GuidetoSettingupanewQmailServeronCentos5.

5
Background In2004Ihadtheneedandthoughtitwouldbeagreatchallengetosetupamailserverformysmallbusiness.After doingalotofreadingIsoonrealiseditwasnotasimplethingtodo,howeverwiththeguidanceoftheqmailrocks website,Imuddledmywaythroughandcreatedmyfirstmailserver.Sincethen,Ihavebuildafewmainlyusing Fedorahoweverin2008IdecidedtobuildaFreebsdversion(usingtheqmailrockssite).Thishasworkedwell howeverIhavedecidedtogobacktoFedora13formyserver.IthendecidedtotryCentos5.5. TheQmailrockssite(nowgone)wasveryoutofdateforFedorasoIthoughtIwouldusewhatknowledgeIhad gainedovertheyears(perhapsnotthatmuchcomparedtosomeoftheguruoutthere)andwriteanupdated versionformyself(ananyoneelsewhoisinterested).IfirstdidthiswithFedora12andhavenowsuccessfully completeditonFedora13andCentos5.5.IhaveusedtheLifewithqmailsiteaswellasreferencestotheold qmailrockssiteinfoandalotofreferencetoJohnSimpsonssiteandBillsgoodcleanemailsitetoachievethisand justmadechangeswherenecessaryforFedoraandCentos. ItakelittlecreditfortheinformationcontainedwithinthisdocumentIhavescavengedthebitsofinfoandputit togetherinordertobuildaworkingQmailserveronFedora13andCentos5.5.TherealheroshereareJohn Simpson,JohnBernstein,LifewithQmail,andmanyothers.IjustputittogetherusingtheKISSmethod(KeepIt SimpleStupid).Iamsuremyguidecanbeimproveduponhoweveritresultsinaworkingqmailsystem. Youwillneedtogotovariouswebsitesthroughoutthisguidetocheckandperhapsdownloadthelatestversionsof programsandplacetheminthe/downloads/qmrfolder.Ihaveputallthecurrentfilesrequiredtocompletethis installinoneziphowevernotsurewheretoputthisguideandthefilesasmypersonalsystemwouldnotcopewith thetraffic!!! Finally,IknowImaygetyelledat,butIbuildthisrunningasroot(unlesstoldnotto).Iamcertainlynoexpertjust anovicesoanysuggestedimprovementsetcwouldbeappreciated. Thereishowevernosupportforthisguide.Read,searchgoogle,lookinforumsandlearn.Helpyourself. Goodluck DaveDonnelly Onyournewsystem,ifyoufollowthisguide,youwillendupwith:
QmailpatchedwithJohnSimpsonslatest7.10patch Ucspitcp Daemontools Ezmlmidx Autoresponder Vpopmail5.4.30withonchange MkvalidrcpttoandMkauth Maildrop Dovecot Ucspissl Clamav Spamassassin Qmailscanner Qmailadmin Vqadmin Squirrelmail

Part 1 - Checklist 1. Make sure you have Centos installed. SELINUX is a huge problem with qmail and I had to firstly put it in permissive mode and then disable it altogether. I do however have a firewall on my router. Security is another topic. 2. Make sure you have the following (on your system) (Command line is rpm qa | grep pkgname) Eg rpm qa | grep php a. b. c. d. e. f. g. h. i. j. k. l. http php perl perl-suidperl gcc gcc-c++ mysql openssl openssl-devel wget Personally I use midnight commander so I also install mc patch

3. If any are missing, install them. For example, to install php, type: yum install php 4. Make sure you update your entire system with yum update after all this. I then run perl MCPAN e shell (and go with it) When you get cpan> type install Bundle::CPAN when you get it again, type install CDB_File Type exit when it comes up CPAN3> This last bit takes a while and you have to answer a few questions I just hit enter to accept the default Yes answers. This last bit is needed for Spamassassin.

Required Files to complete Setup Create a directory /downloads/qmr You need to go and get the required files which are currently hosted at ekrfs.com.au/qmr There are instructions for Fedora dont worry, the files are still the same although you will not use all of them. If the files are moved from that site, I should put a link as to where they are.

