|
Building a Mailbox using Postfix with AV and UCE controls, Part Three.
Last time we were here, I got as far as installing the Postfix
documentation, then asking you to read it.
Did you? At least one person emailed to say, "Yes, now get on with it."
Okay, let's have some fun. We'll test some initial configuration settings,
and send email through the server to some outside host.
Is Postfix listening right now?
mailbox:~# !netstat
netstat -an | grep tcp | grep -i listen
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN
That's validation enough for me. Here's another way to tell. From either
the box itself (or preferably some outside source, as here), telnet to the
mailserver port (that's 25, corresponding to the second line in the
listing above. You may recall that 22 is SSH):
bash-2.05b$ telnet 192.168.1.53 25
Trying 192.168.1.53...
Connected to 192.168.1.53.
Escape character is '^]'.
220 mailbox.orbdesigns.com ESMTP Postfix (Debian/GNU)
helo goldfinger.orbdesigns.com
250 mailbox.orbdesigns.com
quit
221 Bye
Connection closed by foreign host.
That worked nicely. I didn't do more with this connection, it's time to
look at the configuration and see what's what. Here's the contents of
/etc/postfix/main.cf. There's also master.cf, but we'll return to that
later...
# see /usr/share/postfix/main.cf.dist for a commented, fuller
# version of this file.
# Do not change these directory settings - they are critical to Postfix
# operation.
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix
setgid_group = postdrop
# appending .domain is the MUA's job.
append_dot_mydomain = yes
smtpd_banner = ESMTP (Debian/GNU)
biff = no
# Uncomment the next line to generate delayed mail warnings
#delay_warning_time = 4h
myhostname = mailbox.orbdesigns.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mailbox.orbdesigns.com, localhost.orbdesigns.com,
localhost
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a ""
mailbox_size_limit = 0
recipient_delimiter = +
That's a nice short config. I should be able to send mail to my user
account on that box. Here's a sample run:
bash-2.05b$ telnet 192.168.1.53 25
Trying 192.168.1.53...
Connected to 192.168.1.53.
Escape character is '^]'.
220 mailbox.orbdesigns.com ESMTP Postfix (Debian/GNU)
helo goldfinger.orbdesigns.com
250 mailbox.orbdesigns.com
mail from: [email protected]
250 Ok
rcpt to: [email protected]
250 Ok
data
354 End data with .
Subject: A test message.
Hi, Brian. This is Brian. Did this test work?
.b
.
250 Ok: queued as B1B54345B
quit
221 Bye
Connection closed by foreign host.
Things to observe. There's a distinct order to the commands when talking
to any MTA, and Postfix is no different. First a HELO to get the attention
of the MTA. Then a MAIL FROM: followed by a RCPT TO: then DATA. Following
the DATA line, you can put as much text as you want, then close with a
'.' on a blank line (as directed, neh?).
Now, what happened to that email over on mailbox:
mailbox:/etc/postfix# tail /var/log/mail.info
May 16 19:00:19 mailbox postfix/smtpd[550]: B1B54345B:
client=unknown[192.168.1.11]
May 16 19:02:09 mailbox postfix/cleanup[559]: B1B54345B:
message-id=<[email protected]>
May 16 19:02:09 mailbox postfix/qmgr[557]: B1B54345B:
from=, size=455, nrcpt=1 (queue active)
May 16 19:02:10 mailbox postfix/local[562]: B1B54345B:
to=, relay=local, delay=111, status=sent
("|procmail -a """)
May 16 19:02:13 mailbox postfix/smtpd[550]: disconnect from
unknown[192.168.1.11]
I inserted some linefeeds into that tail output, so that each log line
shows properly. In the file itself, those are one long line each. Now, was
the message delivered to the local mailbox for the "bilbrey" user? I'll
log in with another ssh session and check that using the mail command.
bilbrey@mailbox:~$ mail
Mail version 8.1.2 01/15/2001. Type ? for help.
"/var/mail/bilbrey": 1 message
> 1 bilbrey@speakeasy Sun May 16 19:02 20/662 A test message.
& t 1
Message 1:
From [email protected] Sun May 16 19:02:09 2004
X-Original-To: [email protected]
Subject: A test message.
Date: Sun, 16 May 2004 19:00:19 -0400 (EDT)
From: [email protected]
To: undisclosed-recipients:;
Content-Length: 49
Lines: 3
Hi, Brian. This is Brian. Did this test work?
b
& d 1
& q
That all looks good, so I deleted the message and quit. Local delivery is
good, from an outside source. Now, how to send messages from this machine
to an address in the real world is the next task.
There are a couple of factors to consider here. Is the connection to the
Internet on a Dynamic DSL or Cable address? If so, it's likely that most
connections to outside servers will be rejected because of that address.
