This is HOWI so you may find out HOWTO

sudo dpkg-reconfigure clamav-base

There are a number of questions to answer here, The options below are the ones that I changed or needed a mention. The rest I used the defaults

Now that keeps the virus-DB upto date but not the engine. To keep the engine up to date is some what harder. I used the following to get a more up to date version of clamav. This worked for a while and then I received a broken package and had to go digging into the use of aptitude. https://help.ubuntu.com/community/ClamAV

Testing that Calmav is working is simple once you get a virus you can email around. Don't panic the test virus will not do anything, harmful in fact it won't do anything at all. Go to the following link and have a read

http://www.eicar.org/anti_virus_test_file.htm

Copy the string 68 characters and save them to a file. Now attach the file to an email and send it. You SHOULD see some lines in the mail.log that indicate that the file was infected. Also try out the same text file but packed in an archive, tar, zip or compressed file .gzip, tgz zip.

AVG Free Anti-Virus

Download the latest binaries from AVG http://free.avg.com/us-en/download

On 64-bit systems you will need to install the 32 bit compatibility libs and to use the '--force-architecture' switch.

The above installs the software into /opt/avg/avg8

AVG Free via Amavis

AVG Free is already configured in the file "15-av_scanners, but to call any scanner you need to uncommented the bypass_spam line in 15-content_filter_mode.

In the above file you can squeeze a few extra milliseconds of speed by commenting out all the scanners you will not be using.


The people that use my mailserver are, actually sensible. There machines are also not on the same network as mine. 7| Therefore I do not quarantine mails that are marked as infected with a virus. They have their subject's updated to clearly show the mail is infected. This maens I also PASS infected mail on to their mail box for them to deal with.

Set the following parameters for communication via INET socket:

Updating AVG Free Engine and Database

Make the script executable by root so the daily cron can run it.

We can do the first update now so we can start with an upto date AV system.

Testing that AVG Free is working is simple once you get a virus you can email around. Don't panic the test virus will not do anything harmful in fact it won't do anything at all. Go to the following link and have a read

http://www.eicar.org/anti_virus_test_file.htm

Copy the string 68 characters and save them to a file. Now attach the file to an email and send it. You SHOULD see some lines in the mail.log that indicate that the file was infected. Also try out the same text file but packed in an archive or compressed file such as a tar or tar gzip file.

Postgrey

There are a number of ways to stop spam from reaching your inbox, we have already setup Amavis and Spamassassin to do some spam filtering. Grey-listing is not designed to replace this but to work with it. By providing a first hurdle for spam to get past before hitting your inbox. It is yet another tool in your arsenal against the endless barrage of pointless emails we all receive. Grey-listing is very simple and requires very little CPU or processing time. It simply looks at the senders name and if they are not known already, it politely says to them "Please try again later". For any well setup mail server this is not a problem and the mail will be redelivered later as requested. But for spammers that want to get as many emails out there as possible, they never bother to "try again later".

Installing Postgery

To install Postgrey is just a apt-get away with:

Configuring Postgrey

We need to tell postfix how to talk to postgrey. Add the following lines to your /etc/postfix/main.cf Postgey defaults to port 10023.

You can adjust some other settings. These are available in /etc/default/postgrey. There are also some white lists you can add to if you feel lucky.

This would be a good backup point! 
 

Apache Web server

Installing Apache

You should at this point be able to see a web page displayed that says "It works!" if you use the URL http://www.example.com Give it a try, it you do not see the test page from the Apache install then you'll need to sort that out before continuing.

When you stop and start your Apache server you may see an error message like the one below. Lets start by getting that sorted out.

Apache cannot work out the domain name of your server machnice or perhaps you simply do not have a domain name setup. Not to worry it is simple to fix. Edit /etc/apache2/apache2.conf add the ServerName option. Use the output from the Linux command hostname as the value. I add the line after ServerRoot. Then restart the Apache server and you are done. We should see the following forthe example server.

Add these lines to /etc/apache2/apache2.conf

Test that all is still well with the Apache configuration files with the following command. This is usful as if there are errors the server is left up and running in the pre-edit state. We can then use reload it take the changes into use without shutting down the server and bringing back up again. On a live server this is less likely to be noticed that the restart.

Configuring Apache

You now have Apache serving pages locally on your LAN, but you also want to be able to access the same Web site via the Internet. With Apache it is simple, once you know how. We will setup Apache to serve web pages for a number of Domains by using the virtual hosts feature.


