Step By step to installing the Indimail Server With Greylisting, DKIM sign.
IndiMail INSTALLATION STEPS
Quite often I find people doing a google search on IndiMail Installation Steps. I am not happy with the result which comes up in the search.
If you have learnt the art of being patient the read the file INSTALL-version. You can read the file INSTALL-RPM-version in case you want to install from RPM (version is the version of IndiMail you want to install).
If you are in a hurry to install and setup IndiMail, download the RPM and read the file Quick-INSTALL-version.
IndiMail RPM for various linux distros can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/
The top level directory for current indimail source being maintained can be found at
https://sourceforge.net/projects/indimail/files/indimail
If you have learnt the art of being patient the read the file INSTALL-version. You can read the file INSTALL-RPM-version in case you want to install from RPM (version is the version of IndiMail you want to install).
If you are in a hurry to install and setup IndiMail, download the RPM and read the file Quick-INSTALL-version.
IndiMail RPM for various linux distros can be downloaded from
http://download.opensuse.org/repositories/home:/indimail/
The top level directory for current indimail source being maintained can be found at
https://sourceforge.net/projects/indimail/files/indimail
Using spamassassin program with IndiMail
Just few days back a user asked me whether spamassassin can be used with IndiMail.
IndiMail uses environment variables SPAMFILTER, SPAMEXITCODE to configure any spam filter to be used. All that is required for the spam filter is to read a mail message on stdin, output the message back on stdout and exit with a number which indicates whether the message is ham or spam.
The default installation of IndiMail creates a configuration where mails get scanned by bogofilter for spam filtering. bogofilter exits with value '0' in case the message is spam and with value '1' when message is ham. The settings for SPAMFILTER, SPAMEXITCODE is as below
SPAMFILTER="/var/indimail/bin/bogofilter -p -u -d /var/indimail/etc"
SPAMEXITCODE=0
Assuming that you have installed, setup and trained spamassassin, you can follow the instructions below to have IndiMail use spamassassin.
spamassasin has a client spamc which exits 1 when message is spam and exits 0 if the message is ham. To use spamassassin, just use the following for SPAMFILTER, SPAMEXITCODE
SPAMFILTER="path_to_spamassassin_spamc_program -E -U socket -d host -p port -u user "
SPAMEXITCODE=1
(see the documentation on spamc for description of arguments to spamc program)
If you are a lazy person like me then you can execute the following command to have the above environment variables set for qmail-smtpd to use spamassassin
% su
# /var/indimail/sbin/svctool --smtp=25 --servicedir=/service --qbase=/var/indimail/queue --qcount=5 --qstart=1 \
--cntrldir=control --localip=0 --maxdaemons=75 --maxperip=25 \
--persistdb --starttls --fsync --syncdir --memory=52428800 \
--chkrecipient --chkrelay --masquerade --min-free=52428800 \
--content-filter --virus-filter \
--qhpsi="/var/indimail/bin/clamdscan %s --quiet --disable-summary" \
--spamfilter="path_to_spamassassin_spamc_program -E -U socket -d host -p port -u user" \
--rejectspam=0 --spamexitcode=1 \
--localfilter --remotefilter --remote-authsmtp=plain --dmasquerade \
--dkverify=both --dksign=both --private_key=/var/indimail/control/domainkeys/indimail \
--rbl="-rzen.spamhaus.org -rdnsbl-1.uceprotect.net"
Since IndiMail uses envdir program to set environment variable, a simpler way would be to do the following
% su
# echo "path_to_spamassassin_spamc_program -E -U sock -d host -p port \
-u user" > /service/qmail-smtpd.25/variables/SPAMFILTER
# echo 1 > /service/qmail-smtpd.25/variables/SPAMEXITCODE
IndiMail uses environment variables SPAMFILTER, SPAMEXITCODE to configure any spam filter to be used. All that is required for the spam filter is to read a mail message on stdin, output the message back on stdout and exit with a number which indicates whether the message is ham or spam.
