postfix/smtpd[12323]: name_mask: noanonymous
postfix/smtpd[12323]: connect from unknown[192.168.0.103]
postfix/smtpd[12323]: > unknown[192.168.0.103]: 220 server.benzman.ath.cx ESMTP Postfix
postfix/smtpd[12323]: watchdog_pat: 0x80a73f8
postfix/smtpd[12323]: < unknown[192.168.0.103]: EHLO Schlepptop
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-server.benzman.ath.cx
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-PIPELINING
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-SIZE 10240000
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-VRFY
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-ETRN
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-STARTTLS
postfix/smtpd[12323]: match_hostname: unknown ~? 127.0.0.0/8
postfix/smtpd[12323]: match_hostaddr: 192.168.0.103 ~? 127.0.0.0/8
postfix/smtpd[12323]: match_hostname: unknown ~? 192.168.0.0/24
postfix/smtpd[12323]: match_hostaddr: 192.168.0.103 ~? 192.168.0.0/24
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250-XVERP
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250 8BITMIME
postfix/smtpd[12323]: watchdog_pat: 0x80a73f8
postfix/smtpd[12323]: < unknown[192.168.0.103]: MAIL FROM: <benzman@benzman.ath.cx>
postfix/smtpd[12323]: extract_addr: input: <benzman@benzman.ath.cx>
postfix/smtpd[12323]: extract_addr: result: benzman@benzman.ath.cx
postfix/smtpd[12323]: fsspace: .: block size 4096, blocks free 1530071
postfix/smtpd[12323]: smtpd_check_size: blocks 4096 avail 1530071 min_free 0 size 0
postfix/smtpd[12323]: connect to subsystem public/cleanup
postfix/smtpd[12323]: public/cleanup socket: wanted attribute: queue_id
postfix/smtpd[12323]: input attribute name: queue_id
postfix/smtpd[12323]: input attribute value: 9D42A207FD
postfix/smtpd[12323]: public/cleanup socket: wanted attribute: (list terminator)
postfix/smtpd[12323]: input attribute name: (end)
postfix/smtpd[12323]: send attr flags = 2
postfix/smtpd[12323]: 9D42A207FD: client=unknown[192.168.0.103]
postfix/smtpd[12323]: > unknown[192.168.0.103]: 250 Ok
postfix/smtpd[12323]: watchdog_pat: 0x80a73f8
postfix/smtpd[12323]: < unknown[192.168.0.103]: RCPT TO: <outbound@email.adress>
postfix/smtpd[12323]: extract_addr: input: <outbound@email.adress>
postfix/smtpd[12323]: extract_addr: result: outbound@email.adress
postfix/smtpd[12323]: generic_checks: START
postfix/smtpd[12323]: generic_checks: name=permit_sasl_authenticated
postfix/smtpd[12323]: generic_checks: name=permit_sasl_authenticated status=0
postfix/smtpd[12323]: generic_checks: name=reject
postfix/smtpd[12323]: 9D42A207FD: reject: RCPT from unknown[192.168.0.103]: 554 <unknown[192.168.0.103]>: Client host rejected: Access denied; from=<benzman@benzman.ath.cx> to=<outbound@email.adress> proto=ESMTP helo=<Schlepptop>
postfix/smtpd[12323]: generic_checks: name=reject status=2
postfix/smtpd[12323]: > unknown[192.168.0.103]: 554 <unknown[192.168.0.103]>: Client host rejected: Access denied
postfix/smtpd[12323]: watchdog_pat: 0x80a73f8
postfix/smtpd[12323]: < unknown[192.168.0.103]: QUIT
postfix/smtpd[12323]: > unknown[192.168.0.103]: 221 Bye
postfix/smtpd[12323]: disconnect from unknown[192.168.0.103]
postfix/smtpd[12323]: master_notify: status 1
postfix/smtpd[12323]: connection closed
postfix/smtpd[12323]: watchdog_stop: 0x80a73f8
postfix/smtpd[12323]: watchdog_start: 0x80a73f8

[BlinkEye]

to help you further i suggest you diff again your /etc/postfix/main.cf with others or you post yours here

[davidl]

This a a fantastic guide and is just what I need - few people will really need a full blown MTA infrastructure.

However, the only thing I don't want to use is IMAP. I would like a POP3 server instead of this. In the context of your guide what would you recommend and how would you go about setting it up? Perhaps this could be an optional chapter?

Cheers.