We will be using two different ports to access our web pages 80 the standard http port and the https port 443. We need to tell Apache these will be setup so add the lines below to /etc/apache2/apache2.conf anywhere before line towards the bottom that includes the files in sites-available. I tend to place then just after the ServerRoot and ServerName lines.

By using the'*' wild card we do not differentiate between different IP addresses we will only use the URL to guide us to the right virtual host.

Configure the Default Web Site

We will create the web site and index.html page that will be the fall back when there are no rules to use any other site. We will place it in /var/www/default for want of a better place. Start by changing the default web site config file.

Create the index page for the default site, Nothing to fancy at this point

We need to comment out one line in the following file it will remove the warning about unconfigured virtual host. Place a # at the start of the line for NameVirtualHost *:80.

Check the files are ok. Also from now on I will only mention to reload the Apache files and miss off the part to check in for errors. I assume you will do that bit yourself. It's been a lot of typing so far.

You should now be able you use the URL for mailserver, mailserver.example.com and example.com and even example.net and they all go to the default web page from above.

Setting up the example.com Virtual Host

Let us create the top level virtual host for example.com. This is similar to the default we created above, but hard codes a server name in the virtual host definition.

Create the index page for example.com site. No need to go too mad on this temporary marker page.

We will need to tell the Apache server that this new virtual site exists so we enable it. The enable command makes a symbolic link in sites-enabled back to sites-available.

Now test the syntax and reload the files when there are no errors.

Now you will see that example.com goes to the new virtual host whereas mailserver.example.com goes to the default host. You may have noticed the ServerName we used for this site was www.example.com and the we had aServerAlias of example.com. This means you can use either of those URLs to find this web site.

Rewrite URLs on the fly

One more little tweak to the example.com virtual host configuration file. We can get Apache to rewrite the URL so users will always see http://example.com even if the original URL was www.example.com.

We need to add three lines which will see if the URL matches and then rewrite it to something else as necessary. We will use this trick later on too for the HTTPS connection with Squirrelmail.

Before that can work we need to enable the rewrite module.

Do not forget to reload the changes, before tying this new feature out.

If you have more domains linking to this one Apache server you can set those you by repeating the process above that we used for example.com. All that is left is to add the Web site contents in the normal way starting at the temporary index.html.

This would be a good backup point! 
 

SquirrelMail

Installing SquirrelMail

When I install Squirrelmail I remove the American English dictionaries and replace then with er, um the English dictionaries, "Like what I speak" . You can do the same but install the dictionaries for your own language are required. These should automatically be configured by ispell. But if you use Firefox you already have access to the great feature of auto-spell checking as you type.

Configuring the Apache Server for SquirrelMail

You need make a link from SquirrelMail configuration to the Apache site-available directory.

The default supplied setup does not provide a secure connection between the client and the server. Communication between the web browser and the mail server will be in plain text, which is not good. We can run the connection over SSL (HTTPS) by enabling the ssl module and using the same self-signed certificates we are using for Dovecot. You can always generate another set if you want to. Also we can change the default URL to access the web mail server from one like these

It is much better to provide our users with something that is easier to remember. The Apache setup for this web service is already designed to run as virtual hosts and that allows us to access Squirrelmail with a URL such as

We can also use the Apache mod_rewrite module to rewrite the URL we use to access Squirrelmail so that it will always access the web interface through HTTPS. First we need to enable the Apache modules for ssl and rewrite.

Now to make some changes to the supplied Squirrelmail config file for Apache. There are a lot of changes so here is one that is ready to use. Change the domain name to suite your environment.

As we will be using a virtual host for webmail via HTTPS and the SSL keys we have are not for webmail.example.com the Apache server will warn us that the host name and the Common name (CN) are not the same. If we generate another pair of self-signed certificates with the corret CN. This warning is removed. You can of course use the same certificates as we used for dovecot and put up with the warnings.

Update the permissions and the owner of the private file as it will be read by the Apache server.

Now to enable your new Apache configuration for Sqiurellmail and then reload the Apache configuration.

With that all in place you should be able to access your mailserver via Squirrelmail with the test user, fred@example.com, and his password. The user will not have to remember to use HTTPS:// as we have told Apache to rewrite the URL to force the secure access. It is one less thing for the users to do so one less thing to get wrong

Configuring SquirrelMail

Load up the URL https://webmail.example.com/src/configtest.php in your web browser this will run the Squirrelmail test script and show any errors it finds there. You will most likely see an error message like the one below.