The default installation of IndiMail creates a configuration where mails get scanned by bogofilter for spam filtering. bogofilter exits with value '0' in case the message is spam and with value '1' when message is ham. The settings for SPAMFILTER, SPAMEXITCODE is as below
SPAMFILTER="/var/indimail/bin/bogofilter -p -u -d /var/indimail/etc"
SPAMEXITCODE=0
Assuming that you have installed, setup and trained spamassassin, you can follow the instructions below to have IndiMail use spamassassin.
spamassasin has a client spamc which exits 1 when message is spam and exits 0 if the message is ham. To use spamassassin, just use the following for SPAMFILTER, SPAMEXITCODE
SPAMFILTER="path_to_spamassassin_spamc_program -E -U socket
SPAMEXITCODE=1
(see the documentation on spamc for description of arguments to spamc program)
If you are a lazy person like me then you can execute the following command to have the above environment variables set for qmail-smtpd to use spamassassin
% su
# /var/indimail/sbin/svctool --smtp=25 --servicedir=/service --qbase=/var/indimail/queue --qcount=5 --qstart=1 \
--cntrldir=control --localip=0 --maxdaemons=75 --maxperip=25 \
--persistdb --starttls --fsync --syncdir --memory=52428800 \
--chkrecipient --chkrelay --masquerade --min-free=52428800 \
--content-filter --virus-filter \
--qhpsi="/var/indimail/bin/clamdscan %s --quiet --disable-summary" \
--spamfilter="path_to_spamassassin_spamc_program -E -U socket
--rejectspam=0 --spamexitcode=1 \
--localfilter --remotefilter --remote-authsmtp=plain --dmasquerade \
--dkverify=both --dksign=both --private_key=/var/indimail/control/domainkeys/indimail \
--rbl="-rzen.spamhaus.org -rdnsbl-1.uceprotect.net"
Since IndiMail uses envdir program to set environment variable, a simpler way would be to do the following
% su
# echo "path_to_spamassassin_spamc_program -E -U sock
-u user
# echo 1 > /service/qmail-smtpd.25/variables/SPAMEXITCODE
Troublesome MySQL Configuration
Quite a few of users who attempt to install IndiMail first time, face the biggest issue with MySQL installation and configuration. Most of the issues relate to the following
/var/indimail/bin/svc -u /service/mysql.3306
to start up MySQL.
The solution to the second problem is to create a blank MySQL database by running the following command
/var/indimail/bin/svc -d /service/mysql.3306
/bin/rm -r /var/indimail/mysqldb/data
/usr/bin/mysql_install_db --user=mysql --datadir=/var/indimail/mysqldb/data
chown -R mysql:mysql /var/indimail/mysqldb/data
/var/indimail/bin/svc -u /service/mysql.3306
mysql -u root -p
mysql> use mysql;
mysql> update user set password=PASSWORD('some_pass') where user='root';
mysql> CREATE USER indimail identified by 'ssh-1.5-';
mysql> CREATE USER mysql identifed by '4-57343-';
mysql> CREATE USER admin identified by 'benhur20';
mysql> CREATE USER repl identified by 'slaveserver';
mysql> GRANT SELECT,CREATE,ALTER,INDEX,INSERT,UPDATE,DELETE, \
mysql> CREATE TEMPORARY TABLES, \
mysql> LOCK TABLES ON indimail.* to 'indimail';
mysql> GRANT RELOAD,SHUTDOWN,PROCESS,SUPER on *.* to admin;
mysql> GRANT REPLICATION_SLAVE on *.* to repl;
The third problem can be solved by replacing socket=/var/lib/mysql/mysql.sock with socket=/tmp/mysql.sock in /etc/my.cnf or equivalent file.
- MySQL version less than 5.1: MySQL fails to startup under supervise
- MySQL version less than 5.1: svctool fails to create a default database for IndiMail during rpm installation.
- /etc/my.cnf uses socket=/var/lib/mysql/mysql.sock. IndiMail uses /tmp/mysql.sock. Connection to MySQL fails if you use mysql(1) (without -S opton).
/var/indimail/bin/svc -u /service/mysql.3306
to start up MySQL.
The solution to the second problem is to create a blank MySQL database by running the following command
/var/indimail/bin/svc -d /service/mysql.3306
/bin/rm -r /var/indimail/mysqldb/data
/usr/bin/mysql_install_db --user=mysql --datadir=/var/indimail/mysqldb/data
chown -R mysql:mysql /var/indimail/mysqldb/data
/var/indimail/bin/svc -u /service/mysql.3306
mysql -u root -p
mysql> use mysql;
mysql> update user set password=PASSWORD('some_pass') where user='root';
mysql> CREATE USER indimail identified by 'ssh-1.5-';
mysql> CREATE USER mysql identifed by '4-57343-';
mysql> CREATE USER admin identified by 'benhur20';
mysql> CREATE USER repl identified by 'slaveserver';
mysql> GRANT SELECT,CREATE,ALTER,INDEX,INSERT,UPDATE,DELETE, \
mysql> CREATE TEMPORARY TABLES, \
mysql> LOCK TABLES ON indimail.* to 'indimail';
mysql> GRANT RELOAD,SHUTDOWN,PROCESS,SUPER on *.* to admin;
mysql> GRANT REPLICATION_SLAVE on *.* to repl;
The third problem can be solved by replacing socket=/var/lib/mysql/mysql.sock with socket=/tmp/mysql.sock in /etc/my.cnf or equivalent file.
