Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (CentOS 5.3 x86_64)

Want to support HowtoForge? Become a subscriber!
 
Submitted by falko (Contact Author) (Forums) on Tue, 2009-05-12 16:52. :: Anti-Spam/Virus | CentOS | Postfix

Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (CentOS 5.3 x86_64)

Version 1.0
Author: Falko Timme <ft [at] falkotimme [dot] com>
Last edited 04/20/2009

This tutorial is Copyright (c) 2009 by Falko Timme. It is derived from a tutorial from Christoph Haas which you can find at http://workaround.org. You are free to use this tutorial under the Creative Commons license 2.5 or any later version.

This document describes how to install a Postfix mail server that is based on virtual users and domains, i.e. users and domains that are in a MySQL database. I'll also demonstrate the installation and configuration of Courier (Courier-POP3, Courier-IMAP), so that Courier can authenticate against the same MySQL database used by Postfix.

The resulting Postfix server is capable of SMTP-AUTH and TLS and quota (quota is not built into Postfix by default, I'll show how to patch your Postfix appropriately). Passwords are stored in encrypted form in the database (most documents I found were dealing with plain text passwords which is a security risk). In addition to that, this tutorial covers the installation of Amavisd, SpamAssassin and ClamAV so that emails will be scanned for spam and viruses. I will also show how to install SquirrelMail as a webmail interface so that users can read and send emails and change their passwords.

The advantage of such a "virtual" setup (virtual users and domains in a MySQL database) is that it is far more performant than a setup that is based on "real" system users. With this virtual setup your mail server can handle thousands of domains and users. Besides, it is easier to administrate because you only have to deal with the MySQL database when you add new users/domains or edit existing ones. No more postmap commands to create db files, no more reloading of Postfix, etc. For the administration of the MySQL database you can use web based tools like phpMyAdmin which will also be installed in this howto. The third advantage is that users have an email address as user name (instead of a user name + an email address) which is easier to understand and keep in mind.

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

 

1 Preliminary Note

This tutorial is based on CentOS 5.3 x86_64, so you should set up a basic CentOS 5.3 server installation before you continue with this tutorial (e.g. as shown in the first six chapters of The Perfect Server - CentOS 5.3 x86_64). The system should have a static IP address. I use 192.168.0.100 as my IP address in this tutorial and server1.example.com as the hostname.

You should make sure that the firewall is off (at least for now) and that SELinux is disabled (this is important!).

I tested this setup on an x86_64 system. The setup should be similar or maybe even identical for an i386 system, but I didn't test it.

 

2 Install Some Software

First we update our existing packages on the system:

yum update

Now we install some software that we need later on:

yum groupinstall 'Development Tools'

yum groupinstall 'Development Libraries'

 

3 Install Apache, MySQL, phpMyAdmin

First we enable the RPMforge repository on our CentOS system as lots of the packages that we are going to install in the course of this tutorial are not available in the official CentOS 5.3 repositories:

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm
rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

Afterwards we can install the needed packages with one single command (including the packages we need to build Courier-IMAP):

yum install ntp httpd mysql-server php php-mysql php-mbstring rpm-build gcc mysql-devel openssl-devel cyrus-sasl-devel pkgconfig zlib-devel phpmyadmin pcre-devel openldap-devel postgresql-devel expect libtool-ltdl-devel openldap-servers libtool gdbm-devel pam-devel gamin-devel

 

4 Install Courier-IMAP, Courier-Authlib, And Maildrop

Unfortunately there are no rpm packages for Courier-IMAP, Courier-Authlib, and Maildrop, therefore we have to build them ourselves.

RPM packages should not be built as root; courier-imap will even refuse to compile if it detects that the compilation is run as the root user. Therefore we create a normal user account now (falko in this example) and give him a password:

useradd -m -s /bin/bash falko
passwd falko

We will need the sudo command later on so that the user falko can compile and install the rpm packages. But first, we must allow falko to run all commands using sudo:

Run

visudo

In the file that opens there's a line root ALL=(ALL) ALL. Add a similar line for falko just below that line:

[...]
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
falko   ALL=(ALL)       ALL
[...]

Now we are ready to build our rpm package. First become the user falko:

su falko

Next we create our build environment:

mkdir $HOME/rpm
mkdir $HOME/rpm/SOURCES
mkdir $HOME/rpm/SPECS
mkdir $HOME/rpm/BUILD
mkdir $HOME/rpm/BUILDROOT
mkdir $HOME/rpm/SRPMS
mkdir $HOME/rpm/RPMS
mkdir $HOME/rpm/RPMS/i386
mkdir $HOME/rpm/RPMS/x86_64

echo "%_topdir $HOME/rpm" >> $HOME/.rpmmacros

Now we create a downloads directory and download the source files from http://www.courier-mta.org/download.php:

mkdir $HOME/downloads
cd $HOME/downloads

wget http://prdownloads.sourceforge.net/courier/courier-authlib-0.62.2.tar.bz2
wget http://prdownloads.sourceforge.net/courier/courier-imap-4.4.1.tar.bz2
wget http://prdownloads.sourceforge.net/courier/maildrop-2.0.4.tar.bz2