[davidl]

However, the only thing I don't want to use is IMAP. I would like a POP3 server instead of this. In the context of your guide what would you recommend and how would you go about setting it up? Perhaps this could be an optional chapter?

Cheers.

Arrghhh - courier-pop3d. I'm tying myself in knots with some of these tools. Perhaps an addition of pop3 to the guide would make it pretty complete.

[Benzman]

I've now changed the line

Code: Select all

smtpd_client_restrictions = permit_sasl_authenticated, reject

to

Code: Select all

smtpd_client_restrictions = permit_sasl_authenticated, reject_unauth_destination

like said in the "virtual/mailhost postfix howto"
As result I no longer get the error "Client host reacted: Access denied", I now get "Relay access denied".
I also made the test, mentioned under point 6 of the virtual/mailhost postfix howto (telnet to the mailserver and send a "EHLO benzman.ath.cx" to it). Heres the output:

Code: Select all

Connected to 192.168.0.2.
Escape character is '^]'.
220 server.benzman.ath.cx ESMTP Postfix
EHLO benzman.ath.cx
250-server.benzman.ath.cx
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-XVERP
250 8BITMIME

But the virtual/mailhost postfix howto says that the output should be that:

Code: Select all

220 mail.domain.com ESMTP Postfix
EHLO domain.com
250-mail.domain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-XVERP
250 8BITMIME

Especially the 2 lines "250-AUTH LOGIN PLAIN" and "250-AUTH=LOGIN PLAIN" irritate me. I'm not an email expert, but I think the smtpauth doesn't work for me...

edit: sorry, I forgot....
Here's my complete /etc/postfix/main.cf file:

Code: Select all

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_owner = postfix
myhostname = server.benzman.ath.cx
mydomain = benzman.ath.cx
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain $mydomain
unknown_local_recipient_reject_code = 450
mynetworks_style = subnet
mynetworks = 127.0.0.0/8 192.168.0.0/24
mailbox_command = /usr/bin/procmail
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.0.19/sample

readme_directory = /usr/share/doc/postfix-2.0.19/readme
default_destination_concurrency_limit = 2
alias_database = hash:/etc/mail/aliases
local_destination_concurrency_limit = 2
alias_maps = hash:/etc/mail/aliases
home_mailbox = .maildir/

smtpd_sasl_auth_enable = yes
smtpd_sasl2_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_sasl_authenticated, reject_unauth_destination

smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

[BlinkEye]

this is exactly the info needed to help you out. my problem: sasl authentication doesn't work for me neither. i'm sorry but i can't help you - i've tried to get ssl working for many days but finally gave up.

[BlinkEye]

either way, i'm just giving it another try. i added the sasl and ssl lines according to the virt-mail-howto and if i telnet on port 25 i get:

Code: Select all

#telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 blinkeye.dyndns.org ESMTP Postfix (2.0.19)
EHLO blinkeye.dyndns.org
250-blinkeye.dyndns.org
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH NTLM LOGIN PLAIN DIGEST-MD5 CRAM-MD5
250-AUTH=NTLM LOGIN PLAIN DIGEST-MD5 CRAM-MD5
250-XVERP
250 8BITMIME

may you have forgotten this step?:

# nano -w /etc/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: LOGIN PLAIN

[slestak]

I have root aliased to my local user on this machine in /etc/mail/aliases. Do I need to have a fetchmail entry in fetchmailrc to get local mail? I cant tell if postfix is not sending local mail, or if fetchmail is not being told to get it.

[BlinkEye]

I have root aliased to my local user on this machine in /etc/mail/aliases. Do I need to have a fetchmail entry in fetchmailrc to get local mail?

nope, you don't. to check what happens with your mail do a

Code: Select all

tail -f /var/log/messages

or wherever you store your mail messages (for my part this would be /var/log/mail.* (log,warn,err,info)) and send a message and post the messages that show up in your log.

[slestak]

i did see postfix output in /var/log/messages. I tried something that i need to undo. i aliased the root to my pop3 email address at my isp. that still didnt send. I will map it back to localuser and post messages output.

When I had it mapped to my external email addrtess, it did eventually get delivered.