Part 2 - Run Script to create the necessary users etc for qmail install Run the following script to create all the necessary users and folders / files and also to patch qmail with John Simpsons latest patch (currently 7.10). You should go check that this is still the latest and if not, edit the script and download the latest patch.

cd /downloads/qmr/scripts/install ./qmr_install_with_jms1.script This script will: Make some necessary directories Create necessary users and groups Unpack qmail-1.03 and patch it with John Simpsons 7.10 patch Unpack ucspi-tcp and daemontools and put them in the correct places on the system Create logging directories and supervise script directories

Part 3 Install Qmail (with John Simpsons patches already done) Then go to the /qmail-1.03-jms1-7.10 directory. make man && make setup check Qmail is now installed but you still have a lot to do. When finished, type ./config-fast your.full.hostname For example ./config-fast dolphin.example.com.au eg ./config-fast jhl.com.au

# make clean We are now done getting qmail setup (for now)!

Part 4 Install ucspi-tcp cd /usr/src/qmail/ucspi-tcp-0.88 We must also patch this file. patch < /downloads/qmr/patches/ucspi-tcp-0.88.errno.patch It will say patching file error.h This is good! make && make setup check That is all for this. Now to install qmail

Part 5 Install Daemontools cd /package/admin/daemontools-0.76/src We must patch this file as well patch < /downloads/qmr/patches/daemontools-0.76.errno.patch It will say patching file error.h This is good! cd .. package/install Thats it.

Part 6 Install Ezmlm-idx cd /downloads/qmr tar zxvf ezmlm-idx-7.1.1.tar.gz cd ezmlm-idx-7.1.1 make && make setup

Part 7 Install Autorespond cd /downloads/qmr tar zxvf autorespond-2.0.5.tar.gz cd autorespond-2.0.5 make && make install

Part 8 Qmail-updater cd /var/qmail/supervise mkdir m 1755 qmail-updater mkdir m 755 qmail-updater/log cd qmail-updater/log cp /downloads/qmr/service-any-log-run run chmod 755 run cd .. cp /downloads/qmr/pipe-watcher pipe-watcher cp /downloads/qmr/update-qmail update-qmail cp /downloads/qmr/service-qmail-updater-run run

chmod 755 pipe-watcher update-qmail run The last step here is to link the qmail-updater directory in the /service directory so daemontools can run it. ln s /var/qmail/supervise/qmail-updater /service/ Wait a few seconds then run: svstat /service/qmail-updater /service/qmail-updater/log You should see output showing up for more than 3 seconds for both.

Part 9 Install Vpopmail with onchange First we need to install Skel cd ~vpopmail tar zxvf /downloads/qmr/skel.tgz chown R vpopmail:vchkpw skel chmod R 700 skel/ chmod 0600 skel/.qmail skel/mailfilter We want to install vpopmail with the onchange function enabled. The latest version is 5.4.33 currently. cd /downloads/qmr tar zxvf vpopmail-5.4.33.tar.gz cd vpopmail-5.4.33 ./configure --enable-logging=p --enable-onchange-script make install-strip If that all run without errors, vpopmail is configured and installed. Now we must get the onchange function working. cd /~vpopmail/etc cp /downloads/qmr/onchange onchange This is the script that vpopmail will execute when a user or domain is added or deleted from the system. You need to now set permissions: chown vpopmail:vchkpw ~vpopmail/etc/onchange chmod 750 ~vpopmail/etc/onchange chmod +x ~vpopmail/etc/onchange Now that the onchange script is in place we can test it with the qmail-updater log file. Open up another session (Ctrl+Alt+F2) and type tail f /service/qmail-updater/log/main/current Go back to the original session (ctrl+Alt+F1) and add a domain and user and you should see your log file in the other session change stuff goes in it.

cd ~vpopmail/bin ./vadddomain test.com.au ./vadduser [email protected] password If the log file fills up with stuff, congratulations. We need to make a slight modification to the vchkpw file to make it work with SMTP with ssl work. cd ~vpopmail/bin chmod 6711 vchkpw chown vpopmail:vchkpw vchkpw

Part 10 - Validrccptto and Auth We must then create the validrcptto and auth files which reside in /var/qmail/control. To do this, we use the mkvalidrcptto and mkauth scripts. cd /usr/local/bin wget http://qmail.jms1.net/scripts/mkvalidrcptto wget http://qmail.jms1.net/scripts/mkauth chmod 755 mkvalidrcptto mkauth Then we run the scripts: mkvalidrcptto c /var/qmail/control/validrcptto.cdb mkauth c /var/qmail/control/auth.cdb To test ps axww | grep readproctitle the output should be something like 0:0 read..service errors . . It will not be exactly this but similar!

