This tutorial will show you how you can setup a mail server with Postfix/ Postfixadmin / PostgreSQL / Courier / Squirrelmail / SpamAssassin / ClamAV on Debian.

First step is to install Debian

No surprise there... I installed via netboot, and ended up with a fairly minimal

setup. You'll probably do it a different way. I told it to install as a 'mail server' and a

'web server'. The 'mail server' option was probably a mistake as it installs uw-imapd

and exim, neither of which I wanted/needed.

You probably want to install openssh-server and molly-guard :)

Postfix

apt-get install postfix postfix-pgsql

(Or postfix-mysql if you're going to use that instead)

I selected the Internet Site configuration when asked to pick a configuration.

/etc/apt/sources.list

In order to have slightly more recent versions of a few packages (PHP5, ClamAV and

PostgreSQL mainly), I added the following into my /etc/apt/sources.list file :

deb http://packages.dotdeb.org stable all

deb http://www.mirrorservice.org/sites/backports.org/ etch-backports main contrib

non-free

deb http://volatile.debian.org/debian-volatile etch/volatile main contrib non-free

Install PostgreSQL

I installed PostgreSQL 8.2 from backports.org ...

apt-get install -t etch-backports postgresql-8.2

(Note: there is no requirement on using v8.2, but I'm under the impression that

it's faster than previous versions). I'd suggest you use at least v8.1 (in Etch) from

a maintenance point of view.

Install PHP5

I always install the suhosin extension to PHP in the hope it will provide extra security.

APC (Alternative PHP Cache) is also installed in the expectation it will improve performance.

apt-get install php5 libapache2-mod-php5 php5-pgsql php5-suhosin php5-apc php-pear

(The above packages nearly all come from dotdeb.org)

Install Postfixadmin

Although I have created .deb for Postfixadmin; at the time of writing, v2.2.0 hasn't been

released; so I instal Postfixadmin from SVN. Hopefully, we'll release version 2.2.0 of

Postfixadmin sometime soon, and you will want to see this page to download it.

cd /var/www

svn co https://postfixadmin.svn.sourceforge.net/svnroot/postfixadmin/trunk postfixadmin

If you now hit http://your.server/postfixadmin you should see a slightly useful 'welcome'

screen, follow the link through to the 'setup.php' page. And you should get some sort

of instant gratification that at least something works :) (although some of the checks will fail)

Setting up PostgreSQL (or MySQL)

As postfixadmin stores all of it's configuration within a database, we need to setup the

database before we can do much further. You may find that phppgadmin or phpmyadmin

help with this.

Basically - create a user (e.g. 'postfix') and a database (e.g. 'postfix'). The user should own

the database. Ensure there's a password set on the user.

If security is a concern, you should probably have a user that is 'read-only' which is used

by postfix (as it only ever queries the DB) while postfixadmin will need a read-write user account.

If you're using PostgreSQL, the following shows what I typed in from a shell (all lines

containing a $ or #)on the server when logged in as root

mail:~# su - postgres

postgres@mail:~$ psql template1

Welcome to psql 8.2.4, the PostgreSQL interactive terminal.

Type: \copyright for distribution terms

\h for help with SQL commands

\? for help with psql commands

\g or terminate with semicolon to execute query

\q to quit

template1=# CREATE USER postfix WITH PASSWORD 'complexpassword';

CREATE ROLE

template1=# CREATE DATABASE postfix WITH OWNER postfix ENCODING 'UNICODE';

CREATE DATABASE

template1=# \q

If, like me, you are useless at picking passwords, try using pwgen

Load the Postfixadmin Database Schema into your database

As of subversion revision 328, the setup.php script should automatically create the

database structure for you. If you are using an older version of PostfixAdmin you'll need

to do the following :

cd /var/www/postfixadmin

psql -U postfix -h localhost postfix < DATABASE_PGSQL.TXT

This may spew out a few errors about roles that don't exist, but it should work

Configuration of Postfixadmin

Edit /var/www/postfixadmin/config.inc.php in your favourite editor (vi[m]).

Change

$CONF['configured'] = false;

to

$CONF['configured'] = true;

Change

$CONF['postfix_admin_url'] = '';

to

$CONF['postfix_admin_url'] = 'http://your.server/postfixadmin';

Change

$CONF['database_type'] = 'mysql';

to pgsql (assuming you want PostgreSQL!)