To turn these off edit the php.ini from found in /etc/php5/apache2 and search for "magic_quotes_gpc" and set it to off. This was the only offending setting that was turned on.

Make the changes and then restart the Apcahe server, yes you must restart it reloading will not bring the changes into action.

Now to configure Squirrelmail a little bit more. In a terminal start the configuration script for squirrel mail. Do not change anything to start with just have look around to get the idea of what is there.

Ok, you are back from looking at the Squirrelmail configuration.

Start with the D option for "D. Set pre-defined settings for specific IMAP Servers" and
set it to "dovecot" as that is what we are using.

Return to the main menu and select "2. Server Settings." Then using the 'A' and 'B' options to setup IMAP and SMTP settings. The settings below are the ones I am using.

We are also going to use the SQL DB as a backend to hold the address and preferences data. From the main menu select '9 databases' it is options 1 and 3 you should need to change. When the options are set it should look similar to this

Remember to save the settings before exiting and reload the Apache settings.

The Pear plugins are required to access the MySQL DB with Php. Checking pear is loaded and also that the DB access module and also the newer MDB2 modules are loaded. We do need both if you are going to be adding the plugin below. Start by making sure that the Pear libraries are installed.You get install this extra software with the following the commands below. Use the pear list command to see which packages are installed you need to to have:

Load up the URL https://webmail.example.com/src/configtest.php again in your web browser to check all is working as expected.

Testing Squirrel mail

From another machine test that you can send and receive emails with Squirrelmail. If the tests you did with Evolution or thunderbird worked this should be a simple case of send your test user an email from within Squirrelmail. Waiting a second and then seeing if it have arrived by clicking the "Check mail" link in Squirrelmail.

This would be a good backup point! 
 

Squirrelmail plugins

There are two plugins I like to use with Squirrelmail.

1. Change SQL password - Allows anyone to update their own password when logged into Squirrel mail.
2. Mail Aliases - Allow you to maintain your own aliases mappings.

Change Passwords plugin.

Download change_sqlpass (not change_mysqlpass) from the Squirrelmail web site. Also get the latest "Compatibility plugin". (This plugin requires the DB module from above). You will need that too!


Unzip the compatibility plugin somewhere safe, like /tmp so you can read the README and INSTALL instructions. When I installed the compatibility plugin, I simply had to

Now for change_sqlpass, remove the software you unzipped into /tmp and unzip the change_sqlpass tar/zip file. Again read the README and INSTALL file. Follow the instructions. This is what I had to do.

There are some small changes that needed to be made at this point. The first change sets the login parameters for the mysql DB. in the case below they are.

Save the changes you made and as this file has a password it should not be world readable so we change the group and permissions to suit.

Now we can run the squirrelmail config program and get the plugin taken into use.

Then navigate you way to the plugin selection screen. '8 Plugins'. Find change_pass on the list of available plugins and enter the number. It should change to the top of the screen under Installed plugins. Do not forget to save the changes before leaving the script. Load up Squirrelmail goto the options link and follow the link to change password.


Remove the software you unzipped into /tmp.

Adding the Mail Alias plugin

(This plugin requires the MDB2 modules from above). Download the mail_alias tar file from the Squirrelmail web site and unzip into /tmp. Read the README and INSTALL file. Follow the instructions. This is what I did.

The lines I changed in the config.php are these

Save the changes you made and as this file has a password it should not be world readable
so we change the group and permissions to suit.

Now we need to do some major surgery on the file functions.php. This is the script that reads and writes the new aliases. Search for the line that sets $sql_data, we need to remove the last parameter as shown below

Find the function heading add_db_alias_for_user scroll down to the select_search1 part and comment out the parts shown below.

Now do the same thing again in this function.

Lastly replace the function validate_email with this code. This is necessary as the function eregi has been deprieciated.

Save the changes you made and then run the configure script to add the plugin to SquirrelMail.

Then navigate you way to the plugin selection screen. '8 Plugins'. Find mail_alias on the list
of available plugins and enter the number. It should change to the top of the sceen under
Installed plugins. Load up Squirrelmail goto the options link and follow the link to Mail Alias.


Remove the software you unzipped into /tmp.

This would be a good backup point! 
 

UFW

Installing UFW

Configuring UFW

You have backed up your mailserver haven't you? This is where things can go wrong and panic really sets in.