[slestak]

tried using mutt to mail root@localhost with root aliased to steve@localhost

Code: Select all

May 25 15:45:05 webserver postfix/pickup[18728]: 1815044426: uid=0 from=<root>
May 25 15:45:05 webserver postfix/cleanup[18769]: 1815044426: message-id=<200405
25194504.GA18734@webserver.slestak.homelinux.org>
May 25 15:45:05 webserver postfix/qmgr[18729]: 1815044426: from=<root@webserver.
slestak.homelinux.org>, size=507, nrcpt=1 (queue active)
May 25 15:45:05 webserver local[18772]: fatal: execvp /some/where/procmail: No s
uch file or directory
May 25 15:45:06 webserver postfix/local[18771]: 1815044426: to=<steve@localhost.
slestak.homelinux.org>, orig_to=<root@localhost>, relay=local, delay=2, status=b
ounced (Command died with status 1: "/some/where/procmail")
May 25 15:45:06 webserver postfix/cleanup[18769]: 5EB5744427: message-id=<200405
25194506.5EB5744427@webserver.slestak.homelinux.org>
May 25 15:45:06 webserver postfix/qmgr[18729]: 5EB5744427: from=<>, size=2323, n
rcpt=1 (queue active)
May 25 15:45:06 webserver local[18775]: fatal: execvp /some/where/procmail: No s
uch file or directory
May 25 15:45:07 webserver postfix/local[18771]: 5EB5744427: to=<steve@localhost.
slestak.homelinux.org>, orig_to=<root@webserver.slestak.homelinux.org>, relay=lo
cal, delay=1, status=bounced (Command died with status 1: "/some/where/procmail"
)
webserver mail #

changed alias to just steve

Code: Select all

May 25 15:47:04 webserver postfix/master[18917]: daemon started -- version 2.0.1
9
May 25 15:47:41 webserver postfix/pickup[18920]: 5CC2244426: uid=0 from=<root>
May 25 15:47:41 webserver postfix/cleanup[18934]: 5CC2244426: message-id=<200405
25194741.GA18925@webserver.slestak.homelinux.org>
May 25 15:47:41 webserver postfix/qmgr[18921]: 5CC2244426: from=<root@webserver.
slestak.homelinux.org>, size=504, nrcpt=1 (queue active)
May 25 15:47:41 webserver local[18938]: fatal: execvp /some/where/procmail: No s
uch file or directory
May 25 15:47:42 webserver postfix/local[18936]: 5CC2244426: to=<steve@webserver.
slestak.homelinux.org>, orig_to=<root@webserver.slestak.homelinux.org>, relay=lo
cal, delay=1, status=bounced (Command died with status 1: "/some/where/procmail"
)
May 25 15:47:42 webserver postfix/cleanup[18934]: 87FA744427: message-id=<200405
25194742.87FA744427@webserver.slestak.homelinux.org>
May 25 15:47:42 webserver postfix/qmgr[18921]: 87FA744427: from=<>, size=2320, n
rcpt=1 (queue active)
May 25 15:47:42 webserver local[18941]: fatal: execvp /some/where/procmail: No s
uch file or directory
May 25 15:47:43 webserver postfix/local[18936]: 87FA744427: to=<steve@webserver.
slestak.homelinux.org>, orig_to=<root@webserver.slestak.homelinux.org>, relay=lo
cal, delay=1, status=bounced (Command died with status 1: "/some/where/procmail"
)

pertinent parts of /etc/hosts

Code: Select all

127.0.0.1       localhost
192.168.1.1     linksysrouter
192.168.1.2     webserver.slestak.homelinux.org webserver webserver-backup
192.168.1.4     toshiba
192.168.1.5     weezy
192.168.1.8     lol2
192.168.1.50    printserver

I think the current setup of the aliases is correct. steve@webserver.slestak.homelinux.org should stay internal based on my hosts file.

edit - clarify

I do not have an mx record. am not trying to run a full fledged mail server.

[BlinkEye]

well, i see the bug: you set the path to procmail wrong - and i guess it's in /etc/postfix/main.cf. you need to set the line accordingly to your path to procmail, i.e.

Code: Select all

mailbox_command = /usr/bin/procmail

instead of

Code: Select all

/some/where/procmail

i remember i set that wrong too the first time

[BlinkEye]

i hope you still know how you changed the configs that

Code: Select all

to=<steve@localhost.slestak.homelinux.org>

changed to

Code: Select all

to=<steve@webserver.slestak.homelinux.org>

i messed up my configs myself and don't know how i get rid of the localhost. i don't have subdomains as you do but in the header of an email i get

Code: Select all

for <**username**@localhost.dyndns.org>

instead of

Code: Select all

for <**username**@blinkeye.dyndns.org>

[slestak]

the main.cf problem took care of it. thanks.