Change the other database parameters to match what you used above.

You'll want to change other parameters, but they're not normally essential

Postfixadmin

Once your config.inc.php file has the right database credentials, and you refresh

http://your.server/postfixadmin/setup.php you should some output indicating that the

database tables have been created, and also see a dialog box to Create the superadmin

account. You should treat these details a bit like the 'root' password for a Unix server.

This user will be able to add/remove/edit any domains/users/aliases etc.

Anyway, choose an admin account, this could be (for example) This email address is being protected from spambots. You need JavaScript enabled to view it.

Submitting this form, successfully, should result in the page giving you a message like

'Admin has been added!'

Delete setup.php (rm setup.php or mv setup.php setup.php.blah)

Configuring Postfix

This always seems to be the bit that causes others trouble....

New configuration files

{{adsensem}}

In my world, the following go in /etc/postfix/pgsql

You'll need to change the xxxxxx's to appropriate values

relay-domains.cf

(Who we relay mail for (as a backup mx))

user = postfix

password = xxxxxxx

dbname = postfix

hosts = localhost

query = SELECT domain FROM domain WHERE domain = '%s' AND backupmx = true

virtual-alias-maps.cf

(Think: /etc/aliases or similar)

user = postfix

password = xxxxxxxx

dbname = postfix

hosts = localhost

query = SELECT goto FROM alias WHERE address='%s' AND active = true

virtual-domains.cf

(Domains we accept mail for...)

user = postfix

password = xxxxxxxx

dbname = postfix

hosts = localhost

query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = false

AND active = true

virtual-mailbox-limit-maps.cf

(Only used if you're checking quota etc)

user = postfix

password = xxxxxxx

hosts = localhost

dbname = postfix

query = SELECT quota FROM mailbox WHERE username = '%s'

virtual-mailbox-maps.cf

(What mailboxes exist that we can deliver to)

user = postfix

password = xxxxxxxx

dbname = postfix

hosts = localhost

query = SELECT maildir FROM mailbox WHERE username='%s' AND active = true

main.cf changes

Add in the following :

# All virtual mailboxes live somewhere in here ..

virtual_mailbox_base = /var/mail/vmail

# The (virtual) domains we accept mail for

virtual_mailbox_domains = proxy:pgsql:/etc/postfix/pgsql/virtual-domains.cf

# Lookup mailbox location, uid and gid based on email address received.

virtual_mailbox_maps = proxy:pgsql:/etc/postfix/pgsql/virtual-mailbox-maps.cf

virtual_uid_maps = static:1001

virtual_gid_maps = static:8

virtual_alias_maps = proxy:pgsql:/etc/postfix/pgsql/virtual-alias-maps.cf

relay_domains = proxy:pgsql:/etc/postfix/pgsql/relay-domains.cf

local_transport = virtual

local_recipient_maps = $virtual_mailbox_maps

 

adduser vmail -g mail -uid 1001 -d /var/mail/vmail/

chown -R vmail:mail /var/mail/vmail

 

 

Postfix SMTP Auth Support

If your users are likely to be trying to send mail through your mail server when they

are not on a trusted network, you'll need to add this to /etc/postfix/main.cf

smtpd_sasl_authenticated_header = yes

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

broken_sasl_auth_clients = yes

And in /etc/postfix/sasl/smtpd.conf put the following :

pwcheck_method: saslauthd

saslauthd_path: /var/run/saslauthd/mux

log_level: 3

mech_list: PLAIN LOGIN

(As you can see, we'll be using SASL as a backend for authentication)

SASL

Thankfully the SASL package works a bit better under Etch than it did under Sarge/etc.

apt-get install sasl2-bin

Edit /etc/default/saslauthd so it has :

MECHANISMS="rimap"

THREADS=5

OPTIONS="-r -c -O localhost -m /var/spool/postfix/var/run/saslauthd"

 

To set the run directory using dpkg-statoverride, run this command as root:

dpkg-statoverride --add root sasl 710 /var/spool/postfix/var/run/saslauthd

Finally, to add the postfix user to the sasl group:

adduser postfix sasl

 

 

You'll need to mkdir -p /var/spool/postfix/var/run/saslauthd before SASL will start