If it's a business class static IP address (thus unlikely to be listed as
a questionable source under normal circumstances), then you'll want to
list that IP address as an MX under your DNS record. Here's an example of
how to tell if you've got your MX setup right:
bilbrey@mailbox:~$ host -t mx orbdesigns.com
orbdesigns.com mail is handled by 10 zidane.mazin.net
In this case, zidane is indeed the machine that handles email officially
for the orbdesigns.com domain. Now, I could configure mailbox to handle
mail destined for Orb in place of zidane, but I'm on one of those cable
modems. My own servers would reject my mail when I am done securing the
box. That won't do.
So here's the drill - configurations are less complex if you're a real MX
with a real IP that's accepted around the 'net. So I'll configure for the
complex setup - for a machine that's on a dynamic IP and note (to the best
of my meagre skills) where that diverges from a public MX box.
To send email through Mailbox, I'm going to have to relay my mail through
a publicly acceptable mail server. I'll use Zidane, of course. You'll
probably use your ISP's mail servers as a smarthost for the same purpose.
Now I'll add the following lines to main.cf (shown above):
relayhost = zidane.mazin.net
smtp_sasl_auth_enable=yes
smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options=
And I'll create that sasl_passwd file, putting the following fictional
data in it. (Well, duh, why in Dog's name would I put my real username and
password into a file I publish on the Internet?)
mailbox:/etc/postfix# cat > sasl_passwd
zidane.mazin.net har0ld:P0tt!he4d
[note - terminate input with a ^D == Control + D]
mailbox:/etc/postfix# chown root:root /etc/postfix/sasl_passwd \
> && chmod 600 /etc/postfix/sasl_passwd
mailbox:/etc/postfix# postmap hash:/etc/postfix/sasl_passwd
Now that all the config stuff is in place, I'll monitor the error log in
one terminal while refreshing Postfix's configuration in another:
mailbox:/etc/postfix# tail -f /var/log/mail.err
... and ...
mailbox:~# postfix reload
postfix/postfix-script: refreshing the Postfix mail system
No problems visible yet. Did anything show up unusual in the mail.info
file?
mailbox:/etc/postfix# tail /var/log/mail.info
. . .
May 16 19:29:56 mailbox postfix/postfix-script: refreshing the Postfix
mail system
May 16 19:29:56 mailbox postfix/master[500]: reload configuration
That looks good. Now let's try to send a message to me on my Speakeasy
account. Again, I'll monitor the mail.info logfile while I do the work:
mailbox:~# mail [email protected]
Subject: test message
Hello, brian. Did this work? [^D terminates input again.]
Cc:
That's that from this side. What happened in the logfile?
May 16 19:34:01 mailbox postfix/pickup[624]: EE21F346D: uid=0 from=
May 16 19:34:01 mailbox postfix/cleanup[633]: EE21F346D:
message-id=<[email protected]>
May 16 19:34:02 mailbox postfix/qmgr[625]: EE21F346D:
from=, size=340, nrcpt=1 (queue active)
May 16 19:34:02 mailbox postfix/smtp[635]: warning: smtp_sasl_auth_enable
is true, but SASL support is not compiled in
May 16 19:34:03 mailbox postfix/smtp[635]: EE21F346D:
to=, relay=zidane.mazin.net[207.44.178.102],
delay=2, status=bounced (host zidane.mazin.net[207.44.178.102] said: 554
: Relay access denied (in reply to RCPT TO
command))
May 16 19:34:04 mailbox postfix/cleanup[633]: 6C5D33476:
message-id=<[email protected]>
May 16 19:34:04 mailbox postfix/qmgr[625]: 6C5D33476: from=<>, size=2151,
nrcpt=1 (queue active)
May 16 19:34:04 mailbox postfix/smtp[635]: 6C5D33476:
to=, relay=zidane.mazin.net[207.44.178.102], delay=0,
status=sent (250 Ok: queued as D9E2C45C070)
Wow. Okay, so that didn't go so well. At least I "own" both ends of the
conversation. Note that the message to [email protected] on Zidane got through. But then, that isn't a relay, is it?
mailbox:/etc/postfix# apt-cache search postfix
. . .
postfix-tls - TLS and SASL support for Postfix
. . .
mailbox:/etc/postfix# dpkg -l postfix-tls
. . .
un postfix-tls
Ah, that's because I haven't installed the postfix-tls package yet. One
moment please:
mailbox:~# apt-get install postfix-tls
. . .
Starting mail transport agent: Postfix.
Now let's try that message again...
Okay, it's failed again. There are more complexities here than I remember.
I could just cheat and go with the config for a real Internet mail host...
Let me think about that.
More when I know more!
Have fun experimenting.
|
