IndiMail

IndiMail Queue Mechanism

noreply@blogger.com (cprogrammer) — Thu, 07 Dec 2017 05:24:00 +0000

Indimail has the ability of configuring multiple local and remote queues. A queue is a location on your hard disk where email are deposited before actual delivery. When you have massive injecting rates, your software may place multiple files in a single directory. This drastically reduces file system performance. IndiMail avoids this by injecting your email in a queue consisting of multiple directories and mails distributed as evenly as possible across these directories.

Balancing of emails across multiple queues is achieved by the program qmail-multi(8), which is actuall just a qmail-queue(8) replacement. Any qmail-queue frontend can use qmail-multi. The list of qmail-queue frontends in IndiMail are

sendmail
qmail-inject
qmail-smtpd
qmail-qmqpd
qmail-qmtpd
qreceipt
condredirect
dotforward
fastforward
forward
maildirserial
new-inject
ofmipd
replier
rrforward

You just need to configure the following environment variables to have the qmail-queue(8) frontends using qmail-multi(8)
1. QUEUE_BASE – Base directory where all queues will be placed
2. QUEUE_COUNT – number of queues
3. QUEUE_START – numeric prefix of the first queue
e.g. If you want IndiMail to use 10 queues, this is what you will do

% su
# for i in qmail-smtpd.25 qmail-smtpd.465 qmail-smtpd.587 qmail-send.25 \

> qmail-qmqpd.628 qmail-qmtpd.209

> do

> echo 10 > /service/$i/variables/QUEUE_COUNT

> echo “/var/indimail/queue” > /service/$i/variables/QUEUE_BASE

> echo “1” > /service/$i/variables/QUEUE_START

> done
#

You also need to make sure that you have ten queues in /var/indimail/queue.

% su

# for i 1 2 3 4 5 6 7 8 9 10

> do

> /usr/bin/queue-fix /var/indimail/queue/queue”$i” > /dev/null

> done

# exit

% ls -ld var/indimail/queue/queue*

drwxr-x---. 12 qmailq qmail 4096 Mar 30 2017 /var/indimail/queue/queue1

drwxr-x---. 12 qmailq qmail 4096 Dec 7 10:45 /var/indimail/queue/queue10

drwxr-x---. 12 qmailq qmail 4096 Mar 30 2017 /var/indimail/queue/queue2

drwxr-x---. 12 qmailq qmail 4096 Mar 30 2017 /var/indimail/queue/queue3

drwxr-x---. 12 qmailq qmail 4096 Mar 30 2017 /var/indimail/queue/queue4

drwxr-x---. 12 qmailq qmail 4096 Mar 30 2017 /var/indimail/queue/queue5

drwxr-x---. 12 qmailq qmail 4096 Dec 7 10:45 /var/indimail/queue/queue6

drwxr-x---. 12 qmailq qmail 4096 Dec 7 10:45 /var/indimail/queue/queue7

drwxr-x---. 12 qmailq qmail 4096 Dec 7 10:45 /var/indimail/queue/queue8

drwxr-x---. 12 qmailq qmail 4096 Dec 7 10:45 /var/indimail/queue/queue9

Now all you need is restart of all services to use the new QUEUE_BASE, QUEUE_COUNT, QUEUE_START environment variables

% sudo svc -d /service/qmail smtpd* /service/qmail-send.25 /service/qmail-qm?pd.*

% sudo svc -u /service/qmail smtpd* /service/qmail send.25 /service/qmail-qm?pd.*

RoundCube with IndiMail

noreply@blogger.com (cprogrammer) — Mon, 04 Dec 2017 12:30:00 +0000

These instructions will work on CentOS, RHEL, Fedora. For Debian/Ubuntu and other distros, please use your knowledge to make changes accordingly. In this guide, replace indimail.org with your own hostname.

Non SSL Version Install/Configuration

(look below for SSL config)

Install RoundCube. On older systems, use the yum command

$ sudo dnf -y install roundcubemail php-mysqlnd

Connect to MySQL using a privileged user. IndiMail installation creates a privileged mysql user 'mysql'. It does not have the user 'root'. Look at the variable PRIV_PASS in /usr/sbin/svctool to know the password.

$ /usr/bin/mysql -u mysql -p mysql

MySQL> create database RoundCube_db;

MySQL> create user roundcube identified by 'subscribed';

MySQL> GRANT ALL PRIVILEGES on RoundCube_db.* to roundcube;

MySQL> FLUSH PRIVILEGES;

MySQL> QUIT;

$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/SQL/mysql.initial.sql

Copy /etc/roundcube/config.inc.php.sample to /etc/roundcube.inc.php

$ sudo cp /etc/roundcube/config.inc.php.sample /etc/roundcubemail/config.inc.php

Edit the lines in /etc/roundcube/config.inc.php

$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';

$config['smtp_server'] = 'localhost';

$config['smtp_port'] = 587;

$config['smtp_user'] = '%u';

$config['smtp_pass'] = '%p';

$config['support_url'] = 'http://indimail.sourceforge.net';

$config['product_name'] = 'IndiMail Webmail';

$config['plugins'] = array(

'archive',

'sauserprefs',

'markasjunk2',

'iwebadmin',

);

NOTE: the iwebadmin plugin will not work for postmaster account or IndiMail users having QA_ADMIN privileges. man vmoduser(1)

This file should have read permission for apache group

$ sudo chown root:apache /etc/roundcube/config.inc.php

$ sudo chmod 640 /etc/roundcube/config.inc.php

For markasjunk2 to work you need to set permission for apache to write /etc/indimail/spamignore

$ sudo chown apache:indimail /etc/indimail/spamignore

$ sudo chmod 644 /etc/indimail/spamignore

Edit the lines in /etc/roundcube/defaults.inc.php

$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';$config['imap_auth_type'] = 'LOGIN';

$config['smtp_auth_type'] = 'LOGIN';

This file should have read permission for apache group

$ sudo chown root:apache /etc/roundcube/defaults.inc.php

$ sudo chmod 640 /etc/roundcube/defaults.inc.php

Change iwebadmin path in /usr/share/roundcubemail/iwebadmin/config.inc.php

$rcmail_config['iwebadmin_path'] = 'http://127.0.0.1/cgi-bin/iwebadmin';

Change sauserprefs_db_dsnw in /usr/share/roundcubemail/sauserprefs/config.inc.php

$rcmail_config['sauserprefs_db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';

Restore indimail plugins for roundcube

$ sudo yum install ircube

$ cd /tmp

$ wget http://downloads.sourceforge.net/indimail/indimail-roundcube-1.0.tar.gz # This file

$ cd /

$ sudo tar xvfz /tmp/indimail-roundcube-1.0.tar.gz usr/share/roundcubemail/plugins

$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/sauserprefs/sauserprefs.sql

change pdo_mysql.default_socket /etc/php.ini

For some reason pdo_mysql uses wrong mysql socket on some systems. Uses /var/lib/mysql/mysql.sock instead of /var/run/mysqld/mysqld.sock. You need to edit the file /etc/php.ini and define pdo_mysql.default_socket

pdo_mysql.default_socket= /var/run/mysqld/mysqld.sock

You can verify if the path has been correctly entered by executing the below command. The command should return without any error

$ php -r "new PDO('mysql:host=localhost;dbname=RoundCube_db', 'roundcube', 'subscribed');"

HTTPD config
1. Edit file /etc/httpd/conf.d/roundcubemail.conf and edit the following lines

# Round Cube Webmail is a browser-based multilingual IMAP client

#Alias /indimail /usr/share/roundcubemail

# Define who can access the Webmail

# You can enlarge permissions once configured

# Apache 2.4

Require ip 127.0.0.1

Require all granted

Require local

# Apache 2.2

Order Deny,Allow

Deny from all

Allow from 127.0.0.1

Allow from ::1

This file should be owned by root

$ sudo chown root:root /etc/httpd/conf.d/roundcubemail.conf

$ sudo chmod 644 /etc/httpd/conf.d/roundcubemail.conf

Restart httpd

$ sudo service httpd restart

SSL / TLS Version

Install RoundCube. On older systems, use the yum command

$ sudo dnf -y install roundcubemail php-mysqlnd

Connect to MySQL using a privileged user. IndiMail installation creates a privileged mysql user 'mysql'. It does not have the user 'root'. Look at the variable PRIV_PASS in /usr/sbin/svctool to know the password.

$ /usr/bin/mysql -u mysql -p mysql

MySQL> create database RoundCube_db;

MySQL> create user roundcube identified by 'subscribed';

MySQL> GRANT ALL PRIVILEGES on RoundCube_db.* to roundcube;

MySQL> FLUSH PRIVILEGES;

MySQL> QUIT;

$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/SQL/mysql.initial.sql

Copy /etc/roundcube/config.inc.php.sample to /etc/roundcube.inc.php

$ sudo cp /etc/roundcube/config.inc.php.sample /etc/roundcubemail/config.inc.php

Edit the lines in /etc/roundcube/config.inc.php

$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';

$config['default_host'] = 'ssl://indimail.org';

$config['smtp_server'] = 'localhost';

$config['smtp_port'] = 587;

$config['smtp_user'] = '%u';

$config['smtp_pass'] = '%p';

$config['support_url'] = 'http://indimail.sourceforge.net';

$config['product_name'] = 'IndiMail Webmail';

$config['plugins'] = array(

'archive',

'sauserprefs',

'markasjunk2',

'iwebadmin',

);

NOTE: the iwebadmin plugin will not work for postmaster account or IndiMail users having QA_ADMIN privileges. man vmoduser(1)

This file should have read permissions for apache group

$ sudo chown root:apache /etc/roundcube/config.inc.php

$ sudo chmod 640 /etc/roundcube/config.inc.php

Edit the lines in /etc/roundcube/defaults.inc.php i.e.

$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';

$config['default_host'] = 'ssl://indimail.org';

$config['default_port'] = 993;

$config['imap_conn_options'] = array(

'ssl' => array(

'verify_peer' => false,

'verify_peer_name' => false,

);

$config['imap_auth_type'] = 'LOGIN';

$config['smtp_auth_type'] = 'LOGIN';

$config['force_https'] = true;

$config['product_name'] = 'IndiMail Webmail';

$config['useragent'] = 'IndiMail Webmail/'.RCMAIL_VERSION;

This file should have read permission for apache group$config['force_https'] = true;

$ sudo chown root:apache /etc/roundcube/defaults.inc.php

$ sudo chmod 640 /etc/roundcube/defaults.inc.php

Change iwebadmin path in /usr/share/roundcubemail/iwebadmin/config.inc.php

$rcmail_config['iwebadmin_path'] = 'https://127.0.0.1/cgi-bin/iwebadmin';

Change sauserprefs_db_dsnw in /usr/share/roundcubemail/sauserprefs/config.inc.php

$rcmail_config['sauserprefs_db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';

Restore indimail plugins for roundcube

$ cd /tmp

$ wget http://downloads.sourceforge.net/indimail/indimail-roundcube-ssl-1.0.tar.gz # This file

$ cd /

$ sudo tar xvfz /tmp/indimail-roundcube-ssl-1.0.tar.gz usr/share/roundcubemail/plugins

$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/sauserprefs/sauserprefs.sql

Change pdo_mysql.default_socket /etc/php.ini

pdo_mysql.default_socket= /var/run/mysqld/mysqld.sock

You can verifiy if the path has been correctly entered by executing the below command. The command should return without any error

php -r "new PDO('mysql:host=localhost;dbname=RoundCube_db', 'roundcube', 'subscribed');"

HTTPD config

Edit file /etc/httpd/conf.d/roundcubemail.conf and edit the following lines

# Round Cube Webmail is a browser-based multilingual IMAP client

#Alias /indimail /usr/share/roundcubemail

# Define who can access the Webmail

# You can enlarge permissions once configured

# Apache 2.4

Require ip 127.0.0.1

Require all granted

Require local

# Apache 2.2

Order Deny,Allow

Deny from all

Allow from 127.0.0.1

Allow from ::1

This file should be owned by root

$ sudo chown root:root /etc/httpd/conf.d/roundcubemail.conf

$ sudo chmod 644 /etc/httpd/conf.d/roundcubemail.conf

This is assuming you have already generated indimail cert after indimail installation. If not execute the following command. We will assume that your host is indimail.org

$ sudo /usr/sbin/svctool --postmaster=postmaster@indimail.org –config=cert"

--common_name=indimail.org

Edit the file /etc/httpd/conf.d/ssl.conf i.e.

ServerName indimail.org:443

SSLCertificateFile /etc/indimail/certs/servercert.pem

Now apache server needs access to servercert.pem. Add apache user to the qmail group. You can chose either of the below two options (Options 2 is less secure, as it gives httpd access to qmail files).

Option 1

$ sudo chown indimail:apache /etc/indimail/certs/servercert.pem

$ sudo chmod 640 /etc/indimail/certs/servercert.pem

Option 2

$ sudo usermod -aG qmail apache

Now you should see apache getting qmail group access

$ grep "qmail:x:" /etc/group

qmail:x:1002:qscand,apache

Edit file /etc/php.ini. For some funny reason, the cert needs to be mentioned. i.e.

openssl.cafile=/etc/indimail/certs/servercert.pem

openssl.capath=/etc/pki/tls/certs

Run the following command to get the cert locations. [ini_cafile] should point to servercert.pem location.