(One day, I might change to use the pam_sql module; as this would remove unnecessary

IMAP logins... )

Courier

apt-get install courier-authdaemon courier-imap courier-imap-ssl courier-pop courier-pop-ssl

courier-authlib-postgresql

Configuring Courier's authdaemon

You'll need to edit /etc/courier/authpgsqlrc (or authmysqlrc if using MySQL)

PGSQL_HOST localhost

PGSQL_PORT 5432

PGSQL_USERNAME postfix

PGSQL_PASSWORD something

PGSQL_DATABASE postfix

PGSQL_USER_TABLE mailbox

PGSQL_CRYPT_PWFIELD password

PGSQL_UID_FIELD '1001'

PGSQL_GID_FIELD '8'

PGSQL_LOGIN_FIELD username

PGSQL_HOME_FIELD '/var/mail/vmail'

PGSQL_NAME_FIELD name

PGSQL_MAILDIR_FIELD maildir

PGSQL_QUOTA_FIELD quota

And also edit /etc/courier/authdaemonrc, and set authmodulelist="authpgsql" (or authmysql

if you're using MySQL)

If you now create a user in a test domain on postfixadmin, you should be able to connect to

your mail server successfully, and receive mail

Basic Testing (pop3)

Assuming you've created a domain, and a user within that domain from Postfixadmin, you

should be able to do something like the following :

mail:~# tail -f /var/log/mail.log &

mail:~# echo 'test email' | mail This email address is being protected from spambots. You need JavaScript enabled to view it.

mail:~#

Dec 6 22:31:56 mail postfix/pickup[11888]: A811A2B10063: uid=0 from=<root>

Dec 6 22:31:56 mail postfix/cleanup[11897]: A811A2B10063: message-id=<This email address is being protected from spambots. You need JavaScript enabled to view it.>

Dec 6 22:31:56 mail postfix/qmgr[11889]: A811A2B10063: from=<root>, size=297,

nrcpt=1 (queue active)

Dec 6 22:31:56 mail postfix/virtual[11902]: A811A2B10063: to=<This email address is being protected from spambots. You need JavaScript enabled to view it.>,

relay=virtual, delay=0.11, delays=0.05/0.04/0/0.02, dsn=2.0.0, status=sent (delivered

to maildir)

Dec 6 22:31:56 mail postfix/qmgr[11889]: A811A2B10063: removed

Additionally, if you now look in /var/mail/vmail, you should see a folder called 'This email address is being protected from spambots. You need JavaScript enabled to view it.'.

No guesses should be needed to figure out what this contains!

Squirrelmail

Squirrelmail is a mature web based mail client. It's been around for some time now, and

thankfully plugins exist for a number of additional "features". As your author patched up

the squirrelmail postfixadmin plugin, he's going to take a small amount of time <plug>it.

</plug>

apt-get install squirrelmail

Squirrelmail-postfixadmin install:

wget http://squirrelmail-postfixadmin.palepurple.co.uk/files/squirrelmail-postfixadmin_2.1.0-1_all.deb

dpkg -i squirrelmail-postfixadmin_2.1.0-1_all.deb

Or:

svn co -r35  http://squirrelmail-postfixadmin.palepurple.co.uk/svn/trunk/

mv trunk/ /usr/share/squirrelmail/plugins/squirrelmail-postfixadmin

cd /usr/share/squirrelmail/plugins/squirrelmail-postfixadmin

mv config.php.sample config.php

Edit /etc/squirrelmail/plugins/postfixadmin-config.php - use the same settings from Postfixadmin

pear install MDB2

pear install MDB2#pgsql (or MDB2#mysql)

Run squirrelmail-configure and enable the Postfixadmin plugin

Squirrelmail should be accessible at http://youserver/squirrelmail by default.

ClamAV

This is easiest to integrate via Amavis. You should get ClamAV from dotdeb.org, or Debian

volatile via apt-get. Relying on the 'default' clamav shipped with etch is probably not a good

idea (and ClamAV will also moan when it tries to update it's definitions list).

apt-get install amavisd-new clamav spamassassin

You'll want to edit

/etc/amavis/50-user

In my case, it looks a bit like :

use strict;

#

# Place your configuration directives here. They will override those in

# earlier files.

#

# See /usr/share/doc/amavisd-new/ for documentation and examples of

# the directives you can use in this file

#

chomp($myhostname = `hostname`);

$forward_method = 'smtp:127.0.0.1:10025';

# Where to submit notifications

$notify_method = $forward_method;

# Net::Server Pre-forking settings; note max_servers should match Postfix's master.cf..

$max_servers = 5;

$max_requests = 10;

$child_timeout = 5*60; # abort child if it takes longer than x seconds to complete.