Part 11 Install Maildrop You need maildrop aside from anything else, for qmail-scanner - which needs reformime. Before you install maildrop, you need to install pcre. Download the file to the qmr directory. Tar zxvf pcre-8.12.tar.gz cd /downloads/qmr/pcre-8.12 ./configure make

make install make clean Then cd /downloads/qmr tar xvf maildrop-2.5.2.tar.bz2 cd maildrop-2.5.2 ./configure --enable-maildrop-uid=root --enable-maildrop-gid=vchkpw make install clean

We now add logging options to maildrop. cd /var/qmail/supervise mkdir m 1755 maildrop-logger mkdir m 755 maildrop-logger/log cd maildrop-logger/log cp /downloads/qmr/service-any-log-run run chmod 755 run cd .. cp /downloads/qmr/log-maildrop log-maildrop cp /downloads/qmr/pipe-watcher pipe-watcher cp /downloads/qmr/maildrop-logger-run run chmod 755 pipe-watcher log-maildrop run touch /tmp/log-maildrop chown vpopmail:vchkpw /tmp/log-maildrop

Now we start the maildrop-logger service ln s /var/qmail/supervise/maildrop-logger /service/ Wait a bit then check svstat /service/maildrop-logger /service/maildrop-logger/log Again, it all should be running for more than 3 seconds

Part 12 Uninstall Sendmail To find out the version numbers to remove type rpm qa | grep sendmail Then /etc/rc.d/init.d/sendmail stop Then

rpm e nodeps sendmail-x.x.x rpm e nodeps sendmail-cf-x.x.x

(version number from results above) (version number from results above)

We now need to establist an artificial sendmail path or a symbolic link to Qmails sendmail. This is needed to ensure the whole system is able to send mail. ln s /var/qmail/bin/sendmail /usr/lib/sendmail ln s /var/qmail/bin/sendmail /usr/sbin/sendmail Thats it for this step.

Part 13 Install Dovecot Do not try to install any courier stuff as they do not support vpopmail any more. The latest stable version is dovecot-1.2.12. (I tried using the later version 2.0.11 but this did not work well.) cd /downloads/qmr tar xzf dovecot-1.2.12.tar.gz cd dovecot-1.2.12 cp /downloads/qmr/configure.dovecot configure.dovecot chmod 755 configure.dovecot ./configure.dovecot make make install There seems to be a few directories either weren't created, or were created with bad permissions. The following commands fixed the problems: mkdir -m 0755 /usr/local/var /usr/local/var/run /usr/local/var/run/dovecot chmod go=u-w /usr/local/share /usr/local/share/doc chmod -R go=u-w /usr/local/lib/dovecot /usr/local/libexec/dovecot /usr/local/share/doc/dovecot The next step is to create a new non-root userid which is used to process authentication requests. This command is specific to Linux, and will probably need to be adjusted for other systems. The idea is to create a userid which cannot log in, which has no valid shell, and has no home directory- one which, if somebody were to "hack" into it, wouldn't be able to do much. useradd -d /nohome -s /bin/false -c 'Dovecot user' dovecot ________________________________________ Configuring Dovecot Dovecot itself is configured using a single control file, which will is in /usr/local/etc/dovecot.conf When you install the software, it creates a dovecot-example.conf file in this directory, and the directions with the software tell you to rename or copy the file to dovecot.conf and then customize it.

There is a customised dovecot.conf file (thanks to John Simpson). Note that an invalid IP, so you will need to customize the file before using it- either that, or use the dovecot-example.conf file and build your own configuration. The first thing you'll need to do is adjust the "first_valid_uid" and "last_valid_uid" values in the file. Find the numeric uid of the vpopmail user... id -u vpopmail My result was 508 To copy the dovecot.conf file (mentioned above, then cd /usr/local/etc cp /downloads/qmr/dovecot.conf dovecot.conf chown root:root dovecot.conf If the IMAP servers will ONLY be used for vpopmail accounts, make sure both of these values are set to that number (in this case, 508.) Also make sure both lines are un-commented (i.e. remove the "#" in front of the "last_valid_uid" line.) ## Mail processes verbose_proctitle = yes first_valid_uid = 508 last_valid_uid = 508 You also need to change the ip addresses too your own. ssl_listen twice eg 192.168.1.6