SLOC Directory SLOC-by-Language (Sorted)
106466 clamav-0.95.2 ansic=94967,sh=11300,perl=199
73173 qmail-1.03 ansic=68645,perl=2361,sh=2167
58207 indimail-1.6.2 ansic=51563,sh=6644
45914 indium-1.0 tcl=39628,sh=5604,ansic=682
41943 bogofilter-1.2.1 ansic=34807,sh=4629,perl=1842,lex=475,lisp=179
14670 flash-0.9.4 ansic=8346,sh=6324
9762 ucspi-tcp-0.88 ansic=9581,sh=181
9362 altermime-0.3.10 ansic=5963,sh=3399
9317 mpack-1.6 ansic=9292,perl=25
8131 ripmime-1.4.0.9 ansic=8116,sh=15
4256 pam-multi-1.0 ansic=3053,sh=1203
3318 libdkim-1.3 cpp=2316,ansic=924,sh=78
1833 nssd-1.0 ansic=1833
1772 fortune-1.1 ansic=1698,sh=74
Totals grouped by language (dominant language first):
ansic: 299470 (77.16%)
sh: 41618 (10.72%)
tcl: 39628 (10.21%)
perl: 4427 (1.14%)
cpp: 2316 (0.60%)
lex: 475 (0.12%)
lisp: 179 (0.05%)
Total Physical Source Lines of Code (SLOC) = 388,124
Development Effort Estimate, Person-Years (Person-Months) = 104.58 (1,254.96)
(Basic COCOMO model, Person-Months = 2.4 * (KSLOC**1.05))
Schedule Estimate, Years (Months) = 3.14 (37.62)
(Basic COCOMO model, Months = 2.5 * (person-months**0.38))
Estimated Average Number of Developers (Effort/Schedule) = 33.36
Total Estimated Cost to Develop = $ 3,011,907
(average salary = $12,000/year, overhead = 2.40).
Greylisting in IndiMail
Greylisting is a method of defending email users against spam, by temporarily rejecting any email from a IP/Sender which it does not recognize. As per SMTP, the originating server should after a delay retry. A server implementing greylisting should accept the mail if sufficient time has elapsed. If the mail is from a spammer it will probably not be retried since a spammer goes through thousands of email addresses and typically cannot afford the time delay to retry.
IndiMail 1.6 onwards implements greylisting using qmail-greyd daemon. You additionally need to have the environment variable GREYIP defined for the qmail-smtpd process. The environment variable GREYIP specifies on which IP and port, qmail-greyd is accepting greylisting requests. qmail-smtpd uses UDP to send a triplet (IP+RETURN_PATH+RECIPIENT) to the greylisting server and waits for an answer which tells qmail-smtpd to proceed ahead or to temporarily reject the mail. qmail-greyd also accepts a list of whitelisted IP addresses for which greylisting should not be done.
1. Enabling qmail-greyd greylisting server
% su
# svctool --greylist=1999 --servicedir=/service --min-resend-min=2 \
--resend-win-hr=24 --timeout-days=30 --context-file=greylist.context \
--save-interval=5 --whitelist=greylist.whitelist --use-greydaemon
2. Enabling greylisting in SMTP
IndiMail 1.6 onwards implements greylisting using qmail-greyd daemon. You additionally need to have the environment variable GREYIP defined for the qmail-smtpd process. The environment variable GREYIP specifies on which IP and port, qmail-greyd is accepting greylisting requests. qmail-smtpd uses UDP to send a triplet (IP+RETURN_PATH+RECIPIENT) to the greylisting server and waits for an answer which tells qmail-smtpd to proceed ahead or to temporarily reject the mail. qmail-greyd also accepts a list of whitelisted IP addresses for which greylisting should not be done.
