Virtual Users And Domains With Postfix, Courier And MySQL (Debian Etch) - Page 3

6 Configure Saslauthd

First run

mkdir -p /var/spool/postfix/var/run/saslauthd

Then edit /etc/default/saslauthd. Set START to yes and change the line OPTIONS="-c" to OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r":

vi /etc/default/saslauthd

#
# Settings for saslauthd daemon
#

# Should saslauthd run automatically on startup? (default: no)
START=yes

# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="pam"

# Additional options for this mechanism. (default: none)
# See the saslauthd man page for information about mech-specific options.
MECH_OPTIONS=""

# How many saslauthd processes should we run? (default: 5)
# A value of 0 will fork a new process for each connection.
THREADS=5

# Other options (default: -c)
# See the saslauthd man page for information about these options.
#
# Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
# Note: See /usr/share/doc/sasl2-bin/README.Debian
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

Then create the file /etc/pam.d/smtp. It should contain only the following two lines (go sure to fill in your correct database details):

vi /etc/pam.d/smtp

auth    required   pam_mysql.so user=mail_admin passwd=mail_admin_password host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1
account sufficient pam_mysql.so user=mail_admin passwd=mail_admin_password host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1

Next create the file /etc/postfix/sasl/smtpd.conf. It should look like this:

vi /etc/postfix/sasl/smtpd.conf

pwcheck_method: saslauthd
mech_list: plain login
allow_plaintext: true
auxprop_plugin: mysql
sql_hostnames: 127.0.0.1
sql_user: mail_admin
sql_passwd: mail_admin_password
sql_database: mail
sql_select: select password from users where email = '%u'

Then restart Postfix and Saslauthd:

/etc/init.d/postfix restart
/etc/init.d/saslauthd restart

 

7 Configure Courier

Now we have to tell Courier that it should authenticate against our MySQL database. First, edit /etc/courier/authdaemonrc and change the value of authmodulelist so that it reads:

vi /etc/courier/authdaemonrc

[...]
authmodulelist="authmysql"
[...]

Then make a backup of /etc/courier/authmysqlrc and empty the old file:

cp /etc/courier/authmysqlrc /etc/courier/authmysqlrc_orig
cat /dev/null > /etc/courier/authmysqlrc

Then open /etc/courier/authmysqlrc and put the following lines into it:

vi /etc/courier/authmysqlrc

MYSQL_SERVER localhost
MYSQL_USERNAME mail_admin
MYSQL_PASSWORD mail_admin_password
MYSQL_PORT 0
MYSQL_DATABASE mail
MYSQL_USER_TABLE users
MYSQL_CRYPT_PWFIELD password
#MYSQL_CLEAR_PWFIELD password
MYSQL_UID_FIELD 5000
MYSQL_GID_FIELD 5000
MYSQL_LOGIN_FIELD email
MYSQL_HOME_FIELD "/home/vmail"
MYSQL_MAILDIR_FIELD CONCAT(SUBSTRING_INDEX(email,'@',-1),'/',SUBSTRING_INDEX(email,'@',1),'/')
#MYSQL_NAME_FIELD
MYSQL_QUOTA_FIELD quota

Then restart Courier:

/etc/init.d/courier-authdaemon restart
/etc/init.d/courier-imap restart
/etc/init.d/courier-imap-ssl restart
/etc/init.d/courier-pop restart
/etc/init.d/courier-pop-ssl restart

By running

telnet localhost pop3

you can see if your POP3 server is working correctly. It should give back +OK Hello there. (Type quit to get back to the Linux shell.)

server1:/etc/postfix# telnet localhost pop3
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
+OK Hello there.
quit
+OK Better luck next time.
Connection closed by foreign host.

 

8 Modify /etc/aliases

Now we should open /etc/aliases. Make sure that postmaster points to root and root to your own username or your email address, e.g. like this:

vi /etc/aliases

[...]
postmaster: root
root: postmaster@yourdomain.tld
[...]

Whenever you modify /etc/aliases, you must run

newaliases

afterwards and restart Postfix:

/etc/init.d/postfix restart

Share this page:

18 Comment(s)

Add comment

Comments

From: at: 2007-06-06 20:11:22

 Hi,


 I don't understand, why you use the smtp-PAM-Module?!


 By the way: In Debian Etch you have to activate DCC in /etc/spamassassin/v310.pre


 Regards,


Hypz 

From: at: 2007-06-24 18:58:29

This setup seems to be extremely insecure.


Mysql function encrypt () encrypts (on some systems, e.g. my Debian Etch) only first eight characters of a string, making hacking of a mailbox extremely easy. For example, passwords


12345678LHKuhlhKJgkZgHklu


and


12345678


both allow the user to log in (think about people who use password5468d - AOL had similar problem recently).

