Nasim Mansurov

18.1) Post-installation and spam control
The installation covered above should filter out most of the spam out there. But it’s not perfect. Spammers are so smart nowadays…they will do everything possible to pass their message and advertise their products/services you will never need. They will even fake their messages so good, that spamassassin will be unable to identify them as spam. So, what do we do with them? There is another solution, which for some users will be a pain, but it will definitely help you out a lot. If you remember, earlier in the guide I said that I would explain “badmailfrom” and “badrcptto” in more detail. Well, here we go :-)

These two files placed in /var/qmail/control directory are used by qmail to identify the bad guys. Sometimes the bad guys are from outside networks - those hungry spammers that just love to waste your mail traffic. In some cases, the bad guys are your own users! I’ve had some users before, who advertised their e-mails on the Internet and subscribed to gazillion newsletters. As soon as the mailbox is full, the server starts generating failure replies, adding to traffic and server load. And the sad thing is - even if you remove the damn user, e-mails will keep on coming and failure replies will be generated even more. So, how do we fight them?

The “badmailfrom” file is sort of your internal blacklist, in which you specify domains or individual e-mail addresses from which you are not willing to receive e-mails from. For example, if you don’t want to receive e-mails from yahoo users, simply add “@yahoo.com” in a new line. If a particular yahoo mail user is bothering you, add his/her full e-mail address to “badmailfrom”. The next time the user tries to send a message, your server will simply deny the message, before even processing it. Here is a good example of “badmailfrom” file:

@yahoo.com
@mail.ru
@hotmail.com
devil@netscape.net
president@whitehouse.gov

Here, we are denying all yahoo.com, mail.ru and hotmail.com users. Plus, we are denying messages from individual e-mail accounts - devil@netscape.net and president@whitehouse.gov :)

The “badrcptto” file will help you control your local “bad guys”. Every account specified in “badrcptto” will no longer receive any e-mails. The sender will receive a delivery failure message “553 sorry, this recipient is in my badrecipientto list” after sending an e-mail to blacklisted local user. The “badrcptto” file is processed line by line, just like badmailfrom. So, if you need to block access to several users, type their e-mail addresses one per line.

There are some new tools appearing now on the Internet that help to better fight spam, but I haven’t checked them out yet. If something good is released, I will definitely add it to this guide.

19) oMail-admin
oMail-admin is a great program written by Olivier Mueller. It allows you to manage virtual users on your system (create users and aliases, forwarding,
mailing lists, automated replies, etc.)

oMail-admin needs “vmailmgrd” daemon to run, which should already be up and running from the “runmail” script we’ve created before. Again, type ps ax to see if a process called unixserver exists.

This step assumes that an Apache server compiled with PHP is up and running. (If you haven’t installed Apache yet, I would highly recommend my Apache guide which is available here). Place the oMail files into your htdocs directory, and edit your apache configuration (httpd.conf) as necessary. Open your browser and then type the URL for oMail-admin. Type your domain (yourserver.com) in “Email Address or Domain Name” box and the domain password that you entered during the “add_virt” command. Then, click “Login” and a new page with account management should come up. It is very easy to go from there - just read “Help” if you don’t understand how it works.

20) Startup environment
Now we need to make sure that Qmail and all other extra stuff we’ve been installing so far starts up properly when the machine is rebooted.

You can do it in two ways - either by placing the lines below into your startup file (/etc/rc.d/rc.local):

# echo ‘# Qmail and other stuff’ >> /etc/rc.d/rc.local
# echo ‘/var/qmail/rc &’ >> /etc/rc.d/rc.local
# echo ‘/usr/local/bin/runmail’ >> /etc/rc.d/rc.local
# echo ‘/usr/lib/courier-imap/libexec/imapd.rc start’ >> /etc/rc.d/rc.local

or putting qmail, courier and tcpserver startup scripts into your init.d directory. Don’t forget to make those files executable and run automatically upon reboot:

# mv qmail /etc/rc.d/init.d
# mv courier /etc/rc.d/init.d

# mv tcpserver /etc/rc.d/init.d
# chmod 755 /etc/rc.d/init.d/qmail
# chmod 755 /etc/rc.d/init.d/courier
# chmod 755 /etc/rc.d/init.d/tcpserver
# chkconfig –add qmail
# chkconfig –add courier
# chkconfig –add tcpserver
# chkconfig qmail on
# chkconfig courier on
# chkconfig tcpserver on

21) POP3S and SMTPS using stunnel
The way traditional POP3 and SMTP protocols work is so insecure that it’s easily possible to sniff a login/password combination using simple network utilities. That leads to a security problem, which might result in a hacker stealing your users’ mailbox accounts. Because we are dealing with virtual users who do not have access to shell, just because of the way the system works, it might not be a major security problem. At least we do not have to worry about hackers logging into a shell, stealing information and screwing up our box. However, it’s always good to take precautions no matter how small the impact could be to your security. Normal sendmail installation, for example, authenticates through /etc/passwd. If a user is given both mail and shell access, just think what the end result might be. A hacker might sniff a login/pass combination for a mailbox and then successfully login into the system via shell, even if you have telnet disabled and only allow SSH access. Once a hacker has shell account, there are plenty of tools out there to gain root access. And you never know what’s on hacker’s mind when he/she hacks into your box. This is the major advantage of having a virtual user system. Even if a hacker steals login/pass combination for a mailbox account, the maximum he/she can do is overtake a mailbox. But again, you never know. What if a user on your system uses the same combination of login/password for both mail and shell access? Then basically, you’re screwed.