1. Enabling qmail-greyd greylisting server
% su
# svctool --greylist=1999 --servicedir=/service --min-resend-min=2 \
--resend-win-hr=24 --timeout-days=30 --context-file=greylist.context \
--save-interval=5 --whitelist=greylist.whitelist --use-greydaemon
2. Enabling greylisting in SMTP
- Assuming you've setup your qmail-smtpd service with tcpserver and the
-xoption (as in LWQ), you just need to update the cdb file referenced by this-xoption. The source for this file is typically/var/indimail/etc/tcp.smtp. For example,127.:allow,RELAYCLIENT=""
192.168.:allow,RELAYCLIENT=""
:allow
could become,
127.:allow,RELAYCLIENT=""
192.168.:allow,RELAYCLIENT=""
:allow,GREYIP=":"
- If you've setup
qmail-greydon a non-default address (perhaps you're runningqmail-greydon a separate machine), you'll also need to specify the address it's listening on - adjust the above to includeGREYIP="192.168.5.5:", for example. - Finally, don't forget to update the cdb file corresponding to the source file you've just edited. If you have a LWQ setup that's,
# qmailctl cdb
otherwise (assuming/var/indimail/etc/tcp.smtp,/var/indimail/etc/tcp.smtp.cdb),# tcprules /var/indimail/etc/tcp.smtp.cdb /var/indimail/etc/tcp.smtp.tmp < /var/indimail/etc/tcp.smtp
- Alternatively (and particularly if you're not using the
-xoption totcpserver) you can enable greylisting for all SMTP connections by settingGREYIPin the environment in whichqmail-smtpdis started - for example your variables directory for qmail-smtpd can contain a file with the name GREYIP# echo GREYIP=\":\" > /service/qmail-smtpd.25/variables/GREYIP
If you have installed indimail using any of the RPM at
http://download.opensuse.org/repositories/home:/mbhangui/
you will get IMAPS, POP3S, SMTPS services installed by default. However Certificate are not installed by default. You may want to study the following google search. If you have not installed IndiMail using the RPM, then you can use svctool to create the IMAPS, POP3S, SMTPS services. Executing svctool without any option will give you a help screen.
You can save yourself a lot of trouble by using svctool to create self-signed certificate for IMAPS, POP3S, SMTPS (or starttls in smtp)
# /var/indimail/svctool --postmaster=postmaster@yourdomain --config=cert
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank. For some fields there will be a default value, If you just hit Enter, the field will be left blank. Please note: The common name must be the name of the mail server so make sure you enter it on that line:
Country Name (2 letter code) [GB]:IN
State or Province Name (full name) [Berkshire]:Goa
Locality Name (eg, city) [Newbury]:Porvorim
Organization Name (eg, company) [My Company Ltd]:IndiMail
Organizational Unit Name (eg, section) []: Technology
Common Name (eg, YOUR name) []: yourdomain
Email Address []:user@domain.xxx
Once you have given the above input, your certificate will be generated
% ls -l /var/indimail/control/*.pem
-rw-------. 1 indimail indimail 245 2009-08-19 07:39 dh1024.pem
-rw-------. 1 indimail indimail 156 2009-08-19 07:39 dh512.pem
-rw-------. 1 indimail indimail 497 2009-08-19 07:38 rsa512.pem
lrwxrwxrwx. 1 root root 36 2009-08-19 07:38 clientcert.pem -> /var/indimail/control/servercert.pem
-rw-r-----. 1 indimail indimail 2197 2009-08-19 07:38 servercert.pem
Now you can use the following commands to test the services
To connect to IMAPS
openssl s_client -connect localhost:993
To connect to POP3S
openssl s_client -connect localhost:995
To connect to SMTPS
openssl s_client -connect localhost:465
http://download.opensuse.org/repositories/home:/mbhangui/
you will get IMAPS, POP3S, SMTPS services installed by default. However Certificate are not installed by default. You may want to study the following google search. If you have not installed IndiMail using the RPM, then you can use svctool to create the IMAPS, POP3S, SMTPS services. Executing svctool without any option will give you a help screen.