# MTA specific settings...

$relayhost_is_client = 0;

$insert_received_line = 1;

$inet_socket_bind = '127.0.0.50';

@inet_acl = qw ( 127.0.0.0/8 );

# How we handle viruses and spam; options being discard, bounce or pass.

$final_virus_destiny = D_DISCARD;

$final_banned_destiny = D_BOUNCE;

$final_spam_destiny = D_PASS;

$final_bad_header_destiny = D_BOUNCE;

# Headers..

$X_HEADER_TAG = 'X-Virus-Scanned';

$X_HEADER_LINE = "by Amavis+SpamAssassin+ClamAV and more at $mydomain";

$remove_existing_x_scanned_headers = 1;

$remove_existing_spam_headers = 1;

$sa_tag_level_deflt = -99.0; # add spam info headers if at, or above that level

$sa_tag2_level_deflt = 5.0;

$sa_kill_level_deflt = 5.0; # triggers spam evasive actions

$recipient_delimiter = '+';

$replace_existing_extension = 1;

$localpart_is_case_sensitive = 0;

# SpamAssassin settings

$sa_timeout = 30;

$sa_auto_whitelist = 1;

$sa_local_tests_only = 0;

$sa_spam_modifies_subj = 1;

$sa_spam_subject_tag = '*** SPAM *** ';

$sa_spam_report_header = 1;

$first_infected_stops_scan = 1;

$sa_debug = 1;

$DO_SYSLOG = 0;

$SYSLOG_LEVEL = 'mail.info';

$LOGFILE = "/var/log/amavis.log";

@local_domains_acl = ('.');

#------------ Do not modify anything below this line -------------

1; # insure a defined return

The above configures Amavis to :

Scan and label Spam for all mail that goes through the server (And not just for some specified

domains - see @local_domains_acl)

Forward scanned mail to 127.0.0.2:10025 for delivery by Postfix

Listen for mail (from Postfix) on 127.0.0.50

Discard Viruses

Remove any existing anti-virus tags etc (as these will be from some.other.system)

If SpamAssassin scores more than 5.0, then rewrite the subject etc

Some notes:

SpamAssassin does not need to run via the SpamC/SpamD mechanism - Amavis handles this

all internally

Amavis appears to ignore most, if not all, settings you would otherwise set for SpamAssassin in

e.g. /etc/spamassassin/local.cf

When I initially started using Amavis it seemed to be a bit clueless when it came to listening and

delivering on the same IP address. Perhaps I did something wrong, but nevertheless, this is why

it listens on a different IP address (127.0.0.50) to the one it delivers to (127.0.0.1). You don't need

to do anything to setup 127.0.0.50 on a Linux box.

Amavis / Postfix Integration

Edit /etc/postfix/master.cf

amavis unix - - - - 5 smtp

-o smtp_data_done_timeout=5000

-o smtp_send_xforward_command=yes

-o receive_override_options=no_address_mappings

# change or remove the existing smtp definition.

smtp inet n - - - 12 smtpd

-o content_filter=amavis:[127.0.0.50]:10024

# where mail is re-injected back in by Amavis after it's

# done it's stuff.

127.0.0.1:10025 inet n - - - - smtpd

-o smtpd_autorized_xforward_hosts=127.0.0.0/8

-o smtpd_client_restrictions=

-o smtpd_helo_restrictions=

-o smtpd_sender_restrictions=

-o smtpd_recipient_restrictions=permit_mynetworks,reject

-o mynetworks=127.0.0.0/8

-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,

no_address_mappings

Then reload Postfix, make sure Amavis and ClamAV are running (/etc/init.d/amavis start or

/etc/init.d/clamav-daemon ) and it should work.

Note: We use Hosting and VPS Hosting, from: www.star-host.org We like and trust them. Good prices, high security.