Now (still in $HOME/downloads) we can build courier-authlib:

sudo rpmbuild -ta courier-authlib-0.62.2.tar.bz2

After the build process, the rpm packages can be found in $HOME/rpm/RPMS/x86_64 ($HOME/rpm/RPMS/i386 if you are on an i386 system):

cd $HOME/rpm/RPMS/x86_64

The command

ls -l

shows you the available rpm packages:

[falko@server1 x86_64]$ ls -l
total 608
-rw-r--r-- 1 root root 139732 Apr 20 15:25 courier-authlib-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root 328468 Apr 20 15:25 courier-authlib-debuginfo-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root  35327 Apr 20 15:25 courier-authlib-devel-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root  18307 Apr 20 15:25 courier-authlib-ldap-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root  14497 Apr 20 15:25 courier-authlib-mysql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root  13711 Apr 20 15:25 courier-authlib-pgsql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root   8361 Apr 20 15:25 courier-authlib-pipe-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root root  35285 Apr 20 15:25 courier-authlib-userdb-0.62.2-1.x86_64.rpm
[falko@server1 x86_64]$

Select the ones you want to install, and install them like this:

sudo rpm -ivh courier-authlib-0.62.2-1.x86_64.rpm
sudo rpm -ivh courier-authlib-devel-0.62.2-1.x86_64.rpm
sudo rpm -ivh courier-authlib-mysql-0.62.2-1.x86_64.rpm

Now we go back to our downloads directory:

cd $HOME/downloads

and run rpmbuild again, this time without sudo, otherwise the compilation will fail because it was run as root:

rpmbuild -ta courier-imap-4.4.1.tar.bz2

After the build process, the rpm packages can be found in $HOME/rpm/RPMS/x86_64 ($HOME/rpm/RPMS/i386 if you are on an i386 system):

cd $HOME/rpm/RPMS/x86_64

The command

ls -l

shows you the available rpm packages:

[falko@server1 x86_64]$ ls -l
total 1920
-rw-r--r-- 1 root  root  139732 Apr 20 15:25 courier-authlib-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root  328468 Apr 20 15:25 courier-authlib-debuginfo-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   35327 Apr 20 15:25 courier-authlib-devel-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   18307 Apr 20 15:25 courier-authlib-ldap-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   14497 Apr 20 15:25 courier-authlib-mysql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   13711 Apr 20 15:25 courier-authlib-pgsql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root    8361 Apr 20 15:25 courier-authlib-pipe-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   35285 Apr 20 15:25 courier-authlib-userdb-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 falko falko 391473 Apr 20 15:37 courier-imap-4.4.1-1.x86_64.rpm
-rw-r--r-- 1 falko falko 939716 Apr 20 15:37 courier-imap-debuginfo-4.4.1-1.x86_64.rpm
[falko@server1 x86_64]$

You can install courier-imap like this:

sudo rpm -ivh courier-imap-4.4.1-1.x86_64.rpm

Now we go back to our downloads directory:

cd $HOME/downloads

and run rpmbuild again, this time to build a maildrop package:

sudo rpmbuild -ta maildrop-2.0.4.tar.bz2

After the build process, the rpm packages can be found in $HOME/rpm/RPMS/x86_64 ($HOME/rpm/RPMS/i386 if you are on an i386 system):

cd $HOME/rpm/RPMS/x86_64

The command

ls -l

shows you the available rpm packages:

[falko@server1 x86_64]$ ls -l
total 3172
-rw-r--r-- 1 root  root  139732 Apr 20 15:25 courier-authlib-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root  328468 Apr 20 15:25 courier-authlib-debuginfo-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   35327 Apr 20 15:25 courier-authlib-devel-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   18307 Apr 20 15:25 courier-authlib-ldap-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   14497 Apr 20 15:25 courier-authlib-mysql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   13711 Apr 20 15:25 courier-authlib-pgsql-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root    8361 Apr 20 15:25 courier-authlib-pipe-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 root  root   35285 Apr 20 15:25 courier-authlib-userdb-0.62.2-1.x86_64.rpm
-rw-r--r-- 1 falko falko 391473 Apr 20 15:37 courier-imap-4.4.1-1.x86_64.rpm
-rw-r--r-- 1 falko falko 939716 Apr 20 15:37 courier-imap-debuginfo-4.4.1-1.x86_64.rpm
-rw-r--r-- 1 root  root  298373 Apr 20 15:47 maildrop-2.0.4-1.x86_64.rpm
-rw-r--r-- 1 root  root  767039 Apr 20 15:47 maildrop-debuginfo-2.0.4-1.x86_64.rpm
-rw-r--r-- 1 root  root  134030 Apr 20 15:47 maildrop-devel-2.0.4-1.x86_64.rpm
-rw-r--r-- 1 root  root   58400 Apr 20 15:47 maildrop-man-2.0.4-1.x86_64.rpm
[falko@server1 x86_64]$

