LinuxClass - Estudo de Caso MailServer Open Source

Caso de Estudo: E-mail Server ISP (25/10/2010)

LDAP + Postfix Virtual + Dovecot (Quotas) + Phamm + Mailwatch + Mailscanner + SpamAssassin + Clamav + Horde IMP Webmail + Gnarwl Auto-reply

Implementação: Fedora 12

Descrição das funcionalidades:

- Full Multi Domínio Hosting (Suporte a contas e sistema de entrega sem a necessidade de conta POSIX no sistema para cada usuário)
- Autenticação LDAP
- Gereciamento de Contas via Web do LDAP, função onde cada domínio hospedado terá um administrador específico protegido por senha (Phamm)
- Web-mail em Português Completo (Horde,IMP)
- Função de troca de Senha de Usuarios Web
- Função de auto-resposta e encaminhamento automáticos para férias Web-ldap
- Função de quota de caixa postal (Tamanho máximo para caixa postal individual dos usuários configurável via web (Ajustável por usuário))
- Relatórios Administrativos separados por domínio hospedado, estatítiscas com gráficos de envio , recebimento, spam e virus via Web (MailWatch)
- Anti-Spam Completo (Checagens de Servidor,Rede,Envelope,Corpo e databases públicas) (Postfix-Anti-UCE Restrictions+MailScanner+SpamAssassin)
- Whitelist e Blacklist Gerais do Domínio e por Usuário administradas via WEB (Mailwatch+Mailscanner)
- Whitelist do filtro de restrições UCE-POSTFIX
- Anti-virus de Email com atualizações Gratuitas (ClamAV)
- Função POP/IMAP/IMAPs (Seguro/Criptografado) (Dovecot)
- Função SMTP Autenticado (SASL Dovecot, POSTFIX MailDir) - Função de armazenamento em Quarentena separadas por domínio hospedado para Spam e Virus (MailScanner+MailWatch)
-Função de Alias no LDAP
-Função de encaminhamento (Forward) no LDAP

Baixar todos os arquivos de configuração (.conf):

confs.zip

Instalando e configurando o sistema operacional:

# Instale o fedora 12 e selecione os pacotes de desenvolvimento e Web-Server.

# Atenção: O MailScanner necessita de pelo menos 2GB de memoria RAM para rodar razoavelmente (processar 10.000 mails dia).

# Desligue o SElinux
# Insira no arquivo selinux a palavra disabled onde esta enabled.
sestatus
cd /etc/sysconfig
vi selinux

# Ajuste a hora do sistema. Ajustar data e hora sao fundamentais para o funcionamento do sub-sistema de mail
date -s 16:40

# Desligue qualquer Firewall ou filtro
chkconfig iptables off ; iptables -L ; iptables -F

# Desligue o Network Manager
chkconfig NetworkManager off
chkconfig network on

# Configure a Interface de rede e IP estatico para o Servidor
system-config-network-tui
cd /etc
cd sysconfig
cd network-scripts
vi ifcfg-eth0
service network restart

# Configure uma entrada no /etc/hosts adequada para seu nome de maquina e IP
vi /etc/hosts
192.168.1.34 mailserver.zapt.com.br mailserver

# Coloque em runlevel 3 (Inicializacao em modo texto)
vi /etc/inittab

# Verifique se o IP esta correto
ip addr list

# Verifique se existe um servidor de DNS valido no /etc/resolv.conf
# Teste usando: host www.google.com.br ou a ferramenta dig
# Para o envio e recebimento de emails a resolução de nomes do servidor deve estar 100% funcional.

# Ajuste a linguagem do sistema.
system-config-language

# Atualize todo o sistema
yum update

# Instale ou atualize alguns pacotes necessarios
# Instalando grupo devel necessario
yum grouplist |grep Devel
yum groupinstall "Legacy Software Development"
# Instale todos os grupos de desenvolvimento
yum install openldap-servers
yum install phpldapadmin
yum install postfix
yum install dovecot
yum install php

# Troca no alternatives o sendmail (default do fedora 12) para o postfix

alternatives --config mta
chkconfig sendmail off

# Gera Backup da configuracao original de alguns pacotes
cp /etc/openldap/slapd.conf slapd.conf.original
cp /etc/postfix/main.cf main.cf.original
cp /etc/postfix/master.cf master.cf.original
cp /etc/dovecot.conf dovecot.conf.original

LDAP e Phamm:

# Baixe o pacote phamm-0.5.18.tar.gz de www.phamm.org
# Descompacte: tar xvzf phpamm-0.5.18.tar.gz

# Copie todos os schemas do diretorio /schema após ter descompactado para /etc/openldap/schema

# Copie alguns schemas adicionais de http://open.rhx.it/phamm/schema/ para /etc/openldap/schema

# Voce ira precisar dos seguintes schemas:

phamm.schema, perversia.net.schema, ISPEnv2.schema, amavis.schema, pureftpd.schema,samba.schema,dnsdomain2.schema

# Copie o conteudo descompactado para o diretorio raiz do webserver (Ex. /var/www/html/phamm) (Eu sugiro /var/www/html/admin)