Building the daemontools service(s) This shows how to set up a daemontools service which starts the main dovecot process, which will listen for incoming IMAP and/or POP3 connections as specified in the dovecot.conf file. On my server, all of my daemontools physical service directories are in the /var/qmail/supervise directory. Your own server may be different- the physical directory can be anywhere on the system, except within the "/service" directory itself. cd /var/qmail/supervise mkdir -m 0755 dovecot dovecot/log cd dovecot/log cp /downloads/qmr/service-any-log-run run chmod 0755 run cd .. cp /downloads/qmr/service-dovecot-run run chmod 0755 run Use your text editor of choice. Like the other "service-blah-run" scripts, this one consists of configuration variables at the top, followed by code to build the final command line, and then run it. The variables are:

 IP is the IP address you want to listen on. You can set it to "0" if you want it to listen on every IP attached to your system, however I don't normally recommend doing things that way. PORT is the TCP port number you want to listen on. The standard values are 143 for IMAP, 993 for SSL-IMAP, 110 for POP3, and 995 for SSL-POP3. I DO NOT RECOMMEND RUNNING NON-SSL POP3 OR IMAP SERVICES on any unsecured network (i.e. on the open Internet) because the authentication methods for both POP3 and IMAP involve sending the password across the wire in plain text. Remember, if some "bad person" happens to get one of your users' passwords, they not only have access to that user's email, they will probably have the ability to use that ID and password with an SMTP AUTH command, and use your server as a relay. MAX is the maximum number of concurrent connections allowed by this service. If this is blank, a default value of 40 will be used instead. ACCESS_CDB gives the name of a .cdb file made by tcprules, which controls which clients are and are not allowed to connect. Note that if you plan to use rules involving remote userids (very few people do, because they are so easily forged) you will need to remove the "R" from the options of tcpserver and/or sslserver within the script itself. SVC_LOGIN is the full pathname of the service you wish to run. Normally this will be "imap-login" or "pop3-login". IS_SSL should be set to a number greater than zero if this is to be an SSL-secured service. This tells the script to use sslserver instead of tcpserver, exports the CERTFILE variable (needed by sslserver), and adds a flag to the end of the command line which tells imap-login or pop3-login that the connection is already encrypted. CERTFILE should be set to the full pathname to the .pem file containing the server's encryption key. You can point this to the same servercert.pem file used by qmail-smtpd if you like. ________________________________________ Start up Dovecot This is just like starting up any other daemontools service - create a symlink from /service/something to the physical service directory, wait about ten seconds, and make sure it's running. ln -s /var/qmail/supervice/dovecot /service/ Wait about ten seconds... svstat /service/dovecot /service/dovecot/log /service/dovecot: up (pid 23841) 8 seconds /service/dovecot/log: up (pid 23843) 8 seconds As we have not yet set up the certfile, the service will not run properly. If you check the log file in /var/qmail/supervise/dovecot/log/main/current It will show an error about the certificate file. Fixing that is next

Part 14 Install UCSPI-SSL create Certificates Now we need to install ucspi-ssl so qmail will accept smtp connections with ssl.

cd /package tar zxvf /downloads/qmr/ucspi-ssl-0.70.tar.gz cd host/superscript.com/net/ucspi-ssl-0.70 Compile the package package/compile Run some tests: Note There are some fatal cypher errors and broken pipe errors only, that is ok ignore them. package/rts Install the package package/install That is that. Now we need to create the key: cd /var/qmail/control openssl req newkey rsa:1024 x509 nodes days 3650 out servercert.pem keyout servercert.pem Answer the questions and make sure the Common Name is the name of your mail server!! Now we give proper ownership chown root:nofiles servercert.pem The nofiles group is the group which qmaild belongs to. This combination of ownership and permissions allows qmail-smtpd to read the key but not change or delete it. chmod 640 servercert.pem cp servercert.pem clientcert.pem chown root:qmail clientcert.pem chmod 640 clientcert.pem

You can now go back and check that dovecot is working: svstat /service/dovecot /service/dovecot/log /service/dovecot: up (pid 23841) 8 seconds /service/dovecot/log: up (pid 23843) 8 seconds

Part 15 Finalise the qmail installation There is a bit in this but it is not too difficult. I have modified a script from the old qmailrocks site to suit Centos. To start with run a script which will:

1. Copy all the supervise scripts to their correct locations 2. Copy qmail.rc and qmailctl to the propper locations and create the necessary symbolic links. 3. Set all needed permissions on the supervise scripts Ok. To get things going: cd / downloads/qmr/scripts/finalise chmod 755 finalize_linux.script ./finalize_linux.script