$ php -r "print_r(openssl_get_cert_locations());"

Array

(

[default_cert_file] => /etc/pki/tls/cert.pem

[default_cert_file_env] => SSL_CERT_FILE

[default_cert_dir] => /etc/pki/tls/certs

[default_cert_dir_env] => SSL_CERT_DIR

[default_private_dir] => /etc/pki/tls/private

[default_default_cert_area] => /etc/pki/tls

[ini_cafile] => /etc/indimail/certs/servercert.pem

[ini_capath] => /etc/pki/tls/certs

)

Follow instructions to setup https

https://wiki.centos.org/HowTos/Https

Restart httpd

$ sudo service httpd restart

It appears that in PHP 5.6.0, functions are now validating SSL certificates(in a variety of ways). First, it appears to fail for untrusted certificates (i.e. no matching CA trusted locally), and secondly, it appears to fail for mismatched hostnames in the request and certificate. Verify that php is using the correct certificate with proper CN. Use the program testssl.php download from the location you downloaded this README/INSTALL file. In Step 9ii you created a certificate with common_name as indimail.org. Use the same host that you gave when creating the certificate.

$ php ./testssl.php indimail.org

Success

127.0.0.1 localhost indimail.org

Restart httpd

$ sudo service httpd restart

Using Docker Engine to Run IndiMail / IndiMail-MTA

noreply@blogger.com (cprogrammer) — Tue, 26 Apr 2016 15:13:00 +0000

IndiMail now has docker images. You can read about installing Docker here. Once you have installed docker-engine, you need to start it. Typically it would be

$ sudo service docker start

To avoid having to use sudo when you use the docker command, create a Unix group called docker and add users to it. When the docker daemon starts, it makes the ownership of the Unix socket read/writable by the docker group.

Warning: The docker group is equivalent to the root user; For details on how this impacts security in your system, see Docker Daemon Attack Surface for details.

$ sudo groupadd docker 
$ sudo usermod -aG docker your_username

Log out and login again to ensure your user is running with the correct permissions. You can run the unix id command to confirm that you have the docker group privileges. e.g.

$ id -a
uid=1000(mbhangui) gid=1000(mbhangui) groups=1000(mbhangui),10(wheel),545(docker) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Now we need to pull the docker image for IndiMail. use the docker pull command. The values for tag can be fedora-23, centos7, debian8, ubuntu-15.10, ubuntu-14.03. If your favourite OS is missing, let me know. You can find the list of all images here.

$ docker pull cprogrammer/indimail:tag

(for indimail-mta image, execute docker pull cprogrammer/indimail-mta:tag

You can now list the docker image by executing the docker images command.

$ docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
cprogrammer/indimail       fedora-23           a02e6014a67b        53 minutes ago      1.774 GB

Now let us run a container with this image using the image id a02e6014a67b listed above by running the docker run command. The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker. In our case, I want the systemctl command to work and the container run like a normal host.

$ docker run -d -h indimail.org --privileged a02e6014a67b /sbin/init

I have now figured out the you don't require the --privileged flag. This flag gives the container access to the host's systemd. A better way is to add SYS_ADMIN capability

$ docker run -ti --cap-add=SYS_ADMIN -e "container-docker" -v /sys/fs/cgroup:/sys/fs/cgroup:ro a02e6014a67b /sbin/init

The above will start a fully functional Fedora 23 OS with IndiMail, MySQL, sshd, httpd services up and running.

We can list the running container by running the docker ps command

$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
fd09c7ca75be        a02e6014a67b        "/sbin/init"        38 seconds ago      Up 37 seconds                           desperate_jones

We now have a running container and can attach to it and use it like any functional host. Run the docker exec command. The -ti option attaches a pseudo terminal and makes the session interactive.

$ docker exec -ti fd09c7ca75be /bin/bash --login
#
# /var/indimail/bin/svstat /service/*
/service/fetchmail: down 32 seconds
/service/greylist.1999: up (pid 203) 32 seconds
/service/indisrvr.4000: up (pid 178) 32 seconds
/service/inlookup.infifo: up (pid 192) 32 seconds
/service/mysql.3306: up (pid 181) 32 seconds
/service/proxy-imapd.4143: up (pid 191) 32 seconds
/service/proxy-imapd-ssl.9143: up (pid 188) 32 seconds
/service/proxy-pop3d.4110: up (pid 197) 32 seconds
/service/proxy-pop3d-ssl.9110: up (pid 179) 32 seconds
/service/pwdlookup: up (pid 195) 32 seconds
/service/qmail-imapd.143: up (pid 222) 32 seconds
/service/qmail-imapd-ssl.993: up (pid 200) 32 seconds
/service/qmail-pop3d.110: up (pid 212) 32 seconds
/service/qmail-pop3d-ssl.995: up (pid 184) 32 seconds
/service/qmail-poppass.106: up (pid 216) 32 seconds
/service/qmail-qmqpd.628: down 32 seconds
/service/qmail-qmtpd.209: up (pid 153) 32 seconds
/service/qmail-send.25: up (pid 182) 32 seconds
/service/qmail-smtpd.25: up (pid 187) 32 seconds
/service/qmail-smtpd.366: up (pid 208) 32 seconds
/service/qmail-smtpd.465: up (pid 194) 32 seconds
/service/qmail-smtpd.587: up (pid 196) 32 seconds
/service/qmail-spamlog: up (pid 221) 32 seconds
/service/qscanq: up (pid 213) 32 seconds
/service/udplogger.3000: up (pid 211) 32 seconds

You now have a fully functional mail server with a pre-configured virtual domain indimail.org and a pre-configured virtual user testuser01@indimail.org. You can use IMAP/POP3/SMTP to your heart's content. If not satisfied, try out the ssl enabled services IMAPS/POP3S/SMTPS or STARTTLS command. If still not satisfied, read the man pages in /var/indimail/man/* :)

You can stop the container by executing the docker stop command.

$ docker stop fd09c7ca75be

You can make your changes to the container and commit changes by using the docker commit command. Learning how to use docker is not difficult. Just follow the Docker Documentation. If you are lazy like me, just read the Getting Started guide.

I am also a newbie as far as docker is concerned. Do let me know your experience with network settings and other advanced docker topics, that you may be familiar with. Do send few bottles of beer my way if you can.

NOTE: There are few defaults for the indimail docker container image

root password is passxxx@xxx
mysql user, password for indimail is indimail, ssh-1.5-
mysql privileged user, password is mysql, 4-57343-
password for postmaster@indimail.org virtual imap/pop3 account is passxxx
password for testuser01@indimail.org virtual imap/pop3 account is passxxx

Using systemd to start IndiMail

noreply@blogger.com (cprogrammer) — Wed, 20 Jul 2011 13:05:00 +0000

systemd is a system and service manager for Linux, compatible with SysV and LSB init scripts. systemd provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux cgroups, supports snapshots and restoring of the system state, maintains mount and automount points and implements an elaborate transactional dependency-based service control logic. It can work as a drop-in replacement for sysvinit.

The first step is to write the service configuration file for IndiMail as /lib/systemd/system/indimail.service

[Unit]
Description=IndiMail Messaging Platform
After=local-fs.target network.target

[Service]
ExecStart=/var/indimail/bin/svscanboot /service
ExecStop=/etc/init.d/indimail stop
Restart=on-failure
Type=simple

[Install]
WantedBy=multi-user.target

In Fedora 15, upstart has been replaced by a service called systemd. Due to improper rpm package upgrade scripts, some system services previously enabled in Fedora 14, may not be enabled after upgrading to Fedora 15. To determine if a service is impacted, run the systemctl status command as shown below.

# systemctl is-enabled indimail.service && echo "Enabled on boot" || echo "Disabled on boot"

To enable indimail service on boot, run the following systemctl command

# systemctl enable indimail.service

Now to start IndiMail you can use the usual service command

# service indimail start    (to start indimail)

# service indimail stop     (to stop indimail)

You can automate the above service creation for systemd by running the initsvc(1) command

# /var/indimail/bin/initsvc -on  (to enable indimail service)

# /var/indimail/bin/initsvc -off   (to disable indimail service)

You can now also query the status of the running IndiMail service by using the systemctl command

# systemctl status indimail.service

indimail.service - IndiMail Messaging Platform
          Loaded: loaded (/lib/systemd/system/indimail.service)
          Active: active (running) since Wed, 20 Jul 2011 18:18:35 +0530; 10min ago
        Main PID: 4353 (svscanboot)
          CGroup: name=systemd:/system/indimail.service
                  ├ 4353 /bin/sh /var/indimail/bin/svscanboot
                  ├ 4356 /var/indimail/bin/svscan /service
                  ├ 4357 supervise log
                  ├ 4358 supervise clamd
                  ├ 4359 supervise log
                  ├ 4360 supervise freshclam
                  ├ 4361 supervise log
                  ├ 4362 supervise qmail-send.25
                  ├ 4363 supervise log
                  ├ 4364 supervise qmail-pop3d-ssl.995
                  ├ 4365 supervise log
                  ├ 4366 supervise proxy-imapd-ssl.9143
                  ├ 4367 supervise log
                  ├ 4368 supervise qmail-poppass.106
                  ├ 4369 supervise log
                  ├ 4370 supervise proxy-imapd.4143
                  ├ 4371 supervise log
                  ├ 4372 supervise proxy-pop3d-ssl.9110
                  ├ 4373 supervise log
                  ├ 4374 supervise qmail-smtpd.465
                  ├ 4375 supervise log
                  ├ 4376 supervise inlookup.infifo
                  ├ 4377 supervise log
                  ├ 4378 supervise qmail-smtpd.366
                  ├ 4379 supervise log
                  ├ 4380 supervise proxy-pop3d.4110
                  ├ 4381 supervise log
                  ├ 4382 supervise slapd.389
                  ├ 4383 supervise log
                  ├ 4384 supervise qmail-smtpd.587
                  ├ 4385 supervise log
                  ├ 4386 supervise pwdlookup
                  ├ 4387 supervise log
                  ├ 4388 supervise qmail-pop3d.110
                  ├ 4389 supervise log
                  ├ 4390 supervise qmail-qmtpd.209

                  ├ 4391 supervise log
                  ├ 4392 supervise fetchmail
                  ├ 4393 supervise log
                  ├ 4394 supervise qscanq
                  ├ 4395 supervise log
                  ├ 4396 supervise qmail-smtpd.25
                  ├ 4397 supervise log
                  ├ 4398 supervise mysql.3306
                  ├ 4399 supervise log
                  ├ 4400 supervise qmail-spamlog
                  ├ 4401 supervise log
                  ├ 4402 supervise qmail-qmqpd.628
                  ├ 4403 supervise log
                  ├ 4404 supervise qmail-imapd-ssl.993
                  ├ 4405 supervise log
                  ├ 4406 supervise indisrvr.4000
                  ├ 4407 supervise log
                  ├ 4408 supervise qmail-imapd.143
                  ├ 4409 supervise log
                  ├ 4410 supervise greylist.1999
                  ├ 4411 supervise log
                  ├ 4412 /var/indimail/bin/multilog t /var/log/indimail/fre...
                  ├ 4413 qmail-daemon ./Maildir/
                  ├ 4414 /var/indimail/bin/tcpserver -v -H -R -l 0 -x /var/...
                  ├ 4415 /var/indimail/bin/tcpserver -v -c /service/qmail-p...
                  ├ 4416 /var/indimail/bin/multilog t /var/log/indimail/pro...
                  ├ 4417 /var/indimail/bin/multilog t /var/log/indimail/pop...
                  ├ 4418 /var/indimail/bin/multilog t /var/log/indimail/pro...
                  ├ 4419 /var/indimail/bin/multilog t /var/log/indimail/pro...
                  ├ 4420 /var/indimail/bin/multilog t /var/log/indimail/pop...
                  ├ 4421 /var/indimail/bin/tcpserver -v -c /service/qmail-p...
                  ├ 4422 /var/indimail/bin/multilog t /var/log/indimail/pro...
                  ├ 4424 /var/indimail/bin/tcpserver -v -c /service/proxy-p...
                  ├ 4425 /var/indimail/bin/multilog t -* cleanq starting -*...
                  ├ 4426 /var/indimail/bin/tcpserver -v -h -R -l 0 -x /var/...
                  ├ 4427 /var/indimail/bin/tcpserver -v -c /service/proxy-i...
                  ├ 4428 /var/indimail/sbin/inlookup -i 5
                  ├ 4429 /var/indimail/bin/multilog t /var/log/indimail/mys...
                  ├ 4430 /var/indimail/bin/multilog t /var/log/indimail/smt...
                  ├ 4431 /var/indimail/sbin/nssd -d notice
                  ├ 4432 /var/indimail/bin/tcpserver -v -c /service/qmail-i...