# Construa seu arquivo de configuraçao do openldap (slapd.conf) parecido com o exemplo fornecido.

# Para gerar um novo hash de password do rootdn use, copiando e colando a saida para o slapd.conf.
slappasswd

# Configuração inicial da database
cp /usr/share/doc/openldap-servers-2.4.15/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap:ldap /var/lib/ldap/DB_CONFIG
chmod 600 /var/lib/ldap/DB_CONFIG

#/etc/openldap/slapd.conf

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#

#include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
#include /etc/openldap/schema/duaconf.schema
#include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
#include /etc/openldap/schema/java.schema
#include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
#include /etc/openldap/schema/ppolicy.schema
#include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/phamm.schema
include /etc/openldap/schema/ISPEnv2.schema
include /etc/openldap/schema/amavis.schema
include /etc/openldap/schema/dnsdomain2.schema
include /etc/openldap/schema/pureftpd.schema
include /etc/openldap/schema/samba.schema

# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

# Load dynamic backend modules:
# modulepath /usr/lib/openldap # or /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload denyop.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload lastmod.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by changing to
# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
# slapd.pem so that the ldap user or group can read it. Your client software
# may balk at self-signed certificates, however.
# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
# TLSCertificateFile /etc/pki/tls/certs/slapd.pem
# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem

# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read

access to dn.one="dc=example,dc=tld"
by self write
by users read
by anonymous auth

access to * by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write
by * write
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

database bdb
suffix "dc=example,dc=tld"
checkpoint 1024 15
rootdn "cn=admin,dc=example,dc=tld"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw {SSHA}hz1xghfgh4FiTpTZHSVfY7L5sgObSaiFk

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap

# Indices to maintain for this database
# index objectClass eq,pres
# index ou,cn,mail,surname,givenname eq,pres,sub
# index uidNumber,gidNumber,loginShell eq,pres
# index uid,memberUid eq,pres,sub
# index nisMapName,nisMapEntry eq,pres,sub

# specific for mail
index objectClass eq
index cn,mail,givenname eq,subinitial
index vd,delete eq,pres
index accountActive,forwardActive eq,pres
index smtpAuth eq,pres
index associatedDomain pres,eq,sub
index aAAARecord pres,eq
index aRecord pres,eq
index sn,displayName pres,eq,sub
index uid,uidNumber,gidNumber,memberUid eq
index default sub
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq

# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
# bindmethod=sasl saslmech=GSSAPI
# authcId=host/ldap-master.example.com@EXAMPLE.COM

# enable monitoring
database monitor

# allow onlu rootdn to read the monitor
#access to *
# by dn.exact="cn=Manager,dc=my-domain,dc=com" read
# by * none

# Copie o arquivo config.inc.example.php para config.inc.php, ele deve se parecer com o exemplo abaixo, esta localizado no diretório root do phamm.

<?php
/*
* Phamm - http://www.phamm.org - <team AT phamm DOT org>
* Copyright (C) 2004,2008 Alessandro De Zorzi and Mirko Grava
* Project sponsored by RHX Studio Snc - www.rhx.it
*
* Phamm is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Phamm is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/

/**
* The main Phamm config file
*
* @package Phamm
* @subpackage configuration
* @author Alessandro De Zorzi <adezorzi AT rhx DOT it>
**/

// *============================*
// *=== LDAP Server Settings ===*
// *============================*

// The server address (To use ldapssl change to ldaps://localhost)
define ('LDAP_HOST_NAME','localhost');

// The protocol version [2,3]
define ('LDAP_PROTOCOL_VERSION','3');

// The server port (To use ldapssl change to 636)
define ('LDAP_PORT','389');

// Set LDAP_TLS to 1 if you want to use TLS
define ('LDAP_TLS',0);

// The container
define ('SUFFIX','dc=example,dc=tld');

// The admin bind dn (could be rootdn)
define ('BINDDN','cn=admin,dc=example,dc=tld');

// The Phamm container
define ('LDAP_BASE','o=hosting,dc=example,dc=tld');

// *============================*
// *=== Layout Settings ===*
// *============================*

// Page title
define('ORG_TITLE','Phamm');

// URL
define('ORG_URL','http://www.phamm.org');

// Logo
define('ORG_LOGO', './img/phamm_100.png');

// CSS Style
$style = 'phamm';

// Default language
define ('DEFAULT_LANGUAGE','en_GB');

// The languages available
$supported_languages = array();
$supported_languages["de_DE"] = "Deutsch";
$supported_languages["en_GB"] = "English";
$supported_languages["es_ES"] = "Espa√±ol";
$supported_languages["fr_FR"] = "French";
$supported_languages["hu_HU"] = "Hungarian";
$supported_languages["it_IT"] = "Italiano";
$supported_languages["pl_PL"] = "Polish";
$supported_languages["ru_RU"] = "Russian";
$supported_languages["vi_VN"] = "Ti·∫øng Vi·ªát"; // Vietnamese
$supported_languages["da_DK"] = "Dansk"; // Danish
// $supported_languages["ll_CC"] = "Your language here";