Configuring Qmail

Now we will need to edit a few files to make them work on the new system for this new server. cd /var/qmail/supervise/qmail-pop3d We need to edit the run file. vi run (or mc or whatever editor) Change the mail server name (line 4 at the end) to your mail server. Eg mail.test.com.au /

cd /var/qmail/supervise/qmail-smtpd vi run IP=1.2.3.4 (change this to your ip address obviously) Port=25 (set the port number we will be listening on) SSL=0 (This says do not run an SSL-only service) FORCE_TLS=0 (Refuse to accept mail from clients who have not done STARTTLS) DENY_TLS=0 (Do not refuse to process the STARTTLS command) AUTH=0 (We are turning off auth on port 25 and only allow incomming mail) Require_Auth=0 (Refuse to accept mail from clients who have not done AUTH).

You must also uncomment the following line of the smtp run file or else no mail will be scanned by qmail scanner. Make it this: QMAILQUEUE=$VQ/bin/qmail-scanner-queue.pl Now we need to set up some qmail aliases. Replace [email protected] with the addres you want the mail to go to: echo [email protected] > /var/qmail/alias/.qmail-root echo [email protected] > /var/qmail/alias/.qmail-postmaster echo [email protected] > /var/qmail/alias/.qmail-mailer-daemon

Now we set up selective relaying.

mkdir /etc/tcp cd /etc/tcp cp /downloads/qmr/etc-tcp-makefile Makefile Now create the smtp file. Add your ip address. If your ip address was 192.168.1.1, then it will go like this: vi /etc/tcp/smtp Add the following to the new file: 192.168.1.:allow,RELAYCLIENT= :allow save this and then run: gmake You should get output saying tcprules smtp.cdb smtp.tmp < smtp chmod 644 smtp.cdb smtp

Setting up smtp with SSL We need to edit the file vi /var/qmail/supervise/qmail-smtpd-ssl/run Set the following values: IP=1.2.3.4 (change this to your own ip address obviously) Port=465 (set the port number we will be listening on) SSL=1 (This says to run an SSL-only service) FORCE_TLS=0 (Ignored for ssl services) DENY_TLS=0 (Ignored for ssl services) AUTH=1 (Allow the AUTH command) Require_Auth=1 (Refuse to accept mail from clients who have not done AUTH). You must also uncomment the following line of the smtp run file or else no mail will be scanned by qmail scanner. Make it this: QMAILQUEUE=$VQ/bin/qmail-scanner-queue.pl Save the file then Creating the smtpssl file cd /etc/tcp vi smtpssl in this new file, simply put the following and then save it. :allow

Now you need to edit the Makefile and add smtpssl.cdb after smtp.cdb, save and exit. Now run: gmake The final step is to start the service running: ln s /var/qmail/supervise/qmail-smtpd-ssl /service/ Now check that the service is running ok by: svstat /service/qmail-smtpd-ssl /service/qmail-smtpd-ssl/log As usual, if you see the output is up for more than 3 seconds, all is OK Now we want to start qmail: qmailctl start You should get output like: Starting qmail Starting qmail-send Starting qmail-smtpd Starting qmail-pop3d

To check to make sure it is running ok type: qmailctl stat As long as everything is up for more that say 3 seconds you have succeeded. Well done. That is all that finished. You could just operate a mail server with what you now have but lets install programs to make life much easier. For example, you could easily just manage all your mail accounts and domains with vpopmail. But using qmailadmin and vqadmin is much nicer and easier. Squirrelmail makes life easier for all your users as they can get their mail via a web browser. Clamav checks for viruses in mail and spamassassin gets rid of a lot of spam. Anyway lets get on with it..

Part 16 Install Spamassassin I have done this in two different ways both worked. You can compile from source then install or The simplist way is just use yum to install it: yum install spamassassin Then go and edit /etc/mail/spamassassin/local.cf All you have to put in this file is

required_score 3.2

(that is what I use)

And if you want you can create a whitelist of good known email addresses eg friends whitelist_from [email protected] Now to set it up under daemontools. mkdir m 1755 /var/qmail/supervise/spamd mkdir m 755 /var/qmail/supervise/spamd/log cd /var/qmail/supervise/spamd cp /downloads/qmr/spamd-run run chmod 755 run cd log cp /downloads/qmr/service-any-log-run run chmod 755 run All we need to do now is create the service: ln s /var/qmail/supervise/spamd /service/ Wait a bit then: svstat /service/spamd /service/spamd/log Again, make sure the service is up for more than say 3 seconds. If issues, try stopping the service then re start it. I also then type sa-update to update spamassassin

Thats it for spamassassin.