You can save yourself a lot of trouble by using svctool to create self-signed certificate for IMAPS, POP3S, SMTPS (or starttls in smtp)
# /var/indimail/svctool --postmaster=postmaster@yourdomain --config=cert
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank. For some fields there will be a default value, If you just hit Enter, the field will be left blank. Please note: The common name must be the name of the mail server so make sure you enter it on that line:
Country Name (2 letter code) [GB]:IN
State or Province Name (full name) [Berkshire]:Goa
Locality Name (eg, city) [Newbury]:Porvorim
Organization Name (eg, company) [My Company Ltd]:IndiMail
Organizational Unit Name (eg, section) []: Technology
Common Name (eg, YOUR name) []: yourdomain
Email Address []:user@domain.xxx
Once you have given the above input, your certificate will be generated
% ls -l /var/indimail/control/*.pem
-rw-------. 1 indimail indimail 245 2009-08-19 07:39 dh1024.pem
-rw-------. 1 indimail indimail 156 2009-08-19 07:39 dh512.pem
-rw-------. 1 indimail indimail 497 2009-08-19 07:38 rsa512.pem
lrwxrwxrwx. 1 root root 36 2009-08-19 07:38 clientcert.pem -> /var/indimail/control/servercert.pem
-rw-r-----. 1 indimail indimail 2197 2009-08-19 07:38 servercert.pem
Now you can use the following commands to test the services
To connect to IMAPS
openssl s_client -connect localhost:993
To connect to POP3S
openssl s_client -connect localhost:995
To connect to SMTPS
openssl s_client -connect localhost:465
Wednesday, April 1, 2009
How to set DKIM signature in IndiMail
What is DKIM
DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message while it is in transit. DKIM has been approved as a Proposed Standard by IETF and published it as RFC 4871. There are number of vendors/software available with provide DKIM signing. IndiMail is one of them. You can see the full list here.
DKIM uses public-key cryptography to allow the sender to electronically sign legitimate emails in a way that can be verified by recipients. Prominent email service providers implementing DKIM (or its slightly different predecessor, DomainKeys) include Yahoo and Gmail. Any mail from these domains should carry a DKIM signature, and if the recipient knows this, they can discard mail that hasn't been signed, or that has an invalid signature.
IndiMail from version 1.5 onwards, comes with a drop-in replacement for qmail-queue for DKIM signature signing and verification (see qmail-dkim(8) for more details). You need the following steps to enable DKIM. IndiMail from version 1.5.1 onwards comes with a filter dk-filter, which can be enabled before mail is handed over to qmail-remote or qmail-remote (see spawn-filter(8) for more details).
Create your DKIM signature
% cd /var/indimail/control/domainkeys
# openssl genrsa -out rsa.private 768
# openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
# mv rsa.private private
# chown qmailq:indimail private (name of our selector)
# chmod 440 private
--dkverify (for verification) or --dksign --private_key=
Referense URL:
http://indimail.blogspot.com/
http://indimail.blogspot.com/2009/10/troublesome-mysql-configuration.html
/var/indimail/bin/svc -u /service/mysql.3306
to start up MySQL.
The solution to the second problem is to create a blank MySQL database by running the following command
/var/indimail/bin/svc -d /service/mysql.3306
/bin/rm -r /var/indimail/mysqldb/data
/usr/bin/mysql_install_db --user=mysql --datadir=/var/indimail/mysqldb/data
chown -R mysql:mysql /var/indimail/mysqldb/data
/var/indimail/bin/svc -u /service/mysql.3306
mysql -u root -p
mysql> use mysql;
mysql> update user set password=PASSWORD('some_pass') where user='root';
mysql> CREATE USER indimail identified by 'ssh-1.5-';
mysql> CREATE USER mysql identifed by '4-57343-';
mysql> CREATE USER admin identified by 'benhur20';
mysql> CREATE USER repl identified by 'slaveserver';
mysql> GRANT SELECT,CREATE,ALTER,INDEX,INSERT,UPDATE,DELETE, \
mysql> CREATE TEMPORARY TABLES, \
mysql> LOCK TABLES ON indimail.* to 'indimail';
mysql> GRANT RELOAD,SHUTDOWN,PROCESS,SUPER on *.* to admin;
mysql> GRANT REPLICATION_SLAVE on *.* to repl;
The third problem can be solved by replacing socket=/var/lib/mysql/mysql.sock with socket=/tmp/mysql.sock in /etc/my.cnf or equivalent file.
Changing the Port 25 to 587 for the security purpose:
/var/indimail/sbin/svctool --smtp=587 --servicedir=/service \
--qbase=/var/indimail/queue --qcount=5 --qstart=1 --authsmtp --antispoof \
--cntrldir=control --localip=0 --maxdaemons=150 --maxperip=25 --persistdb \
--starttls --fsync --syncdir --memory=104857600 --chkrecipient --chkrelay --masquerade \
--min-free=52428800 --content-filter --virus-filter \
--qhpsi="/var/indimail/