                  ├ 4433 /var/indimail/bin/multilog t /var/log/indimail/pwd...
                  ├ 4434 /var/indimail/bin/multilog t /var/log/indimail/smt...
                  ├ 4435 /var/indimail/bin/multilog t /var/log/indimail/pop...
                  ├ 4436 /var/indimail/bin/tcpserver -v -c /service/proxy-i...
                  ├ 4437 /var/indimail/bin/multilog t /var/log/indimail/inl...
                  ├ 4438 /usr/bin/perl /var/indimail/bin/greydaemon -w /var...
                  ├ 4439 /var/indimail/bin/tcpserver -v -c /service/qmail-i...
                  ├ 4440 /var/indimail/bin/tcpserver -v -h -R -l 0 -x /var/...
                  ├ 4441 /var/indimail/bin/multilog t /var/log/indimail/ima...
                  ├ 4442 /var/indimail/bin/tcpserver -v -H -R -l 0 -x /var/...
                  ├ 4443 /var/indimail/bin/multilog t /var/log/indimail/gre...
                  ├ 4444 /usr/local/mysql/libexec/mysqld --defaults-file=/v...
                  ├ 4445 /var/indimail/bin/tcpserver -v -H -R -l 0 -x /var/...
                  ├ 4446 /var/indimail/bin/qmail-cat /tmp/spamfifo
                  ├ 4447 /var/indimail/bin/multilog t /var/log/indimail/fet...
                  ├ 4448 /var/indimail/bin/multilog t /var/log/indimail/qmq...
                  ├ 4449 /var/indimail/bin/multilog t /var/log/indimail/smt...
                  ├ 4450 /var/indimail/bin/multilog t /var/log/indimail/qmt...
                  ├ 4451 /var/indimail/bin/tcpserver -v -H -R -l 0 -x /var/...
                  ├ 4452 /var/indimail/sbin/indisrvr -i 0 -p 4000 -b 40 -n ...
                  ├ 4453 /var/indimail/bin/multilog t /var/log/indimail/ind...
                  ├ 4454 /var/indimail/bin/multilog t /var/log/indimail/smt...
                  ├ 4455 /var/indimail/bin/multilog t /var/log/indimail/cla...
                  ├ 4456 /var/indimail/bin/multilog t /var/log/indimail/svs...
                  ├ 4457 /var/indimail/sbin/clamd
                  ├ 4458 /var/indimail/bin/multilog t /var/log/indimail/del...
                  ├ 4459 /var/indimail/bin/tcpserver -v -c /service/proxy-p...
                  ├ 4460 /var/indimail/bin/multilog t /var/log/indimail/spa...
                  ├ 4461 /var/indimail/bin/multilog t /var/log/indimail/ima...
                  ├ 4462 /bin/sh ./run
                  ├ 4477 /var/indimail/bin/multilog t /var/log/indimail/sla...
                  ├ 4509 /var/indimail/bin/freshclam -v --stdout --datadir=...
                  ├ 4519 /var/indimail/sbin/inlookup -i 5
                  ├ 4520 /var/indimail/sbin/inlookup -i 5
                  ├ 4521 /var/indimail/sbin/inlookup -i 5
                  ├ 4522 /var/indimail/sbin/inlookup -i 5
                  ├ 4523 /var/indimail/sbin/inlookup -i 5
                  ├ 4526 qmail-send
                  ├ 4527 qmail-send
                  ├ 4528 qmail-send
                  ├ 4529 qmail-send

                  ├ 4530 qmail-send
                  ├ 4531 qmail-lspawn ./Maildir/
                  ├ 4532 qmail-rspawn
                  ├ 4533 qmail-clean
                  ├ 4534 qmail-todo
                  ├ 4535 qmail-clean
                  ├ 4536 qmail-lspawn ./Maildir/
                  ├ 4537 qmail-rspawn
                  ├ 4538 qmail-clean
                  ├ 4539 qmail-todo
                  ├ 4540 qmail-clean
                  ├ 4541 qmail-lspawn ./Maildir/
                  ├ 4542 qmail-rspawn
                  ├ 4543 qmail-clean
                  ├ 4544 qmail-todo
                  ├ 4545 qmail-clean
                  ├ 4546 qmail-lspawn ./Maildir/
                  ├ 4547 qmail-rspawn
                  ├ 4548 qmail-clean
                  ├ 4549 qmail-todo
                  ├ 4550 qmail-clean
                  ├ 4551 qmail-lspawn ./Maildir/
                  ├ 4552 qmail-rspawn
                  ├ 4553 qmail-clean
                  ├ 4554 qmail-todo
                  ├ 4555 qmail-clean
                  ├ 4751 /bin/sh ./run
                  └ 4752 sleep 200

IndiMail Installation for newbies in < 10 steps

noreply@blogger.com (cprogrammer) — Tue, 05 Jul 2011 14:21:00 +0000

Installing Indimail using YUM/APT Repository

Install OS

OpenSUSE

openSUSE Leap 42.3
openSUSE Leap 42.2
openSUSE 13.2
openSUSE 13.1
SUSE Linux Enterprise 12 SP2
SUSE Linux Enterprise 12 SP1
SUSE Linux Enterprise 12

Red Hat

Feodra 27
Fedora 26
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
CentOS 7
CentOS 6

Debian

Debian 8.0
Debian 7.0
Ubuntu 17.04
Ubuntu 16.10
Ubuntu 16.04
Ubuntu 14.04
Ubuntu 12.04

Click the below URL for Install Instructions

https://software.opensuse.org/download.html?project=home%3Aindimail&package=indimail

Shutdown MySQL if already running and disable MySQL from being started up by the system % /etc/init.d/mysqld stop % sudo chkconfig mysqld off % /bin/rm -f /service/mysql.3306/down
Start IndiMail

% sudo service indimail start

Check Servicess

% sudo /usr/bin/svstat /service/*

/service/clamd: up (pid 1014) 2985 seconds
/service/dnscache: up (pid 1021) 2985 seconds
/service/fetchmail: down 2985 seconds
/service/freshclam: up (pid 1020) 2985 seconds
/service/greylist.1999: up (pid 1043) 2985 seconds
/service/indisrvr.4000: up (pid 1048) 2985 seconds
/service/inlookup.infifo: up (pid 1057) 2985 seconds
/service/mrtg: up (pid 1023) 2985 seconds
/service/mysql.3306: up (pid 1031) 2985 seconds
/service/proxy-imapd.4143: up (pid 1018) 2985 seconds
/service/proxy-imapd-ssl.9143: up (pid 1041) 2985 seconds
/service/proxy-pop3d.4110: up (pid 1017) 2985 seconds
/service/proxy-pop3d-ssl.9110: up (pid 1037) 2985 seconds
/service/pwdlookup: up (pid 1030) 2985 seconds
/service/qmail-imapd.143: up (pid 1046) 2985 seconds
/service/qmail-imapd-ssl.993: up (pid 1055) 2985 seconds
/service/qmail-logfifo: up (pid 1024) 2985 seconds
/service/qmail-pop3d.110: up (pid 1029) 2985 seconds
/service/qmail-pop3d-ssl.995: up (pid 1054) 2985 seconds
/service/qmail-poppass.106: up (pid 1022) 2985 seconds
/service/qmail-qmqpd.628: down 2985 seconds
/service/qmail-qmtpd.209: up (pid 1044) 2985 seconds
/service/qmail-send.25: up (pid 1026) 2985 seconds
/service/qmail-smtpd.25: up (pid 1050) 2985 seconds
/service/qmail-smtpd.366: up (pid 1019) 2985 seconds
/service/qmail-smtpd.465: up (pid 1027) 2985 seconds
/service/qmail-smtpd.587: up (pid 1012) 2985 seconds
/service/qscanq: up (pid 1036) 2985 seconds
/service/resolvconf: up (pid 1069) 2985 seconds
/service/udplogger.3000: up (pid 1061) 2985 seconds

Play with the System
1. Add A Domain

% sudo vadddomain example.com password1

Add a User

% sudo vadduser user01@example.com password2

Send email

swaks –to youremail@yourdomain –from user01@example.com –server localhost

RTFM

% man indimail

Buy Beer for Manvendra Bhangui

NOTE: The MySQL database gets installed with the user 'mysql' with all privileges and a user 'indimail' with limited privileges. You will find the passwords for these two users in the script /usr/sbin/svctool. If you modify these, please don't forget to modify /etc/indimail/control/host.mysql

Eliminating Duplicate Emails during local delivery

noreply@blogger.com (cprogrammer) — Thu, 30 Jun 2011 16:49:00 +0000

Often you will find program like MS outlook, notorious for sending duplicate emails, flooding your inbox. IndiMail allows you to quickly deal with this proprietary nonsense by turning on duplicate eliminator in vdelivermail(8) - the default MDA. To turn on the duplicate eliminator in vdelivermail, you need to set ELIMINATE_DUPS and MAKE_SEEKABLE environment variables.

% su
# echo 1> /service/qmail-send.25/variables/ELIMINATE_DUPS
# echo 1> /service/qmail-send.25/variables/MAKE_SEEKABLE
# svc -d /service/qmail-send.25; svc -u /service/qmail-send.25
# exit

If you do not use vdelivermail and want to use your own delivery agent? Fear not by using ismaildup(1). ismaildup expects the email on standard input and is easily scriptable like the example below in a .qmail file.

| ismaildup /var/indimail/bin/maildirdeliver /home/manny/Maildir

will deliver mails to /home/manny/Maildir while discarding duplicates.

If you are not happy with the 900 seconds (15 minutes) time interval for checking duplicates, you can change it by setting the DUPLICATE_INTERVAL environment variable. The following will not allow a single duplicate to be entertained within 24 hours

% su
# echo 86400 > /service/qmail-send.25/variables/DUPLICATE_INTERVAL
# svc -d /service/qmail-send.25 ; svc -u /service/qmail-send.25
# exit

Using procmail with Indimail

noreply@blogger.com (cprogrammer) — Fri, 24 Jun 2011 11:09:00 +0000

IndiMail follows the traditional UNIX philosophy.

"Write programs that do one thing and do it well. Write programs to work together. Write programs to handle text streams, because that is a universal interface"

This allows IndiMail to interface with many programs written by others. IndiMail uses a powerful filter mechanism called vfilter(8). You may already be familiar with procmail. procmail is a mail delivery agent (MDA) capable of sorting incoming mail into various directories and filtering out messages. There are three ways in which you can use procmail with IndiMail.

1. inside .qmail

Users can use

| preline procmail

from ~/.qmail. They will need to use a full path for procmail unless procmail is in the system's startup PATH.

2. Edit .qmail-default

| preline -f procmail -p -m /var/indimail/etc/procmailrc

3. Have an alias

You can use valias(1) to create an alias to call procmail. The following alias calls procmail to deliver the mail using /var/indimail/etc/procmailrc as a procmail recipe

valias -i "|/var/indimail/bin/preline -f /usr/bin/procmail -p -m /var/indimail/etc/procmailrc" testuser@example.com

The following procmailrc puts virus infected mails in /tmp/Maildir and calls maildirdeliver(1) to deliver the mail to /home/mail/T2Zsym/example.com/testuser01/Maildir.

SHELL=/bin/bash
VERBOSE="no"
unset DTLINE
unset RPLINE
:0w
*^X-Virus-Status: INFECTED
/tmp/Maildir/.Virus
:0w
| /var/indimail/bin/maildirdeliver /home/mail/T2Zsym/example.com/testuser01/Maildir

You can replace maildirdeliver in the last line with vdelivermail(8)

| /var/indimail/bin/vdelivermail '' bounce-no-mailbox

Writing Filters for IndiMail

noreply@blogger.com (cprogrammer) — Sat, 18 Jun 2011 05:34:00 +0000

IndiMail provides multiple methods by which you can intercept an email in transit and modify the email headers or the email body. A filter is a simple program that expects the raw email on standard input and outputs the message text back on standard output. The program /bin/cat can be used as a filter which simply copies the standard input to standard output without modifying anything. Some methods can be used before the mail gets queued and some methods can be used before the execution of local / remote delivery.

It is not necessary for a filter to modify the email. You can have a filter just to extract the headers or body and use that information for some purpose. IndiMail also provides the following programs - 822addr(1), 822headerfilter(1), 822bodyfilter(1), 822field(1), 822fields(1), 822header(1), 822body(1), 822headerok(1), 822received(1), 822date(1), 822fields(1) to help in processing emails.

Let us say that we have written a script /usr/local/bin/myfilter. The myfilter program expects the raw email on stdin and outputs the email back (maybe modiying it) on stdout.

1.1 Filtering during SMTP (before mail gets queued)

1.1.1 Using FILTERARGS environment variable

The below configuration causes all inbound SMTP email to be fed through the filter /usr/local/bin/myfilter. You can use the programs 822header(1), 822body(1) inside myfilter to get and manipulate the headers and body (See 1.5.1).

% su root
# echo /usr/local/bin/myfilter > /service/qmail-smtpd.25/variables/FILTERARGS
# svc -d /service/qmail-smtpd.25
# svc -u /service/qmail-smtpd.25

NOTE: If the program myfilter returns 100, the message will be bounced. If it returns 2, the message will be discarded (blackholed).

1.1.2 Using QMAILQUEUE with qmail-qfilter

You can use qmail-qfilter(1). qmail-qfilter allows you to run multiple filters passed as command line arguments to qmail-qfilter. Since QMAILQUEUE doesn't allow you to specify multiple arguments, you can write a shell script which calls qmail-qfilter and have the shell script defined as QMAILQUEUE environment variable.

% su root
# echo /var/indimail/bin/qmail-qfilter /usr/local/bin/myfilter > /usr/local/bin/qfilter
# chmod +x /usr/local/bin/qfilter
# echo /usr/local/bin/qfilter > /service/qmail-smtpd.25/variables/QMAILQUEUE
# echo /var/indimail/bin/qmail-dk > /service/qmail-smtpd.25/variabels/QQF_QMAILQUEUE
# svc -d /service/qmail-smtpd.25
# svc -u /service/qmail-smtpd.25

NOTE: you can define QQF_MAILQUEUE to /var/indimail/bin/qmail-nullqueue to discard the mail (blackhole).