Part 17 - Install Clamav

For the first time install of Clamav, you need to create a new user and group to your system: groupadd clamav groupadd qscand useradd g clamav s /bin/false c Clam Antivirus clamav useradd g qscand s /bin/false c Qscand qscand Now you need to download Clamav from clamav.net. Get the latest stable version which is currently 0.97 cd /downloads/qmr wget http://downloads.sourceforge.net/clamav/clamav-0.97.tar.gz tar zxvf clamav-x.x.x.tar.gz cd clamav-x.x.x

./configure make make check make install make clean Now you need to create the clamd and freshclam service scripts. cd /var/qmail/supervise mkdir m 1755 clamd mkdir m 0755 clamd/log cd clamd cp /downloads/qmr/service-clamd-run run chmod 755 run cd log cp /downloads/qmr/service-any-log-run run chmod 755 run cd /var/qmail/supervise mkdir m 1755 freshclam mkdir m 0755 freshclam/log cd freshclam cp /downloads/qmr/service-freshclam-run run chmod 755 run cd log cp /downloads/qmr/service-any-log-run run chmod 755 run

Now we need to edit the clamd.conf file so it will run correctly via daemontools. chmod 744 /usr/local/etc/clamd.conf vi /usr/local/etc/clamd.conf (or type mc and use midnight commander if you like) #Example must be commented out #LogFile comment out #LogSysLog no comment out #PidFile /var/run/clamav comment out DatabaseDirectory /usr/local/share/clamav LocalSocket /tmp/clamd.socket uncomment this FixStaleSocket yes - optional User qscand Foreground yes this is absolutely required to run via daemontools chown R qscand:qscand /usr/local/share/clamav

Configuring freshclam The freshclam program checks for updated virus definition files and, if it finds them, downloads and installs them automatically. It then sends a message to clamd, telling it to read the new definitions into memory, and can also call another program that we specify. We will be using this "call another program" capability to inform qmail-scanner and/or simscan to update its version database, so the headers that they add to email messages will have accurate version numbers. To configure freshclam, we will edit a file called freshclam.conf, which will be found in the same directory where we found the clamd.conf file (above.) This is a list of the changes we need to make: chmod 744 /usr/local/etc/freshclam.conf vi /usr/local/etc/freshclam.conf (or use mc as above)

#Example comment out DatabaseDirectory /usr/local/share/clamav #UpdateLogFile comment out #LogSyslog no #Pidfile comment out DatabaseOwner qscand Foreground yes checks 24 Set up the services to start ln s /var/qmail/supervise/clamd /service/ ln s /var/qmail/supervise/freshclam /service/ Now check the services are running: svstat /service/clamd /service/clamd/log and then svstat /service/freshclam /service/freshclam/log make sure each is up for more than 3 seconds and all is ok. That is it for Clamav.

Part 18 Install Qmail-scanner The latest version (currently) is 2.08 cd /downloads/qmr tar zxvf qmailscanner-2.08 cd qmailscanner-2.08 cp /downloads/qmr/qms-config qms-config

Now you need to change the qms-config to match your settings. The bits in bold must be changed to your domain specific settings. If you have multiple domain names, in local-domains, separate them by a comma (no space). When you have made your changes, then make it executable and give it a test run: chmod 755 qms-config ./qms-config When it asks you Continue? ([Y] / [N]) go ahead and hit Y It will ask this twice. If all goes well you will get Finished. and a bit more without error messages. If the above worked, then you will need to actually install: ./qms-config install

Updating the qmail-scanner version files The first one is the command that updates your version files. It updates your headers when you upgrade ClamAV or SpamAssassin. It also helps keep the /var/spool/qscan folder clear when SMTP sessions are dropped. Put this one in a cron and run it once a day. setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl z Anytime you update qmail-scanner you should also run setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl g One final ownership check chown R qscand:qscand /var/spool/qscan