[dan2003]

I followed the guide a few months ago and with a bit of help got it working. I recenlty did an emerge -u world and found that my configs got borked . Anyway after putting them all back to how i had them i can receive mail again but cannot send. I get in my mail client a message saying "authenticatiom failed - probably incorrect password" and in the /var/log/mail/current the message saying authenticatin failed.

I noticed a commnet above

Hi, thanks for this guide

You have pwcheck_method:saslauthd in /etc/sasl2/smtpd.conf but you neglect to add sasl users with saslpasswd2. I couldn't send mail from my Outlook Express client until I did this.

echo "$passwd" | saslpasswd2 -p -c $username

And I had to specify $username@$host as the username in Outlook Express where $host = the smtp server (short name - not fully-qualified).

I also had to "chown postfix:mail" the /etc/sasl2/sasldb2 file.

I never had to do this before to make it all work?

I will give this ago and see if it fixes things.

[dan2003]

Still cannot send mail . I'm using kmail 1.6.2 on 3 machines and since the udate world none of them will authenticate for sending mail from my local lan or outside (one is a laptop). I'm confused as receiving mail works fine and the username and password are the same for both.

[jjasghar]

i know this has probably answered before but i'm stuck --->

Code: Select all

ERROR
Error connecting to IMAP server: tito.homelinux.org.
111 : Connection refused

everything is running but for some odd reason i can't connect....any ideas?

Code: Select all

Warning: fsockopen(): unable to connect to tito.homelinux.org:143 in /var/www/localhost/htdocs/squirrelmail/functions/imap_general.php on line 445

too...

[vlack]

If you want to be able to send mail to extneral hosts, and receive mail from external hosts, do the following:

Change smtpd_recipient_restrictions in main.cf to:

Code: Select all

smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination 

Comment out smtpd_client_restrictions in main.cf:

Code: Select all

#smtpd_client_restrictions = permit_sasl_authenticated, reject

Could this information be put in the guide? Obviously, it's unnecessary if you are using your ISP's SMTP server + fetchmail, however, it's good for the rest of us

[Benzman]

I've found out sth new:
When I disable TLS support for postfix (comment the tls specific lines in the main.cf file), I get this when I telnet to the mailserver:

Code: Select all

220 server.benzman.ath.cx ESMTP Postfix
EHLO benzman.ath.cx
250-server.benzman.ath.cx
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-XVERP
250 8BITMIME

I'm also able to send mail.

So I think there's no problem with sasl, it's a problem with tls...

[Kope]

[edit] ignore this -- re-emerged everything, re-did the rc-update stuff and it all worked .../shrug [/edit]

Well.. I'm befuddled.

I followed the guide exactly.. and I'm stuck:

Code: Select all

Porgy new # cat /etc/postfix/main.cf
myhostname = porgy
mydomainname = dyndomain.dyn #it's actually something else, of course
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_owner = postfix
myorigin = $myhostname
mydestination = $myhostname, localhost.$mydomainname $myhostname.$mydomainname
unknown_local_recipient_reject_code = 450
mynetworks_style = subnet
mynetworks = 127.0.0.0/8 192.168.1.0/24
mailbox_command = /usr/bin/procmail
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
                  xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.0.16-r1/sample
readme_directory = /usr/share/doc/postfix-2.0.16-r1/readme
default_destination_concurrency_limit = 2
alias_database = hash:/etc/mail/aliases
local_destination_concurrency_limit = 2
alias_maps = hash:/etc/mail/aliases
home_mailbox = .maildir/
mtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_sasl_authenticated, reject
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

Here's the SASL stuff

Code: Select all

Porgy new # cat /usr/lib/sasl2/smtpd.conf && cat /etc/sasl2/smtpd.conf

pwcheck_method:saslauthd
mech_list: plain login 
# $Header: /home/cvsroot/gentoo-x86/net-mail/postfix/files/smtp.sasl,v 1.1 2003/09/24 05:08:51 max Exp $
#pwcheck_method:pam
pwcheck_method:saslauthd
mech_list: plain login

Porgy new # cat /etc/conf.d/saslauthd
# $Header: /home/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/files/saslauthd2.conf,v 1.2 2004/01/28 14:57:45 max Exp $