1.1.3 Using QMAILQUEUE with your own program

When you want to use your own program as QMAILQUEUE, then your program is responsible for queuing the email. It is trivial to queue the email by calling qmail-multi(8). You script can read the stdin for the raw message (headers + body) and pipe the output (maybe after modifications) to qmail-multi(8). If you are doing DK/DKIM signing, you can execute qmail-dk(8) instead of qmail-multi(8). You can have qmail-dk(8) call qmail-dkim(8) and qmail-dkim(8) calls qmail-multi(8). Assuming you want to do DK/DKIM signing, and myfilter calls qmail-dk(8), you can do the following

% su root
# echo /usr/local/bin/myfilter > /service/qmail-smtpd.25/variables/QMAILQUEUE
# echo /var/indimail/bin/qmail-dkim > /service/qmail-smtpd.25/variables/DKQUEUE
# echo /var/indimail/bin/qmail-multi > /service/qmail-smtpd.25/variables/DKIMQUEUE
# svc -d /service/qmail-smtpd.25
# svc -u /service/qmail-smtpd.25

NOTE: You can set the environment variable NULLQUEUE before calling qmail-multi to discard the mail completely (blackhole).

1.2 Filtering during local / remote delivery

1.2.1 Using FILTERARGS environment variable

The below configuration causes all local / remote deliveries to be fed through the filter /usr/local/bin/myfilter. You can use the programs 822header(1), 822body(1) inside myfilter to get and manipulate the headers and body.

% su root
# echo /usr/local/bin/myfilter > /service/qmail-send.25/variables/FILTERARGS
# svc -d /service/qmail-send.25
# svc -u /service/qmail-send.25

If you want to filter only for local delivery or only for remote delivery, you can use the environment variable QMAILLOCAL or QMAILREMOTE. QMAILLOCAL is defined only for local deliveries while QMAILREMOTE is defined only for remote deliveries.

NOTE: If the program myfilter returns 100, the message will be bounced. If it returns 2, the message will be discarded (blackholed).

e.g. the below script skips filtering for remote deliveries

#!/bin/sh
if [ -n “$QMAILREMOTE” ] ; then
    exec /bin/cat
fi
# rest of the script
...
...
exit 0

1.2.2 Using control file filterargs

The control file filterargs gives you control to run filters individually for local or remote deliveries. It also allows you to run your filter for both local and remote deliveries. See spawn-filter(8) for full description on this control file

e.g. The following entry in /var/indimail/control/filterargs causes all mails to yahoo.com be fed through the filter dk-filter(8) for DK/DKIM signing.

yahoo.com:remote:/var/indimail/bin/dk-filter

NOTE: If the program myfilter returns 100, the message will be bounced. If it returns 2, the message will be discarded (blackholed).

1.2.3 Using QMAILLOCAL or QMAILREMOTE environment variables

If you define QMAILLOCAL, indimail will execute the program/script defined by the QMAILLOCAL variable for all local deliveries. The arguments passed to this program/script will be the same as that for qmail-local(8).

Similarly, if you define QMAILREMOTE, indimail will execute the program/script defined by the QMAILREMOTE variable for all remote deliveries. The argument passed to this program/script are the same as that for qmail-remote(8).

The raw email (header + body) is available on stdin. You can use 822header(8), 822body(8) for getting the headers and body. After your program is through with filtering, the output should be piped to qmail-local(8) for local deliveries and qmail-remote(8) for remote deliveries. You need to also call qmail-local / qmail-remote with the same arguments. i.e

exec qmail-local  "$@"     #(for local deliveries)
exec qmail-remote "$@"     #(for remote deliveries)

NOTE: You can exit with value 0 instead of calling qmail-local / qmail-remote to discard the mail completely (blackhole)

1.3 Using dot-qmail(5) or valias(1)

Both .qmail files and valias mechanism allows you to execute your own programs for local deliveries. See the man pages for dot-qmail(5) and valias(1) for more details. After manipulating the original raw email on stdin, you can pipe the out to the program maildirdeliver(1) for the final delivery.

Assuming you write the program myscript to call maildirdeliver program, you can use the valias command to add the following alias

% valias -i "|/usr/local/bin/myfilter" testuser01@example.com

Now any mail sent to testuser01@example.com will be given to the program /usr/local/bin/myfilter as standard input.

NOTE: you can exit with value 0 instead of calling the maildirdeliver program to discard the mail completely (blackhole).

1.4 Using IndiMail rule based filter - vfilter

IndiMail's vfilter(8) mechanism allows you to create rule based filter based on any keyword in the message headers or message body. You can create a vfilter by calling the vcfilter(1) program.

% vcfilter -i -t myfilter -h 2 -c 0 -k "failure notice" -f /NoDeliver -b "2|/usr/local/bin/myfilter" testuser01@example.com

NOTE: you can exit with value 0 instead of putting anything on standard output to discard the mail completely (blackhole).

1.5 Examples Filters

e.g. the below filter looks for emails having "failure notice" in the subject line and inserts the line "sorry about that" in the first line of the message body and puts the line “sent by IndiMail Messaging platform” in the last line

1.5.1 FILTERARGS script

#bin/sh
# create a temporary file
tmp_file=`mktemp -p /var/tmp -t myfilter.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
# Copy the stdin
/bin/cat > $tmp_file
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
subject=`/var/indimail/bin/822header -I Subject < $tmp_file`
echo $subject | grep "failure notice" > /dev/null 2>&1
if [ $? -eq 0 ] ; then
    (
    /var/indimail/bin/822header < $tmp_file
    echo
    echo "sorry about that"
    /var/indimail/bin/822body < $tmp_file
    echo "sent by IndiMail Messaging platform"
    )
else
    /bin/cat $tmp_file
fi
/bin/rm -f $tmp_file
exit 0

1.5.2 QMAILQUEUE script

#!/bin/sh
# create a temporary file
inp_file=`mktemp -p /var/tmp -t myfilteri.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
out_file=`mktemp -p /var/tmp -t myfiltero.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
/bin/cat > $inp_file
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
subject=`/var/indimail/bin/822header -I Subject < $inp_file`
echo $subject | grep "failure notice" > /dev/null 2>&1
if [ $? -eq 0 ] ; then
    (
    /var/indimail/bin/822header < $inp_file
    echo
    echo "sorry about that"
    /var/indimail/bin/822body < $inp_file
    echo "sent by IndiMail Messaging platform"
    ) > $out_file
    if [ $? -ne 0 ] ; then
        /bin/rm -f $inp_file $out_file
        exit 111
    fi
    exec 0<$out_file
else
    exec 0<$inp_file
fi
/bin/rm -f $inp_file $out_file
# queue the message
exec /var/indimail/bin/qmail-multi
exit 111

1.5.3 QMAILREMOTE script

#!/bin/sh
# This scripts expects qmail-remote arguments on command line
# argv0          - qmail-remote
# argv1          - host   (host)
# argv2          - sender (sender)
# argv3          - qqeh   (qmail queue extra header)
# argv4          - size
# argv5 .. argvn - recipients
# 
#
host=$1
sender=$2
qqeh=$3
size=$4
shift 4
#
# if needed you can modify host, sender, qqeh, size args above
#
if [ -z "$QMAILREMOTE" ] ; then # execute qmail-local
    # call spawn-filter so that features like
    # FILTERARGS, SPAMFILTER are not lost
    exec -a qmail-local /var/indimail/bin/spawn-filter "$@"
fi
if [ " $CONTROLDIR" = " " ] ; then
   FN=/var/indimail/control/filterargs
else
   FN=$CONTROLDIR/filterargs
fi
if [ -n "$SPAMFILTER" -o -n "$FILTERARGS" -o -f $FN ] ; then
   # execute spawn-filter if you have filters defined for remote/local deliveries
   PROG="bin/spawn-filter"
else
   PROG="bin/qmail-remote"
fi
# create a temporary file
inp_file=`mktemp -p /var/tmp -t myfilteri.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
out_file=`mktemp -p /var/tmp -t myfiltero.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
/bin/cat > $inp_file
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
subject=`/var/indimail/bin/822header -I Subject < $inp_file`
echo $subject | grep "failure notice" > /dev/null 2>&1
if [ $? -eq 0 ] ; then
    (
    /var/indimail/bin/822header < $inp_file
    echo
    echo "sorry about that"
    /var/indimail/bin/822body < $inp_file
    echo "sent by IndiMail Messaging platform"
    ) > $out_file
    if [ $? -ne 0 ] ; then
        /bin/rm -f $inp_file $out_file
        exit 111
    fi
    exec 0<$out_file
else
    exec 0<$inp_file
fi
/bin/rm -f $inp_file $out_file
# $PROG points to spawn-filter if FILTERARGS or SPAMFILTER is set
# use $PROG so that features like FILTERARGS, SPAMFILTER are not lost
exec -a qmail-remote $PROG "$host" "$sender" "$qqeh" $size $*
exit 111

1.5.4 QMAILLOCAL script

#!/bin/sh
# This scripts expects qmail-local arguments on command line
# argv0          - qmail-local
# argv1          - user
# argv2          - homedir
# argv3          - local
# argv4          - dash
# argv5          - ext
# argv6          - domain
# argv7          - sender
# argv8          - defaultdelivery (mbox, Maildir)
# argv9          - qqeh
#
user=$1
homedir=$2
local=$3
dash=$4
ext=$5
domain=$6
sender=$7
defaultdel=$8
qqeh=$9

if [ -z "$QMAILLOCAL" ] ; then # execute qmail-remote
    # call spawn-filter so that features like
    # FILTERARGS, SPAMFILTER are not lost
    exec -a qmail-remote /var/indimail/bin/spawn-filter "$@"
fi
# create a temporary file
inp_file=`mktemp -p /var/tmp -t myfilteri.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
out_file=`mktemp -p /var/tmp -t myfiltero.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
/bin/cat > $inp_file
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
subject=`/var/indimail/bin/822header -I Subject < $inp_file`
echo $subject | grep "failure notice" > /dev/null 2>&1
if [ $? -eq 0 ] ; then
    (
    /var/indimail/bin/822header < $inp_file
    echo
    echo "sorry about that"
    /var/indimail/bin/822body < $inp_file
    echo "sent by IndiMail Messaging platform"
    ) > $out_file
    if [ $? -ne 0 ] ; then
        /bin/rm -f $inp_file $out_file
        exit 111
    fi
    exec 0<$out_file
else
    exec 0<$inp_file
fi
/bin/rm -f $inp_file $out_file

# call spawn-filter so that features like
# FILTERARGS, SPAMFILTER are not lost
exec -a qmail-local /var/indimail/bin/spawn-filter "$@"
exit 111

1.5.5 valias / vfilter script

#!/bin/sh
# create a temporary file
inp_file=`mktemp -p /var/tmp -t myfilteri.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file
    exit 111
fi
out_file=`mktemp -p /var/tmp -t myfiltero.XXXXXXXXXXXXXXX`
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
/bin/cat > $inp_file
if [ $? -ne 0 ] ; then
    /bin/rm -f $inp_file $out_file
    exit 111
fi
subject=`/var/indimail/bin/822header -I Subject < $inp_file`
echo $subject | grep "failure notice" > /dev/null 2>&1
if [ $? -eq 0 ] ; then
    (
    /var/indimail/bin/822header < $inp_file
    echo
    echo "sorry about that"
    /var/indimail/bin/822body < $inp_file
    echo "sent by IndiMail Messaging platform"
    ) > $out_file
    if [ $? -ne 0 ] ; then
        /bin/rm -f $inp_file $out_file
        exit 111
    fi
    exec 0<$out_file
else
    exec 0<$inp_file
fi
/bin/rm -f $inp_file $out_file
#
# unset RPLINE so that maildirdeliver does not add a duplicate Return-Path line
# unset PWSTRUCT so that password structure cached is removed for vuserinfo to
# work correctly
#
unset RPLINE PWSTRUCT
dir=`/var/indimail/bin/vuserinfo -d testuser01@example.com | cut -d: -f2 |cut -c2-`

if [ $? -ne 0 -o " $dir" = " " ] ; then
    echo "unable to get user's homedir" 1>&1
    exit 111
fi
exec /var/indimail/bin/maildirdeliver "$dir"/Maildir
exit 111

Explanation of email delivery mechanism for local users

noreply@blogger.com (cprogrammer) — Fri, 03 Jun 2011 09:21:00 +0000

Any email that needs to be delivered needs to be put into a queue before it can be taken up for delivery. Email can be submitted to the queue using qmail-queue command or qmail_open() function. The following programs use the qmail_open() API -
condredirect, dot-forward, fastforward, filterto, forward, maildirserial, new-inject, ofmipd, qmail-inject, qmail-local, qmail-qmqpd, qmail-qmtpd, qmail-queue, qmail-send, qreceipt, replier, rrforward, qmail-smtpd.
Of these, qmail-smtpd and qmail-qmtpd accept an email for a domain only if the domain is listed in rcpthosts. Once an email is accepted into the queue, qmail-send(8) decides if the mail is to be delivered locally or to a remote address. If the email address corresponds to a domain listed in locals or virtualdomains control file, steps are taken to have the email delivered locally.

Delivery Mode

The delivery mode depends on the argument passed to qmail-daemon during startup. The script /service/qmail-send.25/run passes the content of the file /var/indimail/control/defaultdelivery as an argument to qmail-daemon.

See INSTALL.mbox, INSTALL.maildir, and INSTALL.vsm for more information.

To select your default mailbox type, just enter the defaultdelivery value from the table into /var/indimail/control/defaultdelivery.

e.g., to select the standard qmail Mailbox delivery, do:

echo ./Maildir/ > /var/indimail/control/defaultdelivery

Addresses

Once you have decided the delivery mode above, one needs to have some mechanism to assign a local address for the delivery. qmail (which is what IndiMail uses) offers the following mechanism

locals
Any email addressed to user@domain listed in the file /var/indimail/control/locals will be delivered to the local user user. If you have Maildir as the delivery mode and an email to user kanimoji@domain, with home directory /home/blackmoney, will be delivered to /home/blackmoney/Maildir/new

virtualdomains

The control file /var/indimail/control/virtualdomains allows you to have multiple domains configured on a single server. Entries in virtualdomains are of the form:

user@domain:prepend

qmail converts user@domain to prepend-user@domain and treats the result as if domain was local. The user@ part is optional. If it's omitted, the entry matches all @domain addresses.