We will be opening ports to allow access to mailserver and using port numbers. These port numbers come from /etc/services.

It is recommended that by default you deny all access to the server and then add rules to open ports and allow IP addresses through your firewall. If you are accessing your mailserver via an ssh connection, like I do then we need to make sure that connection stays open. We will therefore start the setup with a rule so we can access mailserver via ssh from one specific IP address and then enable UFW. This will stop all other traffic until we open the ports. I setup mailserver as a virtual machine on an Ubuntu box. The host system for the examples used in this part will have an IP address of say 192.168.0.22. Remember that the local LAN IP address for mailserver was 192.168.0.11.

If you try and connect from a machine other then 192.168.0.22 your connection request will timeout. This is good and shows we have climbed the first step Try accessing the test mail account from Evolution from a different machine. it will time out.


We need to allow the outside world access to the ports for POP3, IMAP, SMTP and web access and also the secure alternative to each. If we just add a rule to open those ports we are still open to brute force attacks. Where the hacker scum sends thousands of login attempts hoping one will allow entry. We can add a limiting option to make our firewall more secure. For instance what happens when (yes I did mean when not if) someone tries to hack your server. We can limit the number of login attempts from an individual IP address with one rule. Once enabled anyone trying to access your server six or more times in the last 30 seconds will be banned for one minute. All the connection attempts within that minute will be simply dropped.

The backup software I use is called BackupPC and it uses rsync to connect to the servers and workstations. Rsync sites on port 873. So I open that up to the local LAN.

You may have a few other services that need to connect from a specific machine (IP addreess) or you may want to open all ports from the local LAN. This is a security issue.

If you later see that IP 58.151.230.42 is trying to hack your server with repeated logins. It would be nice to deny all access to that IP address. But on problem with IPTABLES is that once access is granted with a rule it will not be removed again. for example we all ready granted access for SMPTS connections. To add the new deny rule for the scum hacker at 58.151.230.42. We need to addthe rule at the top of the list. Upto now we have just added them at the bottom. We can see the line number forthe existing rules witht he following command

We can then use the number to add a new rule. We want to add our rule to deny all access to the hacker as our new rule two. We can use the following command.

We then end up with the following output, note the new rule on line two.

Ports used by the mailserver

System Maintenance

When you are happy its working.

Turn off the extra logging

MySQL logging

Dovecot

Rotating log files

Something to think about is that these log files can grow to a large size rather quickly. If you add them to the logrotate configuration, they can be kept under some control.

Files we Updated or Modified

MySQL

/etc/mysql/my.cnf
$HOME/create_postfix_mysql_tables.sql

Postfix

/etc/postfix/mysql-virtual-mailbox-domains.cf
/etc/postfix/mysql-virtual-mailbox-maps.cf
/etc/postfix/mysql-virtual-alias-maps.cf
/etc/postfix/mysql-virtual-alias-maps-self.cf

/etc/postfix/main.cf
/etc/postfix/master.cf

Dovecot

/etc/dovecot/dovecot.conf
/etc/dovecot/dovecot-sql.conf

Amavis

/etc/amavis/conf.d/01-debian
/etc/amavis/conf.d/05-node_id
/etc/amavis/conf.d/15-av_scanners
/etc/amavis/conf.d/15-content_filter_mode
/etc/amavis/conf.d/50-user

Spamassassin

/etc/default/spamassassin
/etc/cron.daily/spamassassin

AVG Free

/etc/cron.daily/avgfree

Postgrey

/etc/postgrey/whitelist_clients
/etc/postgrey/whitelist_recipients

Apache

/etc/apache2/apache2.conf
/etc/apache2/ports.conf
/etc/apache2/sites-available/default
/etc/apache2/sites-available/example.com

Squirrelmail

/etc/apache2/sites-available/squirrelmail
/etc/php5/apache2/php.ini
/usr/share/squirrelmail/plugins/change_sqlpass/config.php
/usr/share/squirrelmail/plugins/mail_alias/config.php
/usr/share/squirrelmail/plugins/mail_alias/functions.php

Trouble shooting

Turn on logging

Postfix

For debugging the smpt service add a -v ti the smpt line in master.cf

Dovecot

If you get problem with authentication, try setting these in /etc/dovecot/dovecot.conf and then restart Dovecot

enable auth_debug setting. See http://wiki.dovecot.org/WhyDoesItNotWork

MySQL