# Config file for /etc/init.d/saslauthd

# Initial (empty) options.
#SASLAUTHD_OPTS=""

# Specify the authentications mechanism.
# *NOTE* For list see: saslauthd -v
#SASLAUTHD_OPTS="${SASLAUTH_MECH} -a pam"
#SASLAUTHD_OPTS="-a ${SASL_AUTHMECH}"

# Specify the hostname for remote IMAP server.
# *NOTE* Only needed if rimap auth mech is used.
#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -O localhost"

# Specify the number of worker processes to create.
#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -n 5"

# Enable credential cache, cache size, and timeout.
# *NOTE* Size is measured in kilobytes
#        Timeout is measured in seconds
#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -c -s 128 -t 30"
#SASL_AUTHMECH=shadow
#SASL_RIMAP_HOSTNAME=""
#SASL_TIME_OF_DAY_LOGIN_RESTRICTIONS=yes
#
#
SASL_AUTHMECH=shadow
#
SASL_RIMAP_HOSTNAME=""
SASL_TIME_OF_DAY_LOGIN_RESTRICTIONS=yes
#
SASLAUTHD_OPTS="-a ${SASL_AUTHMECH}"

And the imap stuff

Code: Select all

Porgy new # cat /etc/courier-imap/authdaemond.conf
AUTHDAEMOND="authdaemond.plain"

Porgy new # cat /etc/courier-imap/authdaemondrc
authmodulelist="authpam"

The pam

Code: Select all

Porgy new # cat /etc/pam.d/imap
#%PAM-1.0
#
# $Id: system-auth.authpam,v 1.1 2001/02/02 05:42:57 mrsam Exp $
#
# Copyright 1998-2001 Double Precision, Inc.  See COPYING for
# distribution information.
#
# This is a sample authpam configuration file that uses pam_stack
# (circa linux-pam 0.72).

auth       required     pam_nologin.so
auth       required     pam_stack.so service=system-auth
account    required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth

and the SSL

Code: Select all

Porgy new # cat /etc/courier-imap/imapd.cnf

RANDFILE = /usr/share/imapd.rand

[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
C=US
ST=MN
L=Minneapolis
O=Mail Server
OU=Automatically-generated IMAP SSL key
CN=localhost
emailAddress=root@localhost


[ cert_type ]
nsCertType = server

I did do the mkimapdcert and it worked

All the daemons are running

When I try to send mail, or check mail, I get something along the lines of:

Code: Select all

Unable to authenticate via PLAIN.
The server replied:
Login failed.

in a dialog box from kmail.

Sending mail from an outside source has it bounce with a "reason: 554 Client host rejected: Access denied" error.

Telneting to the box on port 25 (from inside or outside the subnet) results in an established port connection but no text or prompt of any sort.

Any idea where I've gone wrong?

[ruth]

hi @all...
first of all: great guide...
helped me a lot in learning, configuring and trying my first postfix installations....
now to my problem, just a litte, i hope...

i just pulled postfix-2.1.1.ebuild off bugs.gentoo.org and emerged...
no problem so far - but:
after editing /etc/mail/aliases
i tried to run
/usr/bin/newaliases
NOPE, its' gone...
somone already wrote, as of version 2.0.19-r2 this program is not installed anymore...
why?
i looked around, and found the postalias command.
is this the current program to create /etc/mail/aliases.db ?
i already did a
postalias -c /etc/postfix/ hash:/etc/mail/aliases
and all seemed ok, so i just wanted to know, where, why has newaliases been kicked?
is my above command ok?


cheers

rootshell

[EDIT]
ok, the following command seems to work:

Code: Select all

postalias hash:/etc/mail/aliases

just in case, someone's missing the newaliases command...
[/EDIT]

[geforce]

OK, I can't Emerge Procmail !!!

I tried:

emerge procmail

USE="-X -qt -pdflib -gtk -gnome php mysql apache2 proftpd sendmail xml2 mbox sasl distcc" emerge procmail

Even

USE="-X -qt -pdflib -gtk -gnome php mysql apache2 proftpd sendmail xml2 mbox sasl distcc" emerge -O procmail

It didn't work, look at this:

GentooServ root # emerge procmail
Calculating dependencies ...done!
>>> emerge (1 of 1) net-mail/procmail-3.22-r6 to /
>>> md5 src_uri procmail-3.22.tar.gz
>>> Unpacking source...
>>> Unpacking procmail-3.22.tar.gz to /var/tmp/portage/procmail-3.22-r6/work
>>> Source unpacked.
patching file src/authenticate.c
/bin/sh ./initmake /bin/sh "/bin/sh" "/bin/rm -f" "mv -f" "ln" \
"-lm -ldir -lx -lsocket -lnet -linet -lnsl_s -lnsl_i -lnsl -lsun -lgen -lsockdns -ldl" \
"/lib /usr/lib /usr/local/lib" \
/dev/null "make" o \
"gcc" "-O2 -march=athlon-xp -pipe -fno-inline-functions " "-s " "procmail lockfile formail mailstat" \
"procmail formail lockfile" \
"procmailrc procmailsc procmailex" "src man" \
"/usr/bin" \
"strip"
gcc seems to work fine, using that as the C-compiler
...scanning for 13 libraries...
...scanning for 12 libraries...
...scanning for 11 libraries...
...scanning for 10 libraries...
...scanning for 9 libraries...
...scanning for 8 libraries...
...scanning for 7 libraries...
...scanning for 6 libraries...
...scanning for 5 libraries...
...scanning for 4 libraries...
Added LDFLAGS= -lm -lnsl -ldl -lc
cd src; make ../autoconf.h
echo Housekeeping file >config.check
make[1]: Entering directory `/var/tmp/portage/procmail-3.22-r6/work/procmail-3.22/src'
/bin/sh ./autoconf /bin/sh "/bin/rm -f" "mv -f" /dev/null \
"grep -F" "make" o "/tmp . " \
"/usr/bin" ../autoconf.h
Using the following directories for the LOCKINGTESTs:
/tmp .
Initiating fcntl()/kernel-locking-support tests

Proceeding with kernel-locking-support tests in the background
Testing for const
./autoconf: line 743: 17662 Segmentation fault grepfor const '#define NO_const'
Testing for volatile
Testing for prototypes
Testing for enum
Checking for POSIX and ANSI/ISO system include files
Checking for network/comsat/biff support
Testing for void*, size_t, off_t, pid_t, time_t, mode_t, uid_t & gid_t
Checking realloc implementation
Testing for WIFEXITED(), WIFSTOPPED(), WEXITSTATUS() & WSIGTERM()
./autoconf: line 1011: 17723 Segmentation fault grepfor struct '#define WMACROS_NON_POSIX'
./autoconf: line 1011: 17724 Segmentation fault grepfor union '#define WMACROS_NON_POSIX'
Testing for various struct passwd members
./autoconf: line 1024: 17731 Segmentation fault grepfor pw_passwd '#define NOpw_passwd'
./autoconf: line 1025: 17732 Segmentation fault grepfor pw_class '#define NOpw_class'
./autoconf: line 1026: 17733 Segmentation fault grepfor pw_gecos '#define NOpw_gecos'
Testing for memmove, strchr, strpbrk, strcspn, strtol, strstr,
rename, setrgid, setegid, pow, opendir, mkdir, waitpid, fsync,
ftruncate, strtod, strncasecmp, strerror, strlcat,
memset, bzero, and _exit
./autoconf: line 1081: 17754 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17755 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17756 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17757 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17758 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17759 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17760 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17761 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17762 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17763 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17764 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17765 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17766 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17767 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17768 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17769 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1081: 17770 Segmentation fault grepfor $func "#define NO$func"
./autoconf: line 1084: 17771 Segmentation fault grepfor strerror "#define NOstrerror"
./autoconf: line 1090: 17772 Segmentation fault grepfor opendir "
#define NOopendir /* the readdir library does not seem to be available
this will slightly affect the way a filenumber is
selected in MH-folders by procmail */
"
./autoconf: line 1092: 17773 Segmentation fault grepfor setrgid '#define NOsetrgid'
./autoconf: line 1097: 17774 Segmentation fault grepfor setegid '#define NOsetegid'
./autoconf: line 1098: 17775 Segmentation fault grepfor strchr '#define strchr(s,c) index(s,c)'
./autoconf: line 1101: 17776 Segmentation fault grepfor uname "#define NOuname /* <sys/utsname.h> defines it, the libraries don't */"
./autoconf: line 1102: 17777 Segmentation fault grepfor endpwent '#define endpwent()'
./autoconf: line 1103: 17778 Segmentation fault grepfor endgrent '#define endgrent()'
./autoconf: line 1112: 17779 Segmentation fault grepfor gethostbyname '#define NO_COMSAT'
./autoconf: line 1112: 17780 Segmentation fault grepfor getprotobyname '#define UDP_protocolno 17'
./autoconf: line 1112: 17781 Segmentation fault grepfor endhostent '#define endhostent()'
./autoconf: line 1112: 17782 Segmentation fault grepfor endservent '#define endservent()'
./autoconf: line 1112: 17783 Segmentation fault grepfor endprotoent '#define endprotoent()'
./autoconf: line 1114: 17784 Segmentation fault grepfor strstr '#define SLOWstrstr'
./autoconf: line 1114: 17785 Segmentation fault grepfor clock '#define SLOWstrstr'
./autoconf: line 1179: 17786 Segmentation fault grepfor memmove '#define NOmemmove'
Determining the maximum number of 16 byte arguments execv() takes
Whoeaaa! This actually can't happen.
You have a look and see if you detect anything uncanny:
*******************************************************
_autotst.o(.text+0x5ce): In function `main':
: undefined reference to `setrgid'
_autotst.o(.text+0x679): In function `main':
: undefined reference to `setrgid'
collect2: ld returned 1 exit status
make[2]: *** [_autotst] Error 1
*******************************************************
I suggest you take a look at the definition of LDFLAGS*
in the Makefile before you try make again.
make[1]: *** [../autoconf.h] Error 1
make[1]: Leaving directory `/var/tmp/portage/procmail-3.22-r6/work/procmail-3.22/src'
make: *** [autoconf.h] Error 2