When you run the command

vadddomain example.com some_password

It will add the following entry in virtualdomains control file

example.com:example.com

What this means is that any email addressed to user@example.com will be delivered to the address example.com-user@example.com.

IndiMail further uses qmail-users mechanism to deliver the email for users in a virtual domain. This is explained below

qmail-users

The file /var/indimail/users/assign assigns addresses to users.


A simple assignment is a line of the form

=local:user:uid:gid:homedir:dash:ext:

Here local is an address; user, uid, and gid are the account name, uid, and gid o the user in charge of local; and messages to local will be controlled by


homedir/.qmaildashext.




If there are several assignments for the same local address, qmail-lspawn will use the first one. local is interpreted without regard to case.

A wildcard assignment is a line of the form

+loc:user:uid:gid:homedir:dash:pre:

This assignment applies to any address beginning with loc, including loc itself.

It means the same as

=locext:user:uid:gid:homedir:dash:preext:

for every string ext.

When you add a virtualdomain using vadddomain, you will have the following entry

+example.com-:example.com:555:555:/var/indimail/domains/example.com:-::

As stated earlier, any email addressed to user@example.com will be delivered to local user example.com-user@example.com because of virtualdomains control file. The above address can be looked as

=user@example.com:example.com:555:555:/var/indimail/domains/example.com:-:user:

So you can see that emails are controlled by .qmail-user in the directory /var/indimail/domains/example.com. if .qmail-user does not exist, then .qmail-default will be used

Adding the entry

+example.com-customer_care-:example.com:555:555:/var/indimail/domains/example.com/cc:-::

will cause emails to customer_care-delhi@example.com, customer_care-mumba@example.com, etc to be handled by /var/indimail/domains/cc/.qmail-default (if .qmail-customer_care-delhi does does not exist).

Extension Addresses

In the qmail system, you control all local addresses of the form user-anything, as well as the address user itself, where user is your account name. Delivery to user-anything is controlled by the file homedir/.qmail-anything. (These rules may be changed by editing the assign file as given above in qmail-users.
The alias user controls all other addresses. Delivery to user is controlled by the file homedir/.qmail-user, where homedir is alias's home directory.
In the following description, qmail-local is handling a message addressed to local@domain, where local is controlled by .qmail-ext. Here is what it does.
If .qmail-ext is completely empty, qmail-local follows the defaultdelivery instructions set by your system administrator.
If .qmail-ext doesn't exist, qmail-local will try some default .qmail files. For example, if ext is foo-bar, qmail-local will try first .qmail-foo-bar, then .qmail-foo-default, and finally .qmail-default. If none of these exist, qmail-local will bounce the message. (Exception: for the basic user address, qmail-local treats a nonexistent .qmail the same as an empty .qmail.)
The vadddomain command creates the file .qmail-default in /var/domain/domains/domain_name. Hence any email addressed to user@example.com gets controlled by /var/indimail/domains/example.com/.qmail-default.

WARNING: For security, qmail-local replaces any dots in ext with colons before checking .qmail-ext. For convenience, qmail-local converts any uppercase letters in ext to lowercase.

Database Connections made by IndiMail

noreply@blogger.com (cprogrammer) — Fri, 22 Apr 2011 08:28:00 +0000

IndiMail uses MySQL for storing information of virtual domain users. The table 'indimail' stores important user information like password, access permissions, quota and the mailbox path. Most of user related queries have to lookup the 'indimail' table in MySQL.
Rather than making individual connections to MySQL for extracting information from the 'indimail' table, IndiMail programs use the service of the inlookup(8) server. Programs use an API function inquery() to request service. InLookup is a connection pooling server to serve requests for inquery() function. It is implemented over two fifos. One fixed fifo for reading the query and reading the path of a randomly generated fifo. The randomly generated fifo is used for writing the result of the query back. inlookup(8) creates a read FIFO determined by the environment variable INFIFO. If INFIFO is not defined, the default FIFO used is /var/indimail/inquery/infifo. inlookup(8) then goes into an infinite loop reading this FIFO. If INFIFO is not an absolute path, inlookup(8) uses environment variable FIFODIR to look for fifo named by INFIFO variable. Inlookup(8) can be configured by setting environment variables in /service/inlookup.info/variables

inlookup helps in optimizing connection to MySQL(1), by keeping the connections persistent.
It also maintains the query result in a double link list.
It uses binary tree algorithm to search the cache before actually sending the query to the database.
IndiMail clients send requests for MySQL(1) queries to inlookup through the function inquery() using a fifo.
The inquery() API uses the InLookup service only if the environment variable QUERY_CACHE is set. If this environment variable is not set, the inquery() function makes a direct connecton to MySQL.
Clients which are currently using inquery are qmail-smtpd(1), proxyimap(8), proxypop3(8), vchkpass(8) and authindi(8).
inlookup(8) service is one of the reasons why IndiMail is able to serve million+ users using commodity hardware.

The program inquerytest simulates all the queries which inlookup supports and can be used as a test/diagnostic tool for submitting queries to inlookup. e.g

% sudo inquerytest -q 3 -i "" user@example.com

Plugin for qmail-smtpd

noreply@blogger.com (cprogrammer) — Fri, 15 Apr 2011 15:12:00 +0000

IndiMail now has a plugin functionality for qmail-smtpd. You can write your own plugin to carry out tasks during the MAIL, RCPT or the DATA phase of SMTP. See the man page for plugin_init(3) for details.

NAME
plugin_init() - Template for Dynamic SMTP Plugins

SYNTAX
#include smtp_plugin.h

char *from_plug(char *rip, char *from, char **mesg);

char *rcpt_plug(char *rip, char *from, char *rcpt, char **mesg);

char *data_plug(char *local, char *rip, char *rhost, char *rinfo, char **mesg);

PLUGIN *plugin_init();

typedef struct
{
int (*mail_func) (char *, char *, char **);
int (*rcpt_func) (char *, char *, char *, char **);
int (*data_func) (char *, char *, char *, char *, char **);
} PLUGIN;

DESCRIPTION
PLUGIN structure has three components: mail_func is a pointer to function to be exe‐
cuted in the SMTP MAIL session. rcpt_func is a pointer to function to be executed in
the SMTP RCPT session. data_func is a pointer to function to be executed in the SMTP
DATA session.

To write a SMTP plugin you have to write the plugin_init() function. Depending on
which phase of SMTP (MAIL, RCPT, DATA) you want to call your function, you have to
write the from_plug, rcpt_plug, data_plug functions.

The plugin_init() function can be written as below

PLUGIN *
plugin_init()
{
static PLUGIN plug;
PLUGIN *ptr;

ptr = &plug;
ptr->mail_func = from_plug;
ptr->rcpt_func = rcpt_plug;
ptr->data_func = data_plug;
return &plug;
}

To compile the plugin you can use gcc(1).

gcc -shared -rdynamic -nostartfiles -fPIC -s -O4 -o smtpd-plugin.so smtp_plugin.o

RETURN VALUE
The functions from_plug, rcpt_plug, data_plug must return 0 on success. These func‐
tions should return 1 to terminate the sesson with a message. You can set your own
message by assigning mesg variable. If you have the below function in smtpd-plugin.so

int
rcpt_plug(char *remoteip, char *from, char *rcpt, char **mesg)
{
if (!strstr(rcpt, "@yahoo.com"))
{
*mesg = "530 We are serious and don't Yahoo (#5.7.1)
return (1);
}
return (0);
}

SEE ALSO
qmail-smtpd(8), dlopen(3), gcc(1)

The AdminClient Protocol

noreply@blogger.com (cprogrammer) — Fri, 01 Apr 2011 10:02:00 +0000

IndiMail provides close to around 300 different programs as part of a flexible Enterprise Messaging Platform. You can carry administer the entire platform with around 45 of these programs. A program called indisrvr(8) provides a way for users to secure execute these commands from any remote location. To execute these programs, you need to have an admin account on the IndiMail server. These accounts can be created by the mgmtpass(8) program. Once you have an admin account on the IndiMail server, you can further restrict users to certain programs using the vpriv(8) program. vpriv can further modify privileges by allowing only certain options within a allowed program.

To execute these programs on the IndiMail server, you need to connect to port 4000 and use the adminclient protocol. The adminclient protocol is described below by showing a conversation between a client and the server 'indisrvr'

s - denotes server
c - denotes client

   s: "Login: "
   c: "userid\n"
   s: "Password: "
   c: "password\n"
   s: "OK\n"
   c: "index command arg1 arg2 ...\n"
   s:
   c: "\n"
   s: "RETURNSTATUS[return value of command]\n"

To execute 'vuserinfo' you will need to do the following.

% telnet 0 4000

Trying 0.0.0.0...

Connected to 0.

Escape character is '^]'.

Password: benhur20

7 vuserinfo -n manvendra@indimail.org

name : manvendra@indimail.org

RETURNSTATUS0

Index value of '7' was used for vuserinfo. A privileged user 'admin' with password 'benhur20' was used to execute vuserinfo. Each command has an index. The values are given as below.

Index Commands
----- --------
00 vadduser
01 vpasswd
02 vdeluser
03 vsetuserquota
04 vbulletin
05 vmoduser
06 valias
07 vuserinfo
08 vipmap
09 vacation
10 vmoveuser
11 vrenameuser
12 crc
13 vcfilter
14 indiversion
15 vsmtp
16 dbinfo
17 vhostid
18 mgmtpass
19 inquerytest
20 printdir
21 shit
22 vaddaliasdomain
23 vadddomain
24 vcalias
25 vcaliasrev.sh
26 vconvert
27 vdeldomain
28 vrenamedomain
29 vdominfo
30 vfstab
31 vgroup
32 vatrn
33 vpriv
34 vlimit
35 hostcntrl
36 execmysql
37 updatefile
38 vreorg
39 vdeloldusers
40 ipchange
41 svctool
42 clearopensmtp
43 hostsync
44 inquerytest
45 vmoddomain

If you have a user provisioning interface written in your favourite language, you can connect to the port 4000 and execute the above programs. IndiMail also provides you a command line program 'adminclient' which can execute any of the above programs. Read the man page for adminclient for further details.

Distributing your outgoing mails from Multiple IP addresses

noreply@blogger.com (cprogrammer) — Sat, 08 Jan 2011 05:10:00 +0000

Some mail providers like hotmail, yahoo restrict the number of connections from a single IP and the number of mails that can be delivered in an hour from a single IP. To increase your ability to deliver large number of genuine emails from your users to such sites, you may want to send out mails from multiple IP addresses.

IndiMail has the ability to call a custom program instead of qmail-local(8) or qmail-remote(8). This is done by defining the environment variable QMAILLOCAL or QMAILREMOTE. qmail-remote(8) can use the environment variable OUTGOINGIP to set the IP address of the local interface when making outgoing connections. By writing a simple script and setting QMAILREMOTE environment variable pointing to this script, one can randomly chose an IP address from the control file

/var/indimail/control/outgoingip

The script below also allows you to define multiple outgoing IP addresses for a single host. e.g. you can create the control file to send out mails from multiple IPs only for the domain hotmail.com

/var/indimail/control/outgoingip.hotmail.com

Let us name the below script balance_outgoing

% su
# echo "/var/indimail/bin/balance_outgoing" > /service/qmail-send.25/variables/QMAILREMOTE
# svc -d /service/qmail-send.25
# svc -u /service/qmail-send.25
# exit
%

Finally the balance_outgoing script can be placed with execute bit in /var/indimail/bin

#!/bin/sh
# This scripts expects qmail-remote arguments on command line
# argv0 - qmail-remote
# argv1 - host (host)
# argv2 - sender (sender)
# argv3 - qqeh (qmail queue extra header)
# argv4 - size
# argv5 .. argvn - recipients
#
#
host=$1
sender=$2

qqeh=$3

size=$4

shift 4

cd /var/indimail

if [ " $CONTROLDIR" = " " ] ; then

FN=/var/indimail/control/filterargs

else

FN=$CONTROLDIR/filterargs

if [ -n "$SPAMFILTER" -o -n "$FILTERARGS" -o -f $FN ] ; then

# execute spawn-filter if you have filters defined for remote/local deliveries

PROG="bin/spawn-filter"

else

PROG="bin/qmail-remote"

if [ " $CONTROLDIR" = " " ] ; then

if [ -f /var/indimail/control/outgoingip.$host ] ; then

IP=(`cat /var/indimail/control/outgoingip.$host`)

elif [ -f /var/indimail/control/outgoingip ] ; then

IP=(`cat /var/indimail/control/outgoingip`)

else

exec -a qmail-remote $PROG "$host" "$sender" "$qqeh" $size $*

else

if [ -f $CONTROLDIR/outgoingip.$host ] ; then

IP=(`cat $CONTROLDIR/outgoingip.$host`)

elif [ -f $CONTROLDIR/outgoingip ] ; then

IP=(`cat $CONTROLDIR/outgoingip`)

else

exec -a qmail-remote $PROG "$host" "$sender" "$qqeh" $size $*

IP_COUNT=${#IP[*]}

if [ $IP_COUNT -gt 1 ] ; then

i=`expr $RANDOM % $IP_COUNT`

export OUTGOINGIP=${IP[$i]}

exec -a qmail-remote $PROG "$host" "$sender" "$qqeh" $size $*

Handling Bounces yourself

noreply@blogger.com (cprogrammer) — Mon, 02 Aug 2010 07:50:00 +0000

IndiMail allows a mechanism by which you can use your own script/program to handle bounces. All bounces in IndiMail is generated by qmail-send. qmail-send generates a bounce when qmail-lspawn or qmail-rspawn reports a permanent failed delivery. A bounce is generated by qmail-send by injecting a new mail in the queue using qmail-queue. This bounce generation by qmail-send can be modified in three ways

1. Using environment variable BOUNCEPROCESSOR

When you define the environment variable BOUNCEPROCESSOR as a valid path to a program or script, the program gets called whenever a delivery fails permanently. The program runs with the uid qmails and is passed the following five arguments

bounce_file bounce_report bounce_sender original_recipient bounce_recipient

To set BOUNCEPROCESSOR, you would do the following

# echo "path_of_your_bounce_processor" > /service/qmail-send.25/variables/BOUNCEPROCESSOR

There are few email marketing companies who are using BOUNCEPROCESSOR to insert the status of all bounces in MySQL table for their email marketing campaigns.