From: at: 2007-06-24 19:10:25

To fix the security problem I mentioned above, you may possibly use other cyphers, I found this text:


 


User question/comment: I thought MYSQL_CRYPT_PWFIELD only handles the ENCRYPT() function in stead of MD5() (see postfix-mysql setup). Correct me when I'm wrong


User question/comment: MYSQL_CRYPT_PWFIELD only specifies the name of database field,
it has nothing to do with crypt format. authlib
can automatically detect several different formats of password hash, please refer to cryptpassword.c
inside courier authlib source code for more info. Basically it checks if the first
few characters of password hash is:



  • "$1$": password is MD5 format password used by all Linux systems.

  • "{MD5}": this is followed by standard MD5 hash of password phrase.

  • "{SHA}": this is followed by standard SHA hash of password phrase.

  • "{SHA256}": this is followed by standard SHA256 hash of password phrase.

  • "{CRYPT}": this is followed by standard DES crypt() hash of password phrase.

Source:


http://postfix.wiki.xs4all.nl/index.php?title=Virtual_Users_and_Domains_with_Courier-IMAP_and_MySQL 

From: at: 2008-01-18 16:27:33

apt-get source postfix did not work for me.


Replaced by 'apt-src install postfix'.


 

From: at: 2008-01-29 12:11:27

VERY nice howto. It worked like a dream.
And setting up Squirrelmail for this was a breeze too. 


I encountered some problems while I followed the guide though, which I have listed in my blog @ Ronin's blog[^].


 One was a bug I encountered within Courier-Saslauthdaemon, and 2 were some banal problems with Squirrelmail. But I managed to solve them with some googling around ^^

From: at: 2008-07-25 19:30:16

Hi


To fix this problem, just use md5-crypt passwords (as used in /etc/shadow files, starting with $1$) for your mailboxes.


This should work. If it doesn't, append "md5=true" on both lines in /etc/pam.d/smtp.

From: Juan Carlos at: 2008-12-16 17:56:05

hello as are wanting to loguiarme in mailboxes me introduce the following error:

 

Dec 16 12:43:19 linuxdeb authdaemond: stopping authdaemond children
Dec 16 12:43:19 linuxdeb authdaemond: modules="authmyslq", daemons=5
Dec 16 12:43:19 linuxdeb authdaemond: Installing libauthmyslq
Dec 16 12:43:19 linuxdeb authdaemond: libauthmyslq.so: cannot open shared object file: No such file or directory
Dec 16 12:43:46 linuxdeb courierpop3login: Connection, ip=[::ffff:127.0.0.1]
Dec 16 12:43:54 linuxdeb courierpop3login: LOGIN FAILED, user=juan, ip=[::ffff:127.0.0.1]
Dec 16 12:44:03 linuxdeb courierpop3login: LOGOUT, ip=[::ffff:127.0.0.1]
Dec 16 12:44:03 linuxdeb courierpop3login: Disconnected, ip=[::ffff:127.0.0.1]
~

 

that can be

 

From: Anonymous at: 2009-06-17 20:42:27

Hi,


 under debian edge there is a bug in clamav so that it produces 100% cpu load and can´t open a unix socket.


Like this: 

connect to UNIX socket /var/run/clamav/clamd.ctl: No such file or directory

You have to update the clamav to solve this problem. Add folowing package sources in sources.list

deb http://volatile.debian.org/debian-volatile etch/volatile main

 then do: apt-get update


and install the packages: 


clamav-daemon
clamav-freshclam
clamav-base
clamav


then it sould work.


Good Luck


 Kruser

From: at: 2008-01-26 16:54:35

Hi,


Great Howto, thank you very much for your work.


Just a comment: you don't need to set sql parameters and mysql as auxprop_plugin in /etc/postfix/sasl/smtpd.conf as you intend to use PAM for authentication.


The following /etc/postfix/sasl/smtpd.conf should suffice:

pwcheck_method: saslauthd
mech_list: plain login
allow_plaintext: true

This way, plain PAM will be used, with the options you set in /etc/pam.d/smtpd. Indeed, you don't even need to install libsasl2-modules-sql package (but you still do need libpam-mysql, of course).


Best regards,


Alberto Caso
Adaptia

From: at: 2007-06-05 19:31:53

Hi,


 why do you add this SMTP-PAM-Module? I don't see any sense in this.


By the way: In Debian Etch you have to enable DCC in /etc/spamassassin/v310.pre


Regards,


Hypz 

From: at: 2007-07-11 21:17:01

Hi, first ov all thanks for the tut.