!!! ERROR: net-mail/procmail-3.22-r6 failed.
!!! Function src_compile, Line 41, Exitcode 2
!!! (no error message)

It says to look at the LDFLAGS ?????

What are the LDFLAGS ???

I don't really understand how to modify my make.conf, however, here is mine:

GentooServ root # cat /etc/make.conf
# Copyright 2000-2002 Daniel Robbins, Gentoo Technologies, Inc.
# Contains local system settings for Portage system
# Please review 'man make.conf' for more information.

# Build-time functionality
# ========================
#
# The USE variable is used to enable optional build-time functionality. For
# example, quite a few packages have optional X, gtk or GNOME functionality
# that can only be enabled or disabled at compile-time. Gentoo Linux has a
# very extensive set of USE variables described in our USE variable HOWTO at
# http://www.gentoo.org/doc/use-howto.html
#
# The available list of use flags with descriptions is in your portage tree.
# Use 'less' to view them: --> less /usr/portage/profiles/use.desc <--
#
# Example:
USE="X gtk gnome -alsa ssl pam nls maildir sasl gdbm berkdb -mysql -ldap -mbox -postgres -kerberos -java -static"

# Host Setting
# ============
#
# If you are using a Pentium Pro or greater processor, leave this line as-is;
# otherwise, change to i586, i486 or i386 as appropriate. All modern systems
# (even Athlons) should use "i686-pc-linux-gnu"
#
CHOST="i686-pc-linux-gnu"

# Host and optimization settings
# ==============================
#
# For optimal performance, enable a CFLAGS setting appropriate for your CPU
#
# -mcpu=<cpu-type> means optimize code for the particular type of CPU without
# breaking compatibility with other CPUs.
#
# -march=<cpu-type> means to take full advantage of the ABI and instructions
# for the particular CPU; this will break compatibility with older CPUs (for
# example, -march=athlon-xp code will not run on a regular Athlon, and
# -march=i686 code will not run on a Pentium Classic.
#
# CPU types supported in gcc-3.2 and higher: athlon-xp, athlon-mp, athlon-4,
# athlon-tbird, athlon, k6, k6-2, k6-3, i386, i486, i586 (Pentium), i686
# (PentiumPro), pentium, pentium-mmx, pentiumpro, pentium2 (Celeron), pentium3,
# and pentium4. Note that Gentoo Linux 1.4 and higher include at least gcc-3.2.
#
# CPU types supported in gcc-2.95*: k6, i386, i486, i586 (Pentium), i686
# (Pentium Pro), pentium, pentiumpro Gentoo Linux 1.2 and below use gcc-2.95*
#
# Decent examples:
#
#CFLAGS="-mcpu=athlon-xp -O3 -pipe"
CFLAGS="-O2 -march=athlon-xp -pipe"

# If you set a CFLAGS above, then this line will set your default C++ flags to
# the same settings. If you don't set CFLAGS above, then comment this line out.
CXXFLAGS="${CFLAGS}"