2 Using environment variable BOUNCERULES or control files bounce.envrules.

Using envrules, you can set specific environment variables only for bounced recipients. The format of this file is of the form

pat:envar1=val,envar2=val,...]

where pat is a regular expression which matches a bounce recipient. envar1, envar2 are list of environment variables to be set. If var is omitted, the environment variable is unset.

e.g.

support@indimail.org:CONTROLDIR=control2,QMAILQUEUE=/var/indimail/bin/qmail-nullqueue

causes all bounces generated for the sender support@indimail.org to be discarded.

3. Using BOUNCEQUEUE environment variable to queue bounces

qmail-send uses qmail-queue to queue bounces and aliases/forwards. This can be changed by using QMAILQUEUE environment variable. If a different queue program is desired for bounces, it can be set by using BOUNCEQUEUE environment variable.

e.g

# echo /var/indimail/bin/qmail-nullqueue > /service/qmail-send.25/variables/BOUNCEQUEUE

disables bounces system-wide. Though disabling bounces may not be the right thing to do but in some situations where bounces are not at all needed, disabling bounces will surely result in performance improvements of your system, especially so if your system does mass-mailing.

Delivery Instructions for a Virtual Domain

noreply@blogger.com (cprogrammer) — Tue, 13 Jul 2010 07:35:00 +0000

IndiMail uses a modified version of qmail as the MTA. For local deliveries, qmail-lspawn reads a series of local delivery commands from descriptor 0, invokes qmail-local to perform the deliveries. qmail-local reads a mail message and delivers to to a user by the procedure described in dot-qmail(5). IndiMail uses vdelivermail as the local delivery agent.

A virtual domain is created by the command vadddomain(1).

% vadddomain example.com some_password

The above command creates a virtual domain with delivery instructions in /var/indimail/domains/example.com/.qmail-default file. A line in this file is of the form

/var/indimail/sbin/vdelivermail '' delivery_instruction_for_non_existing_user

The delivery_instruction_for_non_existing_user can have one of the following 5 forms

delete
bounce-no-mailbox
Maildir
emailAddress
IPaddress

Using delete as the delivery instruction causes IndiMail to discard all mails addressed to non-existing users. The original sender does not get notified of the delivery. On a real messaging system serving real users, you will not want to do this.

The instruction bounce-no-mailbox causes a bounce to be generated to the sender in case an email is addressed to a non-existing user. This is the most common usage in .qmail-default which most IndiMail installations will have

The instruction Maildir causes emails to be addressed to non-existing users to be saved in a Maildir. Here Maildir should refer to a full path of an existing Maildir.

The instruction emailAddress causes emails to be addressed to non-existing users to be forwarded to an email address emailAddress.

The instruction IPaddress causes emails to be addressed to non-existing users to be redirected to a remote SMTP server at IP IPaddress. The format of IPaddress is domain:ip:port where domain is the domain name, ip is the IP address of the remote SMTP server and port is the SMTP port on the remote SMTP server. It is expected that the non-existing user is present on the remote system. This type of delivery is used by IndiMail on a clustered setup. In a clustered setup, users are distributed across multiple server. A particular user will be located only on one particular server. However, the same domain will be present on multiple servers.

In the delivery instruction in .qmail-default, you can replace vdelivermail with vfilter to perform in-line filtering use IndiMail's poweful vfilter. You can create filters using the program vcfilter.

Relaying - How does IndiMail handle relaying securely

noreply@blogger.com (cprogrammer) — Thu, 08 Jul 2010 04:06:00 +0000

A SMTP server is responsible for accepting mails from a sender and processing it for delivery to one or more recipients. In most situations, for domains which are under your administrative control (native addresses), the SMTP server should accept mails without authentication. However, when a mail is submitted for delivery to domains which are not under your administrative control, you should accept mails only after it satisfies security considerations like having the sender authenticate itself. This is to prevent abuse of external domains using your SMTP server. A SMTP server which accepts mails for external domains without any authentication is called an open relay. The act of accepting mails for external domains for delivery is called relaying.

The default configuration of IndiMail configures the SMTP as a closed system. Hence to be able to send mails to external domains, you need to setup mechanisms for relaying.

There are many methods. Choose any of the below after studying them. I prefer 3 or 4 for security reasons.

Have Sender's IP addresses in tcp.smtp file
Use control file relayclients for IP addresses of clients allowed to relay mail through this host.
Configure IndiMail to use MySQL relay table (good security). This is implemented on POP3/IMAP before SMTP
Use authenticated SMTP (good security)
For allowing relay to specific domains use control file relaydomains
For allowing specific users (native addresses) use control file relaymailfrom

NOTE: you should use 1 & 2 only if if the host having the sender's IP is under your control and you have good security policies for the host (however what is a good security can be very subjective)

Using tcp.smtp

Your startup script for the qmail smtp server must use the tcpserver -x file option similar to this startup line.

env - PATH="/var/indimail/bin" tcpserver -H -R -x /var/indimail/etc/tcp.smtp.cdb \
-c 20 -u 555 -g 555 0 smtp /var/indimail/bin/qmail-smtpd 2>&1

IndiMail uses -x option to tcpserver and hence you need not bother about the above line. You however need to edit /var/indimail/etc/tcp.smtp and put in lines for all static IP's that you will always want to relay access to.

127.0.0.:allow,RELAYCLIENT=””
10.1.1.:allow,RELAYCLIENT=””

The above lines will cause RELAYCLIENT environment variable to be set for localhost and all machines on the 10.1.1 class and hence allow to relay through. Remember that any user on hosts on 10.1.1 class will be able to relay mails. You many not want this. The line having 127.0.0. will allow any client on the IndiMail host to use SMTP and relay mails.

If you add any IP to tcp.smtp, you have to rebuild a cdb database tcp.smtp.cdb. You can run the following command

% sudo /var/indimail/bin/qmailctl cdb

NOTE: Remember that you are exposed to unrestricted relaying from any of the IP addresses listed in tcp.smtp

Using control file relayclients

IP addresses of clients allowed to relay mail through this host. Each address should be followed by a colon and an (optional) string that should be appended to each incoming recipient address, just as with the RELAYCLIENT environment variable. Nearly always, the optional string should be null. The filename can be overriden by the environment variable RELAYCLIENTS.

Addresses in relayclients may be wildcarded (2nd line in the example below):

192.168.0.1:
192.168.1.:

Using MySQL relay table

Run the command /var/indimail/bin/clearopensmtp in the cron every 30 Minutes

By default every time who uses IndiMail's POP3 or IMAP service and authenticates, the following happens:

On successful authentication, IMAP/POP3 daemon inserts entry into relay table, inserting email, IP address and timestamp.
If CHECKRELAY environment variable is enabled, SMTP checks the relay table for a entry within minutes specified by the RELAY_CLEAR_MINUTES environment variable. If the entry is there, RELAYCLIENT environment variable is set, which allows relaying. At this point, the SMTP server will allow that IP to relay for 60 Mins (default)

clearopensmtp will clear all IP which have not authenticated in the past RELAY_CLEAR_MINUTES. clearopensmtp should be enabled in cron to run every 30 minutes.

Set up Authenticated SMTP

IndiMail also provides you authenticated SMTP providing AUTH PLAIN, AUTH LOGIN and AUTH CRAM-MD5 methods. Whenever a user successfully authenticates through SMTP, the RELAYCLIENT environment variable gets set. qmail-smtpd uses the RELAYCLIENT environment variable to allow relaying.

Most of the email clients like thunderbird, evolution, outlook, outlook express have options to use authenticated SMTP.

For a tutorial on authenticated SMTP, you can refer to

http://indimail.blogspot.com/2010/03/authenticated-smtp-tutorial.html

Using control file relaydomains

Host and domain names allowed to relay mail through this host. Each
address should be followed by a colon and an (optional) string that should
be appended to each incoming recipient address, just as with the RELAY\
CLIENT environment variable. Nearly always, the optional string should be
null.
Addresses in relaydomains may be wildcarded:

heaven.af.mil:
.heaven.af.mil:

Using control file relaymailfrom

envelope senders (MAIL FROM) listed in this file will be allowed to relay independently of the RELAYCLIENT environment variable. Entries in relaymailfrom can be E-Mail addresses, or just the domain (with the @ sign).

Unlike relaydomains native addresses should be entered. A line in relay mailfrom may be of the form @host, meaning every address at host. relaymailfrom can also be in cdb format. If relaymailfrom.cdb is present, it will be searched first.

Examples:
joeblow@domain1.com
@domain2.com

If you use the control file /var/indimail/control/relaymailfrom, you should really know what you are doing. Any mail from having a domain component of the address matching any domain in this file, relaying will be allowed without any authentication. You can most probably use this only if you have a closed SMTP server to which access from outside is not possible.

Setting Disclaimers on your outgoing mails

noreply@blogger.com (cprogrammer) — Wed, 30 Jun 2010 15:11:00 +0000

In my earlier article, I showed how to set up automatic rule based archival. I had discussed email archival as one of the many compliance requirements you might have. Sometimes you may also require to configure disclaimers in your messaging system. e.g for UK Companies Act 2006, IRS Circular 230.

IndiMail provides a utility called altermime(1) to add your own disclaimers on each and every mail that goes out through your IndiMail messaging server. You can use any of the two options below to configure disclaimers

Option 1 - using /var/indimail/control/filterargs

The filterargs control file allows you to insert any filter before remote or local delivery. You can use altermime to insert a disclaimer as below

*:/var/indimail/bin/altermime --input=- \

--disclaimer=/var/indimail/control/disclaimer

If you want disclaimer to be used only for your outgoing mails then, you could do the following

*:remote:/var/indimail/bin/altermime --input=- \

--disclaimer=/var/indimail/control/disclaimer

In both the above examples the file /var/indimail/control/disclaimer contains the text of your disclaimer

Option 2 - Set the FILTERARGS environment variable

Just like filterargs control file, the environment variable FILTERARGS allows you to set any custom filter before your mail gets deposited into the queue by qmail-queue(8).

% su

# echo /var/indimail/bin/altermime --input=- --disclaimer=/var/indimail/control/disclaimer \

> /service/qmail-smtpd.587/variables/FILTERARGS

# svc -d /service/qmail-smtpd.587

# svc -u /service/qmail-smtpd.587

Read altermime(1) man page for more details

You can download IndiMail at
http://sourceforge.net/projects/indimail/

The RPM can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/

Subscribe to indimail

Email:

Visit this group

Email Archiving

noreply@blogger.com (cprogrammer) — Sat, 26 Jun 2010 03:49:00 +0000

IndiMail provides multiple options for those who want their emails archived automatically.

For easy retrieval, you can use tools like google desktop, beagle, etc

If you use IndiMail, you have two methods to achieve automatic archiving of emails

1. using environment variable EXTRAQUEUE

If EXTRAQUEUE environment variable is set to any environment variable, qmail-queue will deposit an extra copy of the email which it receives for putting it in the queue. Normally you would set EXTRAQUEUE variable in any of the clients which use qmail-queue. e.g. qmail-smtpd, qmail-inject, sendmail, etc. If you have setup IndiMail as per the official instructions, you can set EXTRAQUEUE for incoming and outgoing mails as given below

% su

# echo "archive@example.com" > /service/qmail-smtpd.25/variables/EXTRAQUEUE

# echo "archive@example.com" > /service/qmail-smtpd.587/variables/EXTRAQUEUE

# svc -d /service/qmail-smtpd.25 /service/qmail-smtpd.587

# svc -u /service/qmail-smtpd.25 /service/qmail-smtpd.587

# exit

Now all your emails coming in and going out of the system, a copy will be sent to archive@example.com. If archive@example.com lies on IndiMail Messaging Platform, you can set filters (using vfilter(1)) to automatically deposit the mails in different folders. The folders can be decided on various criteria like date, sender, recipient, domain, etc.

2. using control file mailarchive

This control file allows you to set up rule based archiving. For any specific sender or recipient, you can set a rule to select a destination email for archiving. This is much more flexible than using EXTRAQUEUE which allowed you to archive emails to a single email address. A line in the control file mailarchive can be of the form

type:regexp:dest_address

Here type is 'T' to set a rule on recipients. You can set the type as 'F' to set a rule on the sender.

regexp is any email address which matches the sender or recipient (depending on whether type is 'T' or 'F').

dest_address should expand to a valid email address. You can have a valid email address. You can also have the '%' sign followed by the letters u, d or e in the address to have the following substitutions made

%u - gets replaced by the user component of email address (without the '@' sign)

%d - gets replaced by the domain component of email address

%e - gets replaced by the email address

The email address in the above substitution will be the recipient (if type is 'T') and the sender (if type is 'F').

another example and a cool tip :)

T:*:%u@arch%d

Will make a hot standby of your incoming mails for yourdomain on another server hosting archyourdomain.