// This TLDs menu
$tld = array();
$tld[] = ".com";
$tld[] = ".org";
$tld[] = ".net";
// $tld[] = ".biz";
// $tld[] = ".info";
// $tld[] = ".eu";
// $tld[] = ".it";
// $tld[] = ".fr";
// $tld[] = ".de";

// *============================*
// *=== Plugins Settings ===*
// *============================*

// The default plugin
define ('DEFAULT_PLUGIN','mail');

// This array contains the active plugins
// NOTE the display order reflect this order
$plugins = array();
$plugins[] = "mail";
$plugins[] = "alias";
//$plugins[] = "dns";
//$plugins[] = "ftp";
//$plugins[] = "proxy";
//$plugins[] = "radius";
//$plugins[] = "radius_stats";
//$plugins[] = "rates";
//$plugins[] = "person";
//$plugins[] = "jabber";
//$plugins[] = "davical";

// Account can be mail OR alias
$plugins_exclusion = array("mail","alias");

// *============================*
// *=== System Settings ===*
// *============================*

// Phamm Version (+ indicate a CVS version)
define ('VERSION','0.5.18');

// Useful if you want hide the version [0,1]
define ('HIDE_VERSION',0);

// Useful if you wish force SSL through PHP [0,1]
define ('FORCE_SSL',0);

// Min password length
define ('PASSWORD_MIN_LENGHT',3);

// Seconds after refresh page
define ('REFRESH_TIME',1);

// A Domain administrator (example: postmaster)
define ('PHAMM_DOMAIN_ADMIN_NAME','postmaster');

// Welcome message
define ('SEND_WELCOME',0);
$welcome_msg = '../welcome_message.txt';
$welcome_subject = 'Welcome!';
# $welcome_sender = 'postmaster@localhost';
# $welcome_bcc = 'postmaster@localhost';

// *============================*
// *=== Advanced Settings ===*
// *============================*

// Debug level [0,1]
define ('DEBUG',0);

// PHP Error Level [0,1,2,10]
define ('ERROR_LEVEL',2);

// Log level 0->don't log [0,1,2]
define ('PHAMM_LOG',0);

// Log file path
define ('LOG_FILE','/var/log/phamm.log');

// Standard LDAP encryption type [CRYPT,MD5,CLEAR]
define ('ENC_TYPE','CRYPT');

// Permit login without @domain (use it with carefull)
// define ('DEFAULT_DOMAIN','example.tld');

# Inicie o ldap (service ldap start) ou (service slapd start)

# Para o Fedora 12 em diante, você deve fazer o backward compatibility (mv /etc/openldap/slapd.d /etc/openldap/disabled)

# Popule as base conforme os ldifs fornecidos nos exemplos do phamm.

ldapadd -v -x -D "cn=admin,dc=example,dc=tld" -W -h localhost -f examples/ldif/sample-main.ldif
ldapadd -v -x -D "cn=admin,dc=example,dc=tld" -W -h localhost -f examples/ldif/sample-mail.ldif

# Tente acessar atraves de um browser o phamm no servidor acessando o diretorio /phamm no diretorio root do apache.

# Tente logar-se usando usuário admin com a senha que você criou.

# Neste momento você já deve poder criar dominios e contas de emails através do phamm, se não puder, comece tudo novamente pois existe algo de errado.

# OPCIONAL - Você pode instalar o phpldapadmin para visualizar seu diretorio ldap (yum install phpldapadmin) Atenção! Use o phpldapadmin somente para debug, ou seja, visualizar em detalhes sua base ldap. Nunca use o phpldapadmin para gerenciar as contas e dominíos de seu mail server, para isso, deixe o phamm fazer seu trabalho.

Postfix e Dovecot:

# Abaixo você encontra todos os arquivos de configuração que estão em produção em meu servidor, seus arquivos devem se parecer com os meus.

# Substitua seus arquivos originais pelos arquivos modelos, recomendo fazer download nos links abaixo ao invés de copiar e colar. Guarde sempre um backup de seus arquivos originais.

# /etc/postfix/main.cf

smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
delay_warning_time = 4h
debug_peer_level = 8
myhostname = vm-mailcdl.cdlflorianopolis.org.br
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $myhostname
relayhost =
mynetworks = 127.0.0.0/8
dovecot_destination_recipient_limit = 1
mailbox_command = /usr/lib/deliver
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
broken_sasl_auth_clients = yes
home_mailbox = Maildir/

default_destination_concurrency_limit=50
default_destination_recipient_limit=50
default_process_limit=200
smtp_mx_session_limit=100
smtpd_client_connection_count_limit=100
smtp_destination_concurrency_limit=100
maximal_backoff_time = 1000s
minimal_backoff_time = 300s

smtpd_helo_required = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes

#smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated reject_unknown_client reject
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_invalid_hostname reject_unauth_pipelining reject_non_fqdn_sender reject_unknown_sender_domain reject_unverified_sender reject_multi_recipient_bounce reject_non_fqdn_recipient reject_unknown_recipient_domain reject_unlisted_recipient reject_rbl_client zen.spamhaus.org reject_rbl_client bl.spamcop.net permit

smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounce, permit

ldap_bind_dn = cn=phamm,o=hosting,dc=example,dc=tld
ldap_bind_pw = zymTask938
ldap_search_base = o=hosting,dc=example,dc=tld
ldap_domain = dc=example,dc=tld
ldap_server_host = localhost
ldap_server_port = 389
ldap_version = 3

# transports
transport_server_host = $ldap_server_host
transport_search_base = $ldap_search_base
transport_query_filter = (&(&(vd=%s)(objectClass=VirtualDomain))(accountActive=TRUE))
transport_result_attribute = postfixTransport
transport_cache = no
transport_bind = yes
transport_scope = one
transport_bind_dn = $ldap_bind_dn
transport_bind_pw = $ldap_bind_pw
transport_version = $ldap_version

# aliases
aliases_server_host = $ldap_server_host
aliases_search_base = $ldap_search_base
aliases_query_filter = (&(&(objectClass=VirtualMailAlias)(mail=%s))(accountActive=TRUE))
aliases_result_attribute = maildrop
aliases_bind = yes
aliases_cache = no
aliases_bind_dn = $ldap_bind_dn
aliases_bind_pw = $ldap_bind_pw
aliases_version = $ldap_version

# Accounts
accounts_server_host = $ldap_server_host
accounts_search_base = $ldap_search_base
accounts_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(accountActive=TRUE))
accounts_result_attribute = mailbox
accounts_cache = no
accounts_bind = yes
accounts_bind_dn = $ldap_bind_dn
accounts_bind_pw = $ldap_bind_pw
accounts_version = $ldap_version

accountsmap_server_host = $ldap_server_host
accountsmap_search_base = $ldap_search_base
accountsmap_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(accountActive=TRUE))
accountsmap_result_attribute = mail
accountsmap_cache = no
accountsmap_bind = yes
accountsmap_bind_dn = $ldap_bind_dn
accountsmap_bind_pw = $ldap_bind_pw
accountsmap_version = $ldap_version

# virtual quota
quota_server_host = $ldap_server_host
quota_search_base = $ldap_search_base
quota_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(accountActive=TRUE))
quota_result_attribute = quota
quota_cache = no
quota_bind = yes
quota_bind_dn = $ldap_bind_dn
quota_bind_pw = $ldap_bind_pw
quota_version = $ldap_version

# transport_maps
maildrop_destination_concurrency_limit = 2
maildrop_destination_recipient_limit = 1
transport_maps = hash:/etc/postfix/transport, ldap:transport
mydestination = $transport_maps, localhost, localhost.localdomain, $myhostname, localhost.$mydomain, $mydomain

# virtual accounts for delivery
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = ldap:accounts
virtual_minimum_uid = 500
virtual_uid_maps = static:500
virtual_gid_maps = static:500
#virtual_alias_maps = ldap:aliases, ldap:accountsmap, hash:/etc/postfix/virtual, ldap:virtualforward

virtual_alias_maps = ldap:virtualforward, ldap:aliases, ldap:accountsmap

local_recipient_maps = $alias_maps $virtual_alias_maps

owner_request_special = no
qmgr_message_active_limit = 40000
qmgr_message_recipient_limit = 40000

header_checks = regexp:/etc/postfix/header_checks

#####
# Mail to reply for gnarwl and mail to forward during vacation
recipient_bcc_maps = ldap:vfm
vfm_server_host = $ldap_server_host
vfm_search_base = $ldap_search_base
#vfm_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(vacationActive=TRUE)(forwardActive=FALSE)(accountActive=TRUE)(delete=FALSE))
vfm_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(vacationActive=TRUE)(accountActive=TRUE)(delete=FALSE))
vfm_result_attribute = mailAutoreply
vfm_cache = no
vfm_bind = yes
vfm_bind_dn = $ldap_bind_dn
vfm_bind_pw = $ldap_bind_pw
vfm_version = $ldap_version
gnarwl_destination_concurrency_limit = 1
gnarwl_destination_recipient_limit = 1

### Virtual Forward
# VirtualForward
virtualforward_server_host = $ldap_server_host
virtualforward_search_base = $ldap_search_base
#virtualforward_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(vacationActive=FALSE)(forwardActive=TRUE)(accountActive=TRUE)(delete=FALSE))
virtualforward_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(forwardActive=TRUE)(accountActive=TRUE)(delete=FALSE))
virtualforward_result_attribute = maildrop
virtualforward_bind = yes
virtualforward_cache = no
virtualforward_bind_dn = $ldap_bind_dn
virtualforward_bind_pw = $ldap_bind_pw
virtualforward_version = $ldap_version

#/etc/postfix/master.cf

#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - 1000 smtpd
#submission inet n - n - - smtpd
# -o smtpd_enforce_tls=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps inet n - n - - smtpd
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#628 inet n - n - - qmqpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - n - - smtp
-o fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - n - - showq
error unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${recipient}
#
# The Cyrus deliver program has changed incompatibly, multiple times.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#cyrus unix - n n - - pipe
# user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp unix - n n - - pipe
# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
dovecot unix - n n - - pipe
flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${recipient}
gnarwl unix - n n - - pipe
flags=F user=vmail argv=/usr/local/bin/gnarwl -a ${user}@${nexthop} -s ${sender}

#/etc/dovecot.conf

auth_verbose = no
mail_debug = no
auth_debug_passwords = no
verbose_proctitle = no
mail_uid = vmail
mail_gid = vmail

syslog_facility = mail

base_dir = /var/run/dovecot/
protocols = imap imaps pop3 pop3s
protocol imap {
mail_plugins = quota imap_quota
imap_client_workarounds = outlook-idle

}
protocol pop3 {
mail_plugins = quota
pop3_no_flag_updates = yes
pop3_reuse_xuidl = no
pop3_lock_session = no
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
protocol lda {
mail_plugins = quota sieve
postmaster_address = postmaster@zapt.com
auth_socket_path = /var/run/dovecot/auth-master
log_path = /var/log/dovecot-deliver-errors.log
info_log_path = /var/log/dovecot-deliver.log
}
plugin {
quota = maildir:User quota
quota_rule = *:storage=20M
quota_rule2 = Trash:storage=10M
quota_warning = storage=80%% /home/vmail/bin/quota-warning.sh 80
quota_warning2 = storage=90%% /home/vmail/bin/quota-warning.sh 90
quota_warning3 = storage=100%% /home/vmail/bin/quota-warning.sh 100
sieve = /home/vmail/%d/%n/.dovecot.sieve
}
listen = *
shutdown_clients = yes
log_timestamp = "%b %d %H:%M:%S "
syslog_facility = mail
disable_plaintext_auth = no
login_chroot = yes
login_user = postfix
login_process_per_connection = yes
login_processes_count = 2
login_max_processes_count = 128
login_max_connections = 256
login_greeting = Welcome to Dovecot ISP Server.
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c
login_log_format = %$: %s
mail_location = maildir:/home/vmail/%d/%u/Maildir
first_valid_uid = 89
pop3_uidl_format = %08Xu%08Xv
auth default {
mechanisms = PLAIN LOGIN
passdb ldap {
args = /etc/dovecot-ldap.conf
}
userdb ldap {
args = /etc/dovecot-ldap.conf
}
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0666
user = vmail
group = vmail
}
client {
path = /var/spool/postfix/private/auth
mode = 0666
user = postfix
group = postfix
}
}
user = vmail
}

#/etc/dovecot-ldap.conf

hosts = localhost
auth_bind = yes
sasl_bind = no
auth_bind_userdn = mail=%u,vd=%d,o=hosting,dc=example,dc=tld
ldap_version = 3
base = o=hosting,dc=example,dc=tld
dn = cn=phamm,o=hosting,dc=example,dc=tld
dnpass = sua-senha-aqui
deref = never
scope = subtree
user_attrs = %n,%Dd=user,quota=quota_rule=*:storage=%$,=home=/home/vmail/%d/%n/Maildir
user_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u))
pass_attrs = uid=mail
pass_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u))
default_pass_scheme = MD5
#user_global_uid = 30041
#user_global_gid = 30041

useradd vmail

cd /etc/postfix

postalias transport

postalias virtual

touch /var/log/dovecot-deliver-errors.log

touch /var/log/dovecot-deliver.log

chmod o+w /var/log/dovecot-deliver-errors.log

chmod o+w /var/log/dovecot-deliver.log

yum install dovecot-ldap

yum install dovecot-sieve

mkdir /home/vmail/bin

vi /home/vmail/bin/quota-warning.sh

chmod o+r /home/vmail/bin/quota-warning.sh

# No arquivo /etc/dovecot-ldap.conf Substitua os valores de DN e Senha para o dovecot ter acesso de leitura em sua base ldap

# No arquivo /etc/postfix/main.cf Substitua os valores para o postfix ter acesso de leitura em sua base ldap também.

# IMPORTANTE! - Ajuste o UID do usuario vmail de acordo com o seu sistema.

cp /etc/dovecot.conf /etc/dovecot-nowarning.conf

# Remova as seguintes linhas de /etc/dovecot-nowarning.conf

quota_warning = storage=80%% /home/vmail/bin/quota-warning.sh 80
quota_warning2 = storage=90%% /home/vmail/bin/quota-warning.sh 90
quota_warning3 = storage=100%% /home/vmail/bin/quota-warning.sh 100

Fazendo o Phamm deletar contas do disco e LDAP:

# Edite o arquivo /var/www/html/phamm/tools/cleaner.sh e ajuste as seguintes variáveis:

LDAP_BASE="o=hosting,dc=example,dc=tld"
admin="cn=admin"
SUFFIX="dc=example,dc=tld"
ROOTPW="sua-senha-aqui"
BINDDN="cn=admin,dc=example,dc=tld"
BINDPW="sua-senha-aqui"

# Em meu caso, tive que visualizar no phpldapadmin o atributo mailbox de meus usuários e editar/ajustar o script cleaner.sh manualmente. Veja abaixo meu exemplo:

{ print "rm -rf /home/vmail/" $2 > "'$OUTPUT'" }

# Você precisa ajustar o valor correto do atributo para o script conseguir apagar os arquivos nos paths corretos, se precisar edite também o arquivo: /var/www/html/admin/(ou phamm)/plugins/mail.xml. Esse é o arquivo chave que gera todos os atributos da conta quando criada no ldap.

# Agora copie esse script para /etc/cron.hourly

# O phamm apenas marca as contas, esse script que irá rodar a cada hora pelo cron ira efetivamente deletar as contas e arquivos do disco.

Ajustando os valores das Quotas:

# Substitua no arquivo /var/www/html/phamm/plugins/mail.xml o trecho, conforme o exemplo abaixo:

# Isso irá ajustar o valor de tamanho de quota default (Inicial) para 500MB de cada usuario novo criado.

# Observe que foi também deletado o caracter ( S ) do atributo suffix, e mudado o valor do multiplicador.

<attribute name="quota">
<prettyName>Quota</prettyName>
<table>1</table>
<default>500</default>
<multiplier>1024</multiplier>
<suffix></suffix>
<minAuthLevel>4</minAuthLevel>
</attribute>

# Ajuste também no arquivo mail.xml o diretorio default home dos seus usuarios corretamenta para seu sistema. (Procure a tag vdHome).

Mailscanner e SpamAssassin:

# Fazer o download em: http://www.mailscanner.info/downloads.html dos arquivos:
# MailScanner-4.79.11-1.rpm.tar
# install-Clam-SA-latest.tar

# Descompactar e executar o install.sh para o MailScanner e após realizar o
# mesmo procedimento para o pacote do install-Clam-SA.

# A instalação é bastante demorada, tenha paciência.

# Baixe o pacote unrar-3.7.8-2.fc9.i386.rpm e instale usando rpm -ivh unrar-3.7.8-2.fc9.i386.rpm. (Para o Fedora 12 existe outra versão do rar). Use o RPM pbone para encontrar seus pacotes rpm.

# Execute:

yum install perl-Mail-DKIM (satisfazendo todas as dependencias...)

chkconfig sendmail off

chkconfig postfix off

chkconfig MailScanner on

# Altere no arquivo /etc/postfix/main.cf a seguinte linha:

header_checks = regexp:/etc/postfix/header_checks

# Adicione no arquivo /etc/postfix/header_checks a seguinte linha: (Se você baixou meu arquivo, isso já existe, não faça duplicado)

/^Received:/ HOLD

# Altere no arquivo /etc/MailScanner/MailScanner.conf

Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
MTA = postfix

# Crie a estrutura de diretorios abaixo obedecendo as permissões:

chown postfix.postfix /var/spool/MailScanner/incoming
chown postfix.postfix /var/spool/MailScanner/quarantine
chown postfix.postfix /var/spool/MailScanner/spamassassin

#As Permissoes e owners dos sub-diretorios /var/spool/MailScanner devem ser as abaixo:

drwxr-xr-x 9 postfix postfix 4096 Ago 10 18:09 incoming
drwxr-xr-x 4 postfix apache 4096 Ago 10 18:08 quarantine
drwxr-xr-x 2 postfix postfix 4096 Jul 28 17:55 spamassassin

# Ajuste o parametro no arquivo /etc/MailScanner/spam.assassin.prefs.conf

envelope_sender_header X-yoursite-MailScanner-From

# Execule: MailScanner --lint

# Execute em: /var/spool/MailScanner/incoming

chown -R postfix.postfix *

# Execule novamente: MailScanner --lint

# Observe que não podem haver erros, se observar erros, tente corrigir-los isoladamente.

# A atualização das definições de virus ocorrem automaticamente, observe que da primeira vez que rodar o comando MailScanner --lint ainda tera definições de virus antigas, isso deve ser corrigido automaticamente em 24h.

# Novamente, é hora de ajustar a hora e data do sistema com o comando date, caso esteja ainda errada.

Faça o download periodicamente de:

/usr/bin/wget -N http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf

# Instalando o arquivo baixadado em: (KAM.cf são rules adicionais, recomendo usar elas.)

/etc/mail/spamassassin/

# Atualizando o SpamAssassin:

sa-update -D
cp /usr/local/bin/sa-update /etc/cron.daily/

# Instalando o RAZOR:

# O Razor transforma um e-mail em um codigo, uma especie de md5sum, desta forma pode verificar se a mesma mensagem esta chegando em diversos servidores ao redor do planeta. Um mesmo e-mail chegando a diversos servidores ao mesmo tempo, certamente é um e-mail de spam de massa circulando pela internet.

# Para instalar o plugin do razor siga os passos:

# Efetue o download dos seguintes pacotes e descompacte:
# http://razor.sourceforge.net/
# razor-agents-sdk-2.07.tar.bz2
# razor-agents-2.84.tar.bz2
# tar xjvf razor*

# Primeiro para o razor-agents-sdk execute:

perl Makefile.PL
make
make test
make install

# Agora para o razor-agents execute:

perl Makefile.PL
make
make test
make install

# Agora execute:

razor-admin -create

# Note que o razor irá criar sua configuração em /root/.razor
# Tenha cuidado para não apagar esse diretorio nunca.

# Para testar faça:

touch /tmp/spam
spamassassin -t -D razor2 < /tmp/spam

# Confira atentamente se o razor esta ou nao sendo usado.

# Instalando o DCC

# Efetue o download de http://www.rhyolite.com/anti-spam/dcc/
# Descompacte e execute:

./configure e após make install.

# Agora, voce precisa rebootar o sistema para ver se a inicializacao dos daemons ocorre normalmente, e também verificar se tudo esta correndo bem até aqui. Envie e receba mensagens locais, teste seu sistema. Observe os logs de /var/mail/maillog para certificar-se que tudo esta funcionando corretamente.

ClamAV Daemon:

# Instale todos os pacotes, clamav, clamav-server e etc.

yum install clamav*

# Copie o arquivo e comente a linha: Example

cp /usr/share/doc/clamav-server-0.95.3/clamd.conf /etc

vi /etc/clamd.d/scan.conf

# Edite o arquivo, comente a linha: Example e adicione as seguintes configurações:

LocalSocket /tmp/clamd.socket
User root

# Inicie a daemom:

service clamd.scan start

# Coloque o clamav para inicialização automatica no boot:

chkconfig clamd.scan on

Mailwatch:

yum install mysql
yum install mysql-server (Fedora 12)
yum install php-gd
yum install php-mysql
chkconfig mysqld on
service mysqld start
/usr/bin/mysqladmin -u root password 'sua-senha-aqui'

# Baixe e Descompacte o mailwatch:

tar xvf mailwatch-1.0.5.tar

mysql -p < create.sql
mysql -p
GRANT ALL ON mailscanner.* TO mailwatch@localhost IDENTIFIED BY 'mail';
GRANT FILE ON *.* TO mailwatch@localhost IDENTIFIED BY 'mail';
FLUSH PRIVILEGES;
quit

# Edite o arquivo MailWatch.pm e mude:

my($db_user) = 'mailwatch';
my($db_pass) = 'mail';

# Copie o MailWatch.pm para /usr/lib/MailScanner/MailScanner/CustomFunctions/ Veja abaixo:

cp MailWatch.pm /usr/lib/MailScanner/MailScanner/CustomFunctions/
mysql mailscanner -u mailwatch -p
INSERT INTO users VALUES ('admin',md5('sua-senha-aqui'),'admin','A','0','0','0','0','0');
quit

# Mova o diretorio mailscanner para o root do httpd

mv mailscanner /var/www/html
cd /var/www/html
chown root:apache images
chmod ug+rwx images
chown root:apache images/cache
chmod ug+rwx images/cache
cp conf.php.example conf.php

# No arquivo conf.php:

# Ajuste a senha do mysql e usuário nos parametros DB_USER E DB_PASS
# Ajuste para True a opcao QUARANTINE_USE_FLAG

mv /root/mailwatch-1.0.5 /opt/
echo "/opt/mailwatch-1.0.5/tools/quarantine_maint.php --clean" > /etc/cron.daily/quarantine_maint.sh
chmod +x /etc/cron.daily/quarantine_maint.sh

# Modifique a primeira linha do script db_clean.php para:
# #!/usr/bin/php -q

cp /tools/db_clean.php /etc/cron.daily/

# Ajuste o parametro Virus Scanner = clamavmodule no arquivo MailScanner.conf (Use clamd para quando estiver usando a versao daemon do clamav conforme voce instalou/configurou acima.)

# Ajuste esses parametros no arquivo MailScanner.conf

Always Looked Up Last = &MailWatchLogging
Detailed Spam Report = yes
Quarantine Whole Message = yes
Quarantine Whole Message As Queue Files = no
Include Scores In SpamAssassin Report = yes
Quarantine User = root
Quarantine Group = apache (this should be the same group as your web server)
Quarantine Permissions = 0660
Detailed Spam Report = yes
Include Scores In SpamAssassin Report = yes
Always Include SpamAssassin Report = yes
Spam Actions = store header "X-Spam-Status: Yes" forward spamquarentena@meudominio.org.br
High Scoring Spam Actions = store header "X-Spam-Status: Yes" forward spamquarentena@meudominios.org.br

# Verifique novamente as permissoes do diretório /var/spool/MailScanner:

drwxr-xr-x 9 postfix postfix 4096 Ago 10 18:09 incoming
drwxr-xr-x 4 postfix apache 4096 Ago 10 18:08 quarantine
drwxr-xr-x 2 postfix postfix 4096 Jul 28 17:55 spamassassin

# Integrando a Whitelist e Blacklist do Mailscanner com o MailWatch:

Edite o arquivo: SQLBlackWhiteList.pm
Configure os seguintes valores:
my($db_user) = '<username>';
my($db_pass) = '<password>';

cp SQLBlackWhiteList.pm /usr/lib/MailScanner/MailScanner/CustomFunctions/

# Edite o MailScanner.conf e configure os valores abaixo:

Is Definitely Not Spam = &SQLWhitelist
Is Definitely Spam = &SQLBlacklist

Horde IMP Webmail:

# Baixe o horde de ftp://ftp.horde.org/pub/horde/
# Descompacte o tar xvf horde_lastest.tar
# Mova para /var/www/html/horde

cd /var/www/html
chown -R apache:apache horde
cd ./horde/config
for f in *.dist; do cp $f `basename $f .dist`; done
cd ../scripts/sql
vi create.mysql.sql (Altere somente o password)
mysql -u root -p < create.mysql.sql

# Instale os seguintes pacotes e suas dependencias

yum install php-imap
yum install php-domxml
yum install php-gettext
yum install php-xml
yum install php-pecl-imagick
yum install php-pear*
yum install php-pecl*

# Gere o conf.php a partir do horde, acese o horde com um browser:
http://your-server/horde/
Go to Adminstration => Setup => Horde

# Caso deseje testar sua instalação use a página de testes do horde abaixo:
http://your-server/horde/test.php

# Ajustando o PHP:
# vi /etc/php.ini

display_errors = On
file_uploads = On
upload_max_filesize = 5M (or your choice)
memory_limit = 128M or more to be able to send large email attachments

# Instalando o IMP (Webmail do Horde):
# Baixe o IMP, e descompacte.
# Mova o conteudo para: /var/www/html/horde/imp

# Dentro de /horde :

chown -R apache:apache imp
cd ./imp/config/
for foo in *.dist; do cp $foo `basename $foo .dist`; done

# Crie as databases
mysql -u root -p horde < imp.sql
yum install uw*
yum install php-tidy
yum install php-idn

# Para terminar a instalação você precisa gerar o arquivo de configuração do IMP.

# Gere o conf.php a partir do horde, acese o horde com um browser:
http://your-server/horde/
Go to Adminstration => Setup => Horde => IMP

#Configure em: /var/www/html/horde/imp/config/servers.php conforme o exemplo abaixo:

$servers['_prompt'] = array(
'name' => _("imap")
);

/* Example configurations: */

$servers['imap'] = array(
'name' => 'IMAP Server',
'server' => 'localhost',
'hordeauth' => false,
'protocol' => 'imap/notls',
'port' => 143,
'maildomain' => 'example.com',
'smtphost' => 'smtp.example.com',
'smtpport' => 25,
'realm' => '',
'preferred' => '',
);

#
# Para nãoo precisar autenticar-se 02 vezes (uma no horde e outra no IMP, leia atentamente abaixo e siga os passos:)
#

If you would prefer that your users authenticate directly with IMP,
without having to authenticate through Horde first, load the
``Administration/Setup/Authentication`` page and from the ``What backend
should we use for authenticating users to Horde`` pulldown menu select
``Let a Horde application handle authentication``. (Please see the
second note below.) Select ``imp`` from the ``The application which is
providing authentication`` pulldown menu.

Gnarwl LDAP Auto-reply para Férias:

Baixe o pacote de:
http://www.onyxbits.de/gnarwl
Descompacte: tar xvf gnarwl-3.6.tar

./configure
make
make install
make perm

# Edite o arquivo /etc/postfix/transport adicionando (Observe que em meus exemplos já existe essa entrada, não faça duplicado):
.autoreply gnarwl:

# Após:
postalias transport

# Edite o arquivo /etc/postfix/master.cf adicionando no final: (Observe que em meus exemplos já existe essa entrada, não faça duplicado):
gnarwl unix - n n - - pipe
flags=F user=vmail argv=/usr/local/bin/gnarwl -a ${user}@${nexthop} -s ${sender}

# Edite o arquivo: /usr/local/etc/gnarwl.cfg conforme o modelo:
map_sender $sender
map_receiver $recepient
map_subject $subject
map_field $begin vacationStart
map_field $end vacationEnd
map_field $fullname cn
map_field $deputy vacationForward
map_field $reply mail
server localhost
port 389
scope sub
login cn=phamm,o=hosting,dc=example,dc=tld
password sua-senha-aqui
protocol 0
base dc=example,dc=tld
queryfilter (&(mailAutoreply=$recepient)(vacationActive=TRUE))
result vacationInfo
mta /usr/sbin/sendmail -F $recepient -t $sender
blockfiles /usr/local/var/lib/gnarwl/block/
umask 0644
blockexpire 48
# mta /usr/sbin/sendmail -F $recepient
maxreceivers 64
maxheader 512
charset ISO8859-1
badheaders /usr/local/var/lib/gnarwl/badheaders.db
blacklist /usr/local/var/lib/gnarwl/blacklist.db
forceheader /usr/local/var/lib/gnarwl/header.txt
forcefooter /usr/local/var/lib/gnarwl/footer.txt
recvheader To Cc
loglevel 3

# Agora voce precisa ajustar corretamente as permissões de alguns arquivos e diretorios conforme abaixo:

/usr/local/etc
-rw------- 1 vmail vmail 848 Ago 19 17:55 gnarwl.cfg
/usr/local/bin
-rwxr-xr-x 1 vmail vmail 24040 Ago 19 16:31 gnarwl

**(Ajuste o Owner e Grupo vmail recursivo a todos os arquivos e sub-diretorios abaixo)
/usr/local/var/lib
drwxr-xr-x 4 vmail vmail 4096 Ago 19 16:31 gnarwl

# Dica de Teste:

Quando testar, observe que o gnarwl mantem uma database, e somente será enviada uma auto-resposta de férias para cada solicitação. Por exemplo, se chegarem varios email de uma mesma origem, somente será enviado apenas 01 email de auto-respota para aquele email de origem.

Content on this page requires a newer version of Adobe Flash Player.