Testing Qmail-scanner Now before we finish, we need to test that it works. Make sure you have set up your main domain and email accounts (in particular the domain that you set the aliases to earlier) as these are where the test emails will go. Then run the following: /downloads/qmmr/qmail-scanner-2.0.8/contrib/test_installation.sh doit When this runs, it will send 4 messages 2 with viruses, one standard message and a piece of junk mail. So when this runs, you should have 1 in /var/spool/qscan/quarantine/viruses/new , 1 message in /var/spool/qscan/quarantine/policy/new , 1 message in ~vpopmail/domains/domainXXX/postmaster/Maildir/new and 1 in your ~vpopmail/domains/domainXXX/postmaster/Maildir/.Spam/new folder (or this will be in your maildir). All you need to do to finish is to restart qmail: qmailctl restart

Thats Qmail-scanner installed! Well done. Part 19 Install VqAdmin VqAdmin is a nice simple web based interface that lets us manage Vpopmail. You can create new domains, new users, net quotas and more. cd /downloads/qmr tar zxvf vqadmin-X.x.x cd vqadmin-X.x.x ./configure --enable-cgibindir=/var/www/cgi-bin --enable-htmldir=/var/www/html (If the paths above are not the same on your system, change them to match) make && make install-strip If the installation is successful, VqAdmin will install itself in the cgi-bin directory of your website. Now you need to edit your apache file (or httpd.conf file). vi /etc/httpd/conf/httpd.conf Now, on about line 325 (of mine anyway) you need to change it to AllowOverride ALL Also on about line 265, make sure your servername is defined. Insert (on mine I did it on line 575 but that does not really matter) <Directory /var/www/cgi-bin/vqadmin> deny from all Options ExecCGI AllowOverride AuthConfig Order deny,allow </Directory> Thats that bit done. cd /var/www/cgi-bin/vqadmin Now you need to create a .htaccess file to password protect the vqadmin interface. There should already be a .htaccess file in the vqadmin directory, so all you need to do is configure it. vi .htaccess AuthType Basic AuthUserFile /etc/httpd/conf/.htpasswd AuthName vQadmin require valid-user satisy any Now change ownership

(in fact you can put this wherever you like)

chown apache .htaccess chmod 644 .htaccess Now you need to create a corresponding .htpasswd file that will contain the username and encrypted password for the VqAdmin administrator. htpasswd bc /etc/httpd/conf/.htpasswd admin admin-password chmod 644 /etc/httpd/conf/.htpasswd Make sure you leave the user admin as admin else it wont work. Obviously the admin-password should be a password. Now we need to restart apache. apachectl stop apachectl start If all has gone well, in you web browser, put: http://www.yourdomain.com.au/cgi-bin/vqadmin/vqadmin.cgi Enter admin and whatever password you created and hey presto. You can now add domains, users etc. If errors, check permissions on vqadmin.cgi.

Part 19 Installing Qmailadmin This provides us with a nice web based interface for administering mail accounts once they are set up through Vpopmail or VqAdmin.
cd /downloads/qmr tar zxvf qmailadmin-X.xx.x cd qmailadmin-X.x.x ./configure --enable-cgibindir=/var/www/cgi-bin --enable-htmldir=/var/www/html --enable-modify-spam enable-ezmlm.idx make && make install-strip

Now to make sure when we add new users via qmailadmin that we want Spam Fighting turned on by default edit the following: vi /usr/local/share/qmailadmin/html/add_user.html find the line <input type=checkbox name=spamcheck> Change it to: <input type=checkbox name=spamcheck checked> That it for the install.

Now open your web browser and go to: http://www.yourdomain.com.au/cgi-bin/qmailadmin You all done here. Part 21 - install Squirrelmail. Squirrelmail is a web based program that allows you to access your email via a web browser. First you must check that you have PHP uploads turned on. vi /etc/php.ini The line you want to check / edit is: file_uploads = On Thats that. Now on to installing Squirrelmail. cd /var/www/html tar zxvf /downloads/qmr/squirrelmail-X.x.x.tar.gz Now rename the untared folder to something more friendly mv squirrelmail-X.x.x webmail Now we configure squirrelmail.. mkdir /var/local/squirrelmail mkdir /var/local/squirrelmail/data chown R apache:apache /var/local/squirrelmail/data cd webmail/config ./conf.pl This will run the squirrelmail setup scriot which allows you to customise the installation and set your server settings. Most of the important things are in area #2 which is called Server Settings. You will be presented with a menu. Under 1 - Organization Preferences, Any one of the setings inside this window are optional. When you are done, hit S to save and then hit Enter and then hit R to go back to the Main Menu. Now we want to go to 2 - Server settings. Hit 1 for Domain and hit Enter on the keyboard. You can type the name of the server or the local IP or public IP, whichever you prefer. If your mailserver is behind a router/firewall, I use the local IP. If you are on the public side of things, the hostname or the static IP will work fine. Under Server settings we want to use the following. Please change x.x.x.x to the IP of your mail server: 1. Domain : x.x.x.x 2. Invert Time : false 3. Sendmail or SMTP : Sendmail A. Update IMAP Settings : localhost:143 (other) B. Change Sendmail Config : /var/qmail/bin/sendmail