# Advanced Masking
# ================
#
# Gentoo is using a new masking system to allow for easier stability testing
# on packages. KEYWORDS are used in ebuilds to mask and unmask packages based
# on the platform they are set for. A special form has been added that
# indicates packages and revisions that are expected to work, but have not yet
# been approved for the stable set. '~arch' is a superset of 'arch' which
# includes the unstable, in testing, packages. Users of the 'x86' architecture
# would add '~x86' to ACCEPT_KEYWORDS to enable unstable/testing packages.
# '~ppc', '~sparc', '~sparc64' are the unstable KEYWORDS for their respective
# platforms. DO NOT PUT ANYTHING BUT YOUR SPECIFIC ~ARCHITECTURE IN THE LIST.
# IF YOU ARE UNSURE OF YOUR ARCH, OR THE IMPLICATIONS, DO NOT MODIFY THIS.
#
#ACCEPT_KEYWORDS="~arch"

# Portage Directories
# ===================
#
# Each of these settings controls an aspect of portage's storage and file
# system usage. If you change any of these, be sure it is available when
# you try to use portage. *** DO NOT INCLUDE A TRAILING "/" ***
#
# PORTAGE_TMPDIR is the location portage will use for compilations and
# temporary storage of data. This can get VERY large depending upon
# the application being installed.
#PORTAGE_TMPDIR="/var/tmp"
#
# PORTDIR is the location of the portage tree. This is the repository
# for all profile information as well as all ebuilds. This directory
# itself can reach 200M. WE DO NOT RECOMMEND that you change this.
#PORTDIR="/usr/portage"
#
# DISTDIR is where all of the source code tarballs will be placed for
# emerges. The source code is maintained here unless you delete
# it. The entire repository of tarballs for gentoo is 9G. This is
# considerably more than any user will ever download. 2-3G is
# a large DISTDIR.
#DISTDIR="${PORTDIR}/distfiles"
#
# PKGDIR is the location of binary packages that you can have created
# with '--buildpkg' or '-b' while emerging a package. This can get
# upto several hundred megs, or even a few gigs.
#PKGDIR="${PORTDIR}/packages"
#
# PORTDIR_OVERLAY is a directory where local ebuilds may be stored without
# concern that they will be deleted by rsync updates. Default is not
# defined.
#PORTDIR_OVERLAY="/usr/local/portage"

# Fetching files
# ==============
#
# If you need to set a proxy for wget or lukemftp, add the appropriate "export
# ftp_proxy=<proxy>" and "export http_proxy=<proxy>" lines to /etc/profile if
# all users on your system should use them.
#
# Portage uses wget by default. Here are some settings for some alternate
# downloaders -- note that you need to merge these programs first before they
# will be available.
#
# Lukemftp (BSD ftp):
#FETCHCOMMAND="/usr/bin/lukemftp -s -a -o \${DISTDIR}/\${FILE} \${URI}"
#RESUMECOMMAND="/usr/bin/lukemftp -s -a -R -o \${DISTDIR}/\${FILE} \${URI}"
#
# Prozilla (turbo downloader)
#FETCHCOMMAND='/usr/bin/proz --no-getch -s ${URI} -P ${DISTDIR}'

# Advanced Features
# =================
#
# MAKEOPTS provides extra options that may be passed to 'make' when a
# program is compiled. Presently the only use is for specifying
# the number of parallel makes (-j) to perform. The suggested number
# for parallel makes is CPUs+1.
#MAKEOPTS="-j2"
#
# AUTOCLEAN enables portage to automatically clean out older or overlapping
# packages from the system after every successful merge. This is the
# same as running 'emerge -c' after every merge. Set with: "yes" or "no".
#AUTOCLEAN="yes"
#
# FEATURES are settings that affect the functionality of portage. Most of
# these settings are for developer use, but some are available to non-
# developers as well. 'buildpkg' is an always-on setting for the emerge
# flag of the same name. It causes binary packages to be created of all
# packages that are merged.
#FEATURES="sandbox ccache buildpkg"
#
# RSYNC_RETRIES sets the number of times portage will attempt to retrieve
# a current portage tree before it exits with an error. This allows
# for a more successful retrieval without user intervention most times.
#RSYNC_RETRIES="3"

Thanks !!!!

[robfish]

I have tried this how-to twice (once a few months ago prior to some changes).

My server and workstation are the same box (is that a problem).
I can send and recieve email using Squirrelmail but I cannot send using either Kmail or Evolution, recieving is fine.

The error messages I get refer to an authentication problem.