NOTE: Currently only type = 'F' is implemented. type='T' will be implemented in release 1.7.8

For some organizations, email archiving is a must due to compliance with regulatory standards like SOX, HIPAA, Basel II Accord (effective 2006), Canadian Privacy Act, Data Protection Act 1988, EU Data Protection Directive 95/46/FC, Federal Information Security Management Act (FISMA), Federal Rules of Civil Procedure (FRCP), Financial Services Act 198, regulated by FSA, Freedom of Information Act (FOIA), Freedom of Information Act (in force January 2005), The Gramm-Leach-Bliley Act (GLBA), MiFID (Markets in Financial Instruments Directives), PIPEDA (Personal Information Protection and Electronic Documents Act), SEC Rule 17a-4/ NASD 3010 (Securities Exchange Act 1934).

Apart from archiving, you would also want to set disclaimers. IndiMail allows you to set a disclaimer by setting the FILTERARGS environment variable and using altermime(1). The following acts/circular specifically require you to set disclaimers.

UK Companies Act 2006, IRS Circular 230,

Reference

Email Compliance - A simple 5 step guide

E-Mail archiving - Wikipedia

Compliance Requirements for email archiving

Email Legislation - Summary of UK, US, EU legislations

You can download IndiMail at
http://sourceforge.net/projects/indimail/

The RPM can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/

Subscribe to indimail

Email:

Visit this group

Setting Limits for your Virtual Domain

noreply@blogger.com (cprogrammer) — Thu, 10 Jun 2010 04:49:00 +0000

IndiMail comes with a program vlimit(1), which allows you to set global limits for your domain. Before using vlimit, you need to enable domain limits for a domain using vmoddomain(1).

% vmoddomain -l 1 example.com

Once you have done the above, you can start using vlimit for the domain example.com

% vlimit -s example.com
Domain Expiry Date : Never Expires
Password Expiry Date : Never Expires
Max Domain Quota : -1
Max Domain Messages : -1
Default User Quota : -1
Default User Messages: -1
Max Pop Accounts : -1
Max Aliases : -1
Max Forwards : -1
Max Autoresponders : -1
Max Mailinglists : -1
GID Flags:
Flags for non postmaster accounts:
pop account : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
alias : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
forward : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
autoresponder : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist users : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist moderators: ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
domain quota : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
default quota : ALLOW_CREATE ALLOW_MODIFY

Using vlimit you can set various limits or defaults for a domain. One of my favourite use of vlimit is setting default quota for users created in a domain. The default quota compiled in IndiMail is 5Mb which is not good enough for today's users. So if you want to have a default quota of 50 Mb for your users when you add them using the vadduser(1) command -

% vlimit -q 52428800 example.com
% vlimit -s example.com
Domain Expiry Date : Never Expires
Password Expiry Date : Never Expires
Max Domain Quota : -1
Max Domain Messages : -1
Default User Quota : 52428800
Default User Messages: -1
Max Pop Accounts : -1
Max Aliases : -1
Max Forwards : -1
Max Autoresponders : -1
Max Mailinglists : -1
GID Flags:
Flags for non postmaster accounts:
pop account : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
alias : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
forward : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
autoresponder : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist users : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist moderators: ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
domain quota : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
default quota : ALLOW_CREATE ALLOW_MODIFY

You can also implement domain level restrictions. To disable POP3 for all users in example.com

% vlimit -g p example.com
% vlimit -s example.com
Domain Expiry Date : Never Expires
Password Expiry Date : Never Expires
Max Domain Quota : -1
Max Domain Messages : -1
Default User Quota : 52428800
Default User Messages: -1
Max Pop Accounts : -1
Max Aliases : -1
Max Forwards : -1
Max Autoresponders : -1
Max Mailinglists : -1
GID Flags:
NO_POP
Flags for non postmaster accounts:
pop account : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
alias : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
forward : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
autoresponder : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist users : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
mailinglist moderators: ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
domain quota : ALLOW_CREATE ALLOW_MODIFY ALLOW_DELETE
default quota : ALLOW_CREATE ALLOW_MODIFY

You can download IndiMail at
http://sourceforge.net/projects/indimail/

The RPM can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/

Subscribe to indimail

Email:

Visit this group

using openLDAP for addressbook

noreply@blogger.com (cprogrammer) — Tue, 01 Jun 2010 04:04:00 +0000

By now I have got exhausted answering folks 'Why IndiMail does not have a shared addressbook'

IndiMail is a pure messaging platform. It does not attempt to do things which can be done better by other software like openLDAP etc.

However, things can get bit tricky setting up an address book using openLDAP. This tutorial should make it easy for you to install your own shared address book. The commands below have worked for me on my linux laptop which is proudly powered by Fedora 12. The commands / configuration may slightly vary for your Linux distro / openLDAP version.

Install openldap

% sudo yum install openldap openldap-servers openldap-clients

Configure openldap

You need to start slapd to implement openldap. slapd uses configurion
file /etc/openldap/slapd.conf

The following slapd.conf file contains the basic configurations required to establish a shared address book on a secure network, however there are no access controls yet defined; security is covered later on. The encrypted root password (rootpw) should be substituted where necessary. You can use slappasswd to generate the password

% slappasswd -s secret
{SSHA}gDPX3cS87+B31mAF5zHCGtEJBYSuqrN/

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/collective.schema

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

database bdb
suffix "dc=indimail,dc=org"
checkpoint 1024 15
rootdn "cn=Manager,dc=indimail,dc=org"
rootpw {SSHA}gDPX3cS87+B31mAF5zHCGtEJBYSuqrN/
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap

# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

access to dn.subtree="ou=addressbook,dc=indimail,dc=org"
by anonymous auth
by self write
by users read
access to *
by anonymous auth
by self read
by users read

# Indices to maintain for this database
index objectClass eq,pres
#index ou,cn,mail,surname,givenname eq,pres,sub
#index uidNumber,gidNumber,loginShell eq,pres
#index uid,memberUid eq,pres,sub
#index nisMapName,nisMapEntry eq,pres,sub

Make user that /etc/openldap/slapd.conf is owned by ldap and has write permissions for ldap user.

As of now I prefer openldap using slapd.conf and not slapd.d for configuration.

% sudo /bin/rm -r /etc/openldap/slapd.d

slapd Startup

My favourite method happens to be using djb's supervise and hence is one of the core compoment of the IndiMail package

% cat > /tmp/run1
#!/bin/sh
exec /usr/sbin/slapd -u ldap -f /etc/openldap/slapd.conf -d 0 2>&1
cntrl-d

% cat > /tmp/run2
#!/bin/sh
exec /var/indimail/bin/setuidgid qmaill \
/var/indimail/bin/multilog t /var/log/indimail/slapd.389
cntrl-d

# create /service/.slapd.389 so that svscan does not discover this new service yet
% sudo mkdir -p /service/.slapd.389/log
% sudo mv /tmp/run2 /service/.slapd.389/log/run
% sudo mv /tmp/run1 /service/.slapd.389/run
% sudo chmod +x /service/.slapd.389/run /service/.slapd.389/log/run

# rename .slapd.389 to slapd.389 for svscan to discover and start slapd
% sudo mv /service/.slapd.389 /service/slapd.389

% svstat /service/slapd.389
/service/slapd.389/: up (pid 4069) 4 seconds

AddressBook Entries

Information can be imported and exported into an LDAP directory service using the LDAP Data Interchange Format (LDIF) as defined in RFC2849. An LDIF file specifies the contents of a directory entry in a human readable text format, this allows quick manipulation of a file to re-import similar entries into the directory.

Now that the LDAP server has been configured and is running, we can conduct a simple search of the naming context to see our directory information before we start to import our entries.

The "namingContexts" should be similar to the example below.

% ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# extended LDIF
#
# LDAPv3
# base <> with scope base
# filter: (objectclass=*)
# requesting: namingContexts

dn:
namingContexts: dc=indimail,dc=org

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

The following LDIF file will create the hierarchical directory service structure that we will be using for indimail's address book. The first entry is that of the base directory and the second entry is for the Manager's (administrator) account. The last two entries are the two organisational units that we will use to store the authorised users (for adding security later) and the address book entries.

The bolded entries should be changed to suit your configuration requirements.

% cat > addressbook.ldif
# Domain entry
dn: dc=indimail,dc=org
o: IndiMail LDAP Server
dc: indimail
objectclass: dcObject
objectclass: organization

# Manager entry
dn: cn=Manager,dc=indimail,dc=org
cn: Manager
objectclass: organizationalRole

# Users
dn: ou=users,dc=indimail,dc=org
ou: users
objectClass: top
objectClass: organizationalUnit

# Addressbook entry
dn: ou=AddressBook,dc=indimail,dc=org
ou: AddressBook
objectClass: top
objectClass: organizationalUnit
cntrl-d

% ldapadd -x -D 'cn=Manager,dc=indimail,dc=org' -W -f addressbook.ldif
Enter LDAP Password:
adding new entry "dc=indimail,dc=org"
adding new entry "cn=Manager,dc=indimail,dc=org"
adding new entry "ou=users,dc=indimail,dc=org"
adding new entry "ou=addressbook,dc=indimail,dc=org"

The following LDAP search is requesting a listing of all entries starting from the base "dc=indimail,dc=org". This should return all of the entries that where added in the previous step.

% ldapsearch -x -b 'dc=indimail,dc=org' '(objectclass=*)'

# indimail.com
dn: dc=indimail,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: Home LDAP Network
dc: indimail

# Manager, indimail.com
dn: cn=Manager,dc=indimail,dc=org
objectClass: organizationalRole
cn: Manager

# users, indimail.com
dn: ou=users,dc=indimail,dc=org
ou: users
objectClass: top
objectClass: organizationalUnit

# addressbook, indimail.com
dn: ou=addressbook,dc=indimail,dc=org
ou: addressbook
objectClass: top
objectClass: organizationalUnit

Now that we have defined and imported our directory scheme, we are able to create user entries to populate the addressbook. The following is a simple example LDIF entry for a contact.

You can gain use slappasswd to generate a user password

% slappasswd -h {MD5} -s manny
{MD5}j+eKwOqr8vR0sN46lo4WXg==

The first line (dn:) designates where about in the directory the entry will belong when its imported, this should be changed to suit your needs.

% cat > newcontact.ldif
dn:uid=mbhangui,ou=addressbook,dc=indimail,dc=org
uid: mbhangui
cn: Manvendra Bhangui
gn: Manvendra
sn: Bhangui
o: Consim Info Pvt. Ltd.
l: Mandaivelli
street: #94 Coconut Republic
st: TN
postalCode: 600028
pager: +91 44 5555 1111
homePhone: +91 44 5555 1234
telephoneNumber: +91 44 5555 1235
facsimileTelephoneNumber: +91 44 5555 1236
mobile: +91 99401xxxxx
mail: m.bhangui@gmail.com
objectClass: top
objectClass: inetOrgPerson
userPassword: {MD5}j+eKwOqr8vR0sN46lo4WXg==
cntrl-d

The contents of the LDIF file can be added into the directory service using the "ldapadd" command below.

% ldapadd -x -D 'cn=Manager,dc=indimail,dc=org' -W -f newcontact.ldif
Enter LDAP Password:
adding new entry "uid=mbhangui,ou=addressbook,dc=indimail,dc=org"

If you do not require an address book and just require a basic user object to use for authenticaton, a basic user object can be created and imported into the LDAP server. This file uses the "UID" (User ID) string to distinguish the object and the contents are all that we need to create a basic authentication mechanism.

It should also be noted that this object is stored in the "users" organisational unit, which is located outside of the address book directory.=

% cat > useraccount.ldif
dn:uid=postmaster,ou=users,dc=indimail,dc=org
uid: postmaster
userPassword: {MD5}j+eKwOqr8vR0sN46lo4WXg==
objectClass: top
objectClass: account
objectClass: simpleSecurityObject
cntrl-d

% ldapadd -x -D 'cn=Manager,dc=indimail,dc=org' -W -f useraccount.ldif
Enter LDAP Password:
adding new entry "uid=postmaster,ou=users,dc=indimail,dc=org"

For mbhangui to authenticate to the server, one needs to pass
"uid=mbhangui,ou=users,dc=indimail,dc=org" as username along with the the plain text value of password, the hashed value is only for storage purposes.

% ldapsearch -x -b 'ou=AddressBook,dc=indimail,dc=org' \
-D "uid=mbhangui,ou=users,dc=indimail,dc=org" '(objectclass=*)' \
-s sub -w manny

Backing up LDAP Database

To export
% sudo /var/indimail/bin/svc -d /service/slapd.389
% slapcat -vl /etc/openldap/backup_slapd.ldif
% sudo /var/indimail/bin/svc -u /service/slapd.389

To import
% sudo /var/indimail/bin/svc -d /service/slapd.389
% slapadd -vl /etc/openldap/backup_slapd.ldif
% chown ldap.ldap /var/lib/ldap/*
% sudo /var/indimail/bin/svc -u /service/slapd.389

Email Client Settings

The last steps in setting up the shared address book is to configure the users email clients to access the LDAP server.

The following table contains some of the information needed to configure the client applications. Note the username will need to be written as the complete "distinguished name" value so the server knows which object to authenticate.

LDAP Server : your_host_IP:389
Search Base : ou=addressbook,dc=indimail,dc=org
Login Method : use distinguished name (if listed)
Username : uid=user,ou=addressbook,dc=indimail,dc=org
Password : As entered in newcontact.ldif file (plain text version)
Secure Connection: Never (unless encryption has been configured)

In the above 'user' is the actual user created in ldap by using ldapadd

References

Mini IndiMail Installation

noreply@blogger.com (cprogrammer) — Fri, 21 May 2010 02:09:00 +0000

IndiMail 1.7.3 comes with option in svctool to install QMQP service. IndiMail 1.7.5 will come with RPM package indimail-mini which will allow you to install a mini indimail installation. A mini indimail installation comes up with a bare minimum list of programs to enable you to send out mails. A indimail-mini installation doesn't have a mail queue. Instead it gives each new message to a central server through QMQP.

Many of my friends run web servers which need to send out emails. If you already have an installation of IndiMail messaging server on your network, you can quickly setup a mini indimail installation on your web server, without impacting the performance by using QMQP. To use QMQP service, you need to have QMQP service running on your IndiMail messaging server. All other servers (including your webservers) can have a indimail-mini installation.

How do I set up a QMQP service?

You need to have at least one host on your network offering QMQP service to your clients. IndiMail includes a QMQP server, qmail-qmqpd. Here's how to set up QMQP service to authorized client hosts on your IndiMail messaging server.

first create /var/indimail/etc/tcp.qmqp in tcprules format to allow queueing from the authorized hosts. make sure to deny connections from unauthorized hosts. for example, if queueing is allowed from 1.2.3.*:

1.2.3.:allow
:deny

Then create /var/indimail/etc/tcp.qmqp.cdb:

% sudo /var/indimail/bin/tcprules /var/indimail/etc/tcp.qmqp.cdb \
/var/indimail/etc/qmqp.tmp < /var/indimail/etc/tcp.qmqp

You can change /var/indimail/etc/tcp.qmqp and run tcprules again at any time. Finally qmail-qmqpd to be run under supervise:

% sudo /var/indimail/sbin/svctool --qmqp=628 --servicedir=/service \
--qbase=/var/indimail/queue --qcount=5 --qstart=1 \
--cntrldir=control --localip=0 \
--maxdaemons=75 --maxperip=25 --fsync --syncdir \
--memory=104857600 --min-free=52428800

628 is the TCP port for QMQP.

How do I install indimail-mini?

A indimail-mini installation is just like a indimail installation, except that it's much easier to set up:

* You don't need MySQL

* You don't need /var/indimail/alias. A indimail-mini installation doesn't do any local delivery.

* You don't need indimail entries in /etc/group or /etc/passwd. indimail-mini runs with the same privileges as the user sending mail; it doesn't have any of its own files.

* You don't need to start anything from your boot scripts. indimail-mini doesn't have a queue, so it doesn't need a long-running queue manager.

* You don't need to add anything to inetd.conf. A null client doesn't receive incoming mail.

Here's what you do need:

* qmail-qmqpc, forward, qmail-inject, sendmail, predate, datemail, mailsubj, qmail-showctl, maildirmake, maildir2mbox, maildirwatch, qail, elq, and pinq in /var/indimail/bin;

* a symbolic link to qmail-qmqpc from /var/indimail/bin/qmail-queue;

* symbolic links to /var/indimail/bin/sendmail from /usr/sbin/sendmail and /usr/lib/sendmail (for Fedora see the topic on /usr/sbin/alternatives below)

* all the manual pages in /var/indimail/man;

You can install all the above by manually copying the binaries and man pages from a host having standard IndiMail installation or you can using the indimail-mini RPM

% sudo rpm -ivh indimail-mini-1.7.5-1.1.i386.rpm

Apart from the binaries, you need to do the following

* a list of IP addresses of QMQP servers, one per line, in /var/indimail/control/qmqpservers;

* a copy of /var/indimail/control/me, /var/indimail/control/defaultdomain, and /var/indimail/control/plusdomain from your central server, so that qmail-inject uses appropriate host names in outgoing mail; and

* this host's name in /var/indimail/control/idhost, so that qmail-inject generates Message-ID without any risk of collision.

Everything can be shared across hosts except for /var/indimail/control/idhost.

Remember that users won't be able to send mail if all the QMQP servers are down. Most sites have two or three independent QMQP servers.

Note that users can still use all the qmail-inject environment variables to control the appearance of their outgoing messages.

Fedora - Using /usr/sbin/alternatives
Sometimes two or more Fedora package exist that serve the same purpose. The alternatives system provides a mechanism for selecting an active default application from several valid alternatives. You can use the alternatives system to configure as an alternative MTA for your system. Using alternatives, you don't have to create the links to /var/indimail/bin/sendmail manually as instructed above.

% sudo /usr/sbin/alternatives --install \
/usr/sbin/sendmail mta /var/indimail/bin/sendmail 120 \
--slave /usr/share/man/man8/sendmail.8.gz mta-sendmailman \
/var/indimail/man/man8/qmail-inject.8.gz \
--slave /usr/lib/sendmail mta-sendmail \
/var/indimail/bin/sendmail
/usr/sbin/alternatives --set mta /var/indimail/bin/sendmail

You can download IndiMail at
http://sourceforge.net/projects/indimail/

The RPM can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/

NOTE: This document is based on 'Installing min-qmail' by djb

Instant Mail to domains added by vadddomain

noreply@blogger.com (cprogrammer) — Sun, 02 May 2010 05:30:00 +0000

IndiMail has a program called vbulletin using which you can instantly email all your subscribers in a domain that has been created using vadddomain. Whenever an authentication requests comes to IndiMail through POP3, IMAP or authenticated SMTP, a hook called Login_Tasks gets called. One of the job that Login_Tasks does is to look for a file, in RFC822 format, with ",all" in the end of the filename. If such a file is found, it is copied to the user's Maildir. By using the timestamp of the original file, Login_Tasks also ensures that the file is copied once only.

The good thing about using bulletins is that the email is available instantly to all users. No queues, no delays and a huge saving of system resources.

You can manually copy the file to /var/indimail/control/domain_name/bulk_mail directory or use the vbulletin command

% vbulletin -f /tmp/new_offers.eml -a example.com

vbulletin is especially useful when you want to target a subsection of your users or when you have large number of mail delivery hosts in an IndiMail cluster.

Read the man page vbulletin(1) for more details

Spam Control using badip control file

noreply@blogger.com (cprogrammer) — Thu, 29 Apr 2010 06:48:00 +0000

IndiMail has many methods to help deal with spam. For detecting spam, IndiMail uses bogofilter a fast bayesian spam filter. IndiMail's qmail-smtpd which provides SMTP protocol is neatly integrated with bogofilter. When bogofilter detects spam, qmail-smtpd prints the X-Bogosity header as part of SMTP transaction log

% grep "X-Bogosity, Yes" /var/log/svc/smtpd.25/current

@400000004bc8183f01fcbc54 qmail-smtpd: pid 16158 from ::ffff:88.191.35.203 HELO X-Bogosity: Yes, spamicity=0.999616, cutoff=9.90e-01, ham_cutoff=0.00e+00, queueID=6cs66604wfk,

The value "Yes" in X-Bogosity indicates spam. You can tell qmail-smtpd to reject such mails at SMTP just by doing

# echo 1 > /service/qmail-smtpd.25/variables/REJECTSPAM
# svc -d /service/qmail-smtpd.25
# svc -u /service/qmail-smtpd.25

SMTP clients which tries to send a spam mail will get the following error at the end of the SMTP transaction

554 SPAM or junk mail threshold exceeded (#5.7.1)

The mail will get bounced. In some cases you would want to issue temporary error to such clients. In the above SMTP transaction log, the IP address of the client was 88.191.35.203. To put such client's into IndiMail's SPAM blacklist, you just need to put the IP address in the control file /etc/indimail/control/badip

# echo 88.191.35.203 >> /etc/indimail/control/badip

For turning on the BADIP functionality, you need to set the BADIPCHECK or the BADIP environment variable. i.e.

# echo badip > /service/qmail-smtpd.25/variables/BADIP
# svc -d /service/qmail-smtpd.25
# svc -u /service/qmail-smtpd.25

Clients whose IP match an entry in badip will be greeted as below

421 indimail.org sorry, your IP (::ffff:88.191.35.203) is temporarily denied (#4.7.1)

Also the client will not be able to carry out any SMTP transactions like ehlo, MAIL FROM, RCPT TO, etc
A large ISP can run the following command every day once in cron

grep "X-Bogosity, Yes" /var/log/svc/qmail.smtpd.25/current > /etc/indimail/control/badip

If your badip files becomes very large, you can also take advantage of IndiMail's ability to use cdb (or you could use MySQL too)

% sudo /usr/bin/qmail-cdb badip

Web Administration for IndiMail

noreply@blogger.com (cprogrammer) — Mon, 26 Apr 2010 02:52:00 +0000

I always find using the web ugly. It is a pain using the mouse almost all the time to do anything. One of the reasons I have never focussed on building a web administration tool for Indimail.

Lately my users have been pestering me if something can be done about it. I have no knowledge of web scripting, etc. But using some bit of common sense, I have managed to make qmailadmin work with IndiMail by modifying the source code (lucky for me, they are written in C).

For the admin user it provides

user addition
user deletion
password change
adding autoresponders
deleting autoresponders
modifying autoresponders
adding forwarding addresses
deleting forwarding addresses
modifying forwarding addreses
quota modification

For users other than the postmaster account it provides

Password change
add/modify/delete forwarding addresses
add/modify/delete autoresponder

iwebadmin can be downloaded from
http://sourceforge.net/projects/indimail/files/iwebadmin

The RPM / Yum Repo file can be downloaded from
http://software.opensuse.org/download.html?project=home:indimail&package=iwebadmin

You can download IndiMail at
http://sourceforge.net/projects/indimail/

The RPM can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/

After installation, you just need to go to http://127.0.0.1/cgi-bin/iwebadmin
The image assets get installed in /var/www/html/images/iwebadmin
The html assets get installed in /var/indimail/share/iwebadmin

The screen shots are below

Post Handle

noreply@blogger.com (cprogrammer) — Sat, 24 Apr 2010 13:45:00 +0000

IndiMail provides a handle post successful operation of few programs. A post execution handle is a program with the same name as that of the calling program but in the directory /usr/libexec/indimail. On successful completion, such programs will execute the handle program and return the status of the called handle program.
In my experience of setting up mail servers in the corporate world, often it is required that users be added to external databases which could be part of some strange enterprise applications. It could be as simple as adding users to your ldap server when creating a mailbox on IndiMail. Sometimes it could be as bad as adding users to ADS (ugh).
IndiMail (release 1.6.9 onwards) provides you a hook, to execute any program after successful completion of the programs, vadddomain, vaddaliasdomain, vdeldomain, vadduser and vdeluser, vrenamedomain, vrenameuser, vmovuser, vpasswd.
A hook can be defined by creating a script or an executable in /usr/libexec/indimail with the name of the program being executed. e.g. if you create a script named vadduser in the directory /usr/libexec/indimail, the script will get executed whenever the program vadduser is used to add a user to indimail. The execution happens only if the program completes successfully. Depending on what you need to do, you can customize the scripts in a jiffy.
The hook script name can be overridden by setting the POST_HANDLE environment variable.
See the man pages of vadddomain, vaddaliasdomain, vdeldomain, vadduser, vmoduser, vmoveuser, vdeluser, vrenamedomain, vrenameuser, vpasswd.
for more details.
Let me know if you create an interesting script.
Example of using a handle is when adding a user, you want vuserinfo to be run.

% cat /var/indimail/libexec/vadduser
exec /var/indimail/bin/vuserinfo $1

If you have the above, then this is what will happen when you add a user

% sudo /var/indimail/bin/vadduser test05@example.com
New IndiMail password for test05@example.com:
Retype new IndiMail password:
name : test05@example.com
passwd : $1$awb5a5oV$/3rsmlKSu.wzwIFhBzMf7/ (MD5)
uid : 1
gid : 0
-all services available
gecos : test05
dir : /home/mail/T2Zsym/example.com/test05 (missing)
quota : 5242880 [5.00 Mb]
curr quota : 0S,0C
Mail Store IP : 192.168.1.100 (Clustered - local)
Mail Store ID : 1000
Sql Database : 192.168.1.100:indimail:ssh-1.5-
Table Name : indimail
Relay Allowed : NO
Days inact : 0 days 00 Hrs 00 Mins 00 Secs
Added On : ( 127.0.0.1) Sat Apr 24 19:49:06 2010
last auth : Not yet logged in
last IMAP : Not yet logged in
last POP3 : Not yet logged in
PassChange : Not yet Changed
Inact Date : Not yet Inactivated
Activ Date : ( 127.0.0.1) Sat Apr 24 19:49:06 2010
Delivery Time : No Mails Delivered yet / Per Day Limit not configured

I personally use post execution handle for adding some mandatory users every time I add a new domain. So this is what my vadddomain handle looks like

% cat /var/indimail/libexec/vadddomain
/var/indimail/bin/vdominfo $1
/var/indimail/bin/valias -i '&register-spam' register-spam@$1
/var/indimail/bin/valias -i '&register-ham' register-ham@$1
/var/indimail/bin/valias -i '&spam' spam@$1
/var/indimail/bin/valias -i '&ham' ham@$1
/var/indimail/bin/vadduser -e prefilt@$1 xxxxxxxx
/var/indimail/bin/vadduser -e postfilt@$1 xxxxxxxx
/var/indimail/bin/vcfilter -i -t spamFilter -c 3 -k "Yes, spamicity=" -f Spam -b 0 -h 33 prefilt@$1
/bin/ls -dl /var/indimail/domains/$1
/bin/ls -al /var/indimail/domains/$1
exit 0