Hit Y and then hit Enter. Hit S to save and then hit Enter again. Hit Q to quit and exit the menu. If you like there are other features you can customise but not critical. Once you are done here, we must configure Apache to serve our new webmail interface. Open up the httpd.conf file and add the following down the bottom under Virtual Domains.. vi /etc/httpd/conf/httpd.conf <VirtualHost 1.2.3.4:80> Change to your ip ServerName mail.test.com.au ServerAlias mail.* ServerAdmin [email protected] DocumentRoot /var/www/html </VirtualHost>

Now all you need to do is restart apache apachectl stop apachectl start Now in your browser: http://www.yourdomain.com.au/webmail That is it. You now have a great qmail server with lots of useful extras. Now for Maintenance of everything we have set up

Part 22 notes on Changing and Maintaining your new Qmail Server Services To start, stop or restart a service (run under daemontools ie the ones in the /service directory): To stop svc d /service/name eg svc /-d /service/spamd To start svc u /service/name To restart svc t /service/name To check all your services at once svstat /service/* /service/*/log (u is for up) (d is for down) will stop spamd

Qmail-Scanner I wanted the subject line to be altered with spam messages. To do this, you need to edit the qmail-scannerqueue.pl file in /var/qmail/bin in this file on my system (line 258) says: my $spamc_subject=***Spam*** ; I set it to delete messages more than 5 over my limit of 3.2. You can edit this two lines below my $sa_quaratnine_over=5 ; This is all I did.

Update Clamav This would be the cause of most pain as it changes every 3 months or so. To see info about freshclam and if it is current type: freshclam -v Or you can look in the file /service/freshclam/log/main/current and see if clamav is outdated. It will say so in the log. To upgrade your clamav, go to the clamav site and download the latest stable source file: http://www.clamav.net/lang/en/download.sources Now download the latest and put it in your downloads directory. For example, to download 96.1 version, cd /downloads wget http://downloads.sourceforge.net/clamav/clamav-0.96.1.tar.gz tar zxvf clamav-0.96.1.tar.gz cd /clamav-0.96.1 I then backup the clamd.conf and freshclam.conf files to be sure. cd/downloads cp /usr/local/etc/freshclam.conf freshclam.conf cp /usr/local/etc/clamd.conf clamd.conf You must then stop qmail and clamav and also freshclam qmailctl stop svc d /service/clamd svc d /service/freshclam Now we start the upgrade: ./configure make make check

(This can take some time) (Same make sure the tests passed ie no errors)

make install make clean Check the conf files and if they are still the same (they should be unaltered). Start up the services again: qmailctl start svc u /service/clamd svc u /service/freshclam You must now update qmail-scanner database setuidgid /var/qmail/bin/qmail-scanner-queue.pl g and also update the version number setuidgid /var/qmail/bin/qmail-scanner-queue.pl z Now type freshclam v and you will see the new version number. Thats it for updating clamav. I just did this exactly and it worked perfectly on my system.

A Script I run to make sure things run smoothly

I created a file called daily-updates
#!/bin/sh PATH=/usr/local/bin:/usr/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/sbin sa-update svc -t /service/* /service/*/log setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -z setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -g

I set this to run in crontab daily

Other issues I have come across:

An error in a log file Unable to bind: address already used This error can be for a few qmail things but I will assume it is smtpd is not working. If you see this error message it means that another program has already bound to the address you are trying to bind. To solve this, stop the service and check it is actually stopped: svc d /service/qmail-smtpd svstat /service/qmail-smtpd

Now check to see if something is running on port 25 netstat an | grep 25 To see what: lsof n i:25 Now whatever that program is, you need to stop it and uninstall it. I had an example where the problem was Exim. I just: rpm e nodeps exim You then turn on smtpd again and check it is all ok. svc u /service/qmail-smtpd svstat /service/qmail-smtpd The output should say it is up for more than 3 seconds. Check your logs again and make sure all is ok with them.