You can now install maildrop like this:

sudo rpm -ivh maildrop-2.0.4-1.x86_64.rpm

After you have compiled and installed all needed packages, you can become root again by typing

exit

 

5 Apply Quota Patch To Postfix

We have to get the Postfix source rpm, patch it with the quota patch, build a new Postfix rpm package and install it.

cd /usr/src
wget http://ftp-stud.fht-esslingen.de/pub/Mirrors/centos/5.3/os/SRPMS/postfix-2.3.3-2.1.el5_2.src.rpm
rpm -ivh postfix-2.3.3-2.1.el5_2.src.rpm

The last command will show some warnings that you can ignore:

warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root

cd /usr/src/redhat/SOURCES
wget http://vda.sourceforge.net/VDA/postfix-2.3.3-vda.patch.gz
gunzip postfix-2.3.3-vda.patch.gz
cd /usr/src/redhat/SPECS/

Now we must edit the file postfix.spec:

vi postfix.spec

Change %define MYSQL 0 to %define MYSQL 1, add Patch0: postfix-2.3.3-vda.patch to the # Patches stanza, and finally add %patch0 -p1 -b .vda to the %setup -q stanza:

[...]
%define MYSQL 1
[...]
# Patches

Patch0: postfix-2.3.3-vda.patch
Patch1: postfix-2.1.1-config.patch
Patch3: postfix-alternatives.patch
Patch6: postfix-2.1.1-obsolete.patch
Patch7: postfix-2.1.5-aliases.patch
Patch8: postfix-large-fs.patch
Patch9: postfix-2.2.5-cyrus.patch
Patch10: postfix-CVE-2008-2936.patch
[...]
%setup -q
# Apply obligatory patches
%patch0 -p1 -b .vda
%patch1 -p1 -b .config
%patch3 -p1 -b .alternatives
%patch6 -p1 -b .obsolete
%patch7 -p1 -b .aliases
%patch8 -p1 -b .large-fs
%patch9 -p1 -b .cyrus
%patch10 -p1 -b .CVE-2008-2936
[...]

Then we build our new Postfix rpm package with quota and MySQL support:

rpmbuild -ba postfix.spec

Our Postfix rpm package is created in /usr/src/redhat/RPMS/x86_64, (/usr/src/redhat/RPMS/i386 on an i386 system) so we go there:

cd /usr/src/redhat/RPMS/x86_64

The command

ls -l

shows you the available packages:

[root@server1 x86_64]# ls -l
total 11732
-rw-r--r-- 1 root root 3940163 Apr 20 15:58 postfix-2.3.3-2.1.x86_64.rpm
-rw-r--r-- 1 root root 7999370 Apr 20 15:59 postfix-debuginfo-2.3.3-2.1.x86_64.rpm
-rw-r--r-- 1 root root   49761 Apr 20 15:58 postfix-pflogsumm-2.3.3-2.1.x86_64.rpm
[root@server1 x86_64]#

Pick the Postfix package and install it like this:

rpm -ivh postfix-2.3.3-2.1.x86_64.rpm


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by darrelltwo (not registered) on Wed, 2010-08-18 14:41.

The location of the "sudo" config file is omitted in step 4 (and not the actual file name that needs to be edited), so running "vi sudo" from just anywhere, creates a new file. Did you mean vi /etc/sudoers ????You didn't mean any of these, which are the only 'sudo' filenames in Centos:

/etc/pam.d/sudo
/var/run/sudo
/usr/share/logwatch/scripts/services/sudo
/usr/bin/sudo
 

 Honestly, when you guys just copy/paste instructions from one tutorial to another, I guess for bragging rights of being the one who wrote the tutorial, instead of running the steps yourself, mistakes like this and leaving out packages (like cyrus-sasl-plain) crop up and it discredits "howtoforge".

Submitted by admin (registered user) on Thu, 2010-08-19 09:28.

The correct command is

visudo

as shown in the tutorial. Please keep your accusations for yourself if you don't know what you're talking about. We're testing every new tutorial, and they work exactly as shown.

Submitted by hyeteck (not registered) on Wed, 2010-08-18 00:12.

Thanks.

You missed a package in step 3.  cyrus-sasl-plain is required.  You had the devel package in there but forgot the plain package.

 my telnet test on step 15 was just hanging and /var/log/maillog was spitting out

warning: xsasl_cyrus_server_get_mechanism_list: no applicable SASL mechanisms
fatal: no SASL authentication mechanisms

 once the cyrus-sasl-plain package was installed, everything started working just fine. :)

 

Submitted by Aleksandar Obradovic (not registered) on Sun, 2009-08-02 12:00.

oh man you made me google for "stanza"...

 

anyway tnx for that tutorial... great job..