In etch you also have to activate spamassasin in /etc/default/spamassasin "ENABLE = 1"


Also I found this in the Fedora tut. about the paths ( it worked for me on etch ):


the dcc_path to the socket is (as I followed exacly the way of installing as described in this tut):

/var/lib/dcc/dccifd


* dcc_add_header and  pyzor_add_header are deprecated (Cf. http://spamassassin.apache.org/full/2.6x/dist/doc/Mail_SpamAssassin_Conf.txt), instead use respectively add_header all DCC _DCCB_: _DCCR_ and add_header all Pyzor _PYZOR_


 * to make amavis keep a part of the spamassassin header, add the following lines to your amavisd.conf :


$remove_existing_spam_headers = 0;


$sa_spam_report_header = 1;


Please correct me if I'm wrong. But it looks like this how it worked for me.


Greets Josh 


 

From: at: 2007-07-20 18:32:01

You are wrong, spamd is typically not used along with amavisd-new. amavisd-new calls spamassassin directly via Perl module Mail::SpamAssassin. So, I suggest leaving the default of "ENABLE = 0" in /etc/default/spamassasin.

From: at: 2008-02-17 22:56:39

I got this error in /var/log/mail.log
Can't connect to UNIX socket /var/run/clamav/clamd.ctl: No such file or directory

Sollution -> http://blog.brachium-system.net/categories/7-virus

From: Tim at: 2009-06-14 22:17:31

I was able to make this run in lenny with some light modifications, no DCC (debian boycotted it in lenny), etc.


Everything works nicely, but spamassassin, razor and pyzor do not print any headers in the e-mail, when "$sa_tag_level_deflt = undef;".


On the amavis startup logging, it does show razor2 being loaded, but not pyzor, while both are installed (did not configuration though).


Amavis is logging to mail.log whether the message is spam or not, and the X-Virus-Scanned shows, but no spamassassin, razor (and pyzor, but it won't even load) headers. Should I just install the perl package for spamassassin? I currently have the "spamassasin" lenny deb installed.


 


"$QUARANTINEDIR = "$MYHOME/virusmails";
$quarantine_subdir_levels = 1; # enable quarantine dir hashing

$log_recip_templ = undef;    # disable by-recipient level-0 log entries
$DO_SYSLOG = 1;              # log via syslogd (preferred)
$syslog_ident = 'amavis';    # syslog ident tag, prepended to all messages
$syslog_facility = 'mail';
$syslog_priority = 'debug';  # switch to info to drop debug output, etc

$enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1

$inet_socket_port = 10024;   # default listening socket

$sa_spam_subject_tag = '***SPAM*** ';
$sa_tag_level_deflt = undef;   # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 4.00;   # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.31;   # triggers spam evasive actions
$sa_dsn_cutoff_level = 10;     # spam level beyond which a DSN is not sent
"


Thanks!


Tim

From: at: 2010-08-21 19:37:35

Hi i folowed this guide and the server has worked well for over a year but now clamd uses up 100% of my cpu.


 

From: at: 2007-06-10 11:51:45

Thanks for this tutorial!


Whats with automatic custom rulesets updates for SpamAssassin?


=> http://www.howtoforge.com/virtual_postfix_mysql_quota_courier_p4


 Nico

From: at: 2008-05-27 15:32:58

You need to use clamav from Debian's volatile repository, otherwise this won't work at all.


On more thing, if you create new email account, and than try to fetch mail for it and fail miserably, than send an email to it, and then try again.


Good tutorial. Thanks ;) 

From: Bruno Taranto Alvim at: 2008-09-30 23:30:19

Change 2 files (mysql-virtual_mailboxes.cf and authmysqlrc) to Maildir work.


mail:/etc/postfix# more mysql-virtual_mailboxes.cf


user = postfix password = postfix dbname = postfix query = SELECT CONCAT(SUBSTRING_INDEX(email,'@',-1),'/','',SUBSTRING_INDEX(email,'@',1),'/','Maildir/') FROM users WHERE email='%s' hosts = 127.0.0.1


mail:/etc/courier# more authmysqlrc


MYSQL_SERVER localhost MYSQL_USERNAME postfix MYSQL_PASSWORD postfix MYSQL_PORT 0 MYSQL_DATABASE postfix MYSQL_USER_TABLE users MYSQL_CRYPT_PWFIELD password #MYSQL_CLEAR_PWFIELD password MYSQL_UID_FIELD 5000 MYSQL_GID_FIELD 5000 MYSQL_LOGIN_FIELD email MYSQL_HOME_FIELD "/home/vmail" MYSQL_MAILDIR_FIELD CONCAT(SUBSTRING_INDEX(email,'@',-1),'/','',SUBSTRING_INDEX(email,'@',1),'/','Maildir/') #MYSQL_NAME_FIELD MYSQL_QUOTA_FIELD quota


Now you can receive and get!