This step will help you to fight the problem of plaintext login/password authentication with a mail server. I will show you how to configure POP3 and
SMTP via SSL.

To those who wonder how we’re going to accomplish this task, let me give you some quick insight. We will have to install stunnel first. Stunnel is a universal SSL wrapper, which will allow us to secure POP3 and SMTP protocols through OpenSSL. Then, we are going to bind tcpserver to stunnel and add some more options to our runmail script created earlier. The whole process should take approximately 15 minutes, if we don’t have any compilation problems. I will try to explain each step in as much detail as possible.

21.1) OpenSSL and Stunnel
Before installing stunnel, please make sure that you have a working version of OpenSSL installed on the system. Try to look for openssl binary by typing “whereis openssl” or “locate openssl” in shell. Possible locations of OpenSSL are: /usr/bin, /usr/local/bin and /usr/local/ssl/bin but a customized installation might have resulted in OpenSSL being somewhere else on the system. Once you find out where it is, type “openssl version” (add the real path in front as needed). If your version is older than 0.9.6j, I personally recommend to upgrade it or reinstall it, because of some security issues found in previous releases. If you have an old RPM release, get rid of it and install from source. The latest version of OpenSSL can be found from here.

Let’s install stunnel now:

# cd /usr/local/src/
# tar zxf stunnel-3.26.tar.gz
# cd stunnel-3.26
# CFLAGS=”-I/usr/kerberos/include -L/usr/kerberos/lib” \
./configure –with-pem-dir=/usr/local/etc
# make

After “make” is done compiling sources, an RSA key will be generated for you. All you have to do, is enter correct information. Here is a sample for arbuz.com:

Country Name (2 letter code) [PL]:UZ
State or Province Name (full name) [Some-State]:Tashkent
Locality Name (eg, city) []:Tashkent
Organization Name (eg, company) [Stunnel Developers Ltd]:Arbuz.com
Organizational Unit Name (eg, section) []:Arbuz.com
Common Name (FQDN of your server) [localhost]:arbuz.com

Make sure that you type your mail hostname in “Common Name (FQDN of your server)” field. Now do the following:

# cp stunnel.pem /usr/local/etc/
# chmod 600 /usr/local/etc/stunnel.pem
# make install

21.2) Modifying the runmail script
The most important step in this process is how our script calls stunnel. Unfortunately, I couldn’t find any information on the web that gives a working sample of stunnel called via tcpserver. After finding out more about stunnel and it’s command options, I came up with a working script based on runmail you’ve seen above. Add it to your runmail script if you want to have all protocols (POP3, SMTP, POP3S and SMTPS) up and running for compatibility or whatever reasons. If you want to have POP3S and SMTPS only, remove everything after the first part (unixserver), then copy paste the following into the script:

exec softlimit -m 32000000 \
envdir /etc/relay-ctrl relay-ctrl-chdir \
tcpserver -v -H -R -l arbuz.com -x /etc/tcp.smtp.cdb \
-c200 -u0 -g0 0 465 \
stunnel -f -p /usr/local/etc/stunnel.pem \
-N smtps -l relay-ctrl-check — relay-ctrl-check \
fixcrio qmail-smtpd 2>&1 \
| setuidgid qmaill \
multilog t n100 s1000000 /var/qmail/logs/smtps & \

exec softlimit -m 32000000 \
envdir /etc/relay-ctrl relay-ctrl-chdir \
tcpserver -v -H -R -l arbuz.com -x /etc/tcp.smtp.cdb \
-c200 -u0 -g0 0 995 \
stunnel -f -p /usr/local/etc/stunnel.pem \
-N pop3s -l qmail-popup — qmail-popup localhost \
checkvpw relay-ctrl-allow qmail-pop3d Maildir 2>&1 \
| setuidgid qmaill \
multilog t n100 s1000000 /var/qmail/logs/pop3s &

Now go ahead and rerun runmail and test if POP3S and SMTPS really work. If you are running tcp wrappers, make sure you put “smtps: ALL: ALLOW” and “pop3s: ALL: ALLOW” into /etc/hosts.allow - otherwise all secure connections will be denied by your server.

If you get an error in log saying “SSL3_READ_BYTES:tlsv1 alert unknown ca” that means your mail client doesn’t accept the SSL certificate created earlier. Note that the certificate we created is not trusted. This is because an authority like VeriSign or Thawte didn’t sign it. I personally don’t like paying a couple of hundred dollars for an SSL certificate, but if money is not an issue for you, you should generate your own SSL key, and send it to an authority to sign it. That way you can get rid of annoying warnings from mail clients. I had a couple of issues trying to send and receive mail with “The Bat” mail client. But I then figured out that my client didn’t want to accept connections from/to an untrusted connection. So, after adding my certificate into the address book and into the trusted server list, I got rid of the “unknown ca” error. I also tested the connection on Outlook Express and everything seemed to work flawlessly (except that annoying “Internet Security Warning”). Note that POP3S and SMTPS sit on ports 995 and 465, respectively. So, make sure you specify the ports correctly while configuring your mail clients.

That’s it! You are finally done! Congratulations

Used Resources:

1) Qmail-Vmailmgr-Courier-SquirrelMail Installation Guide by Konstantin Riabitsev
2) Qmail Homepage
3) Untroubled.org by Bruce Guenter
4) Cr.yp.to by D.J. Bernstein
5) Courier Mail Server by Double Precision, Inc.
6) SpamAssassin.org
7) Qmail-Scanner by Jason Haar
8) Google

Pages: 1 2 3 4 5 6

Posted by MegaZ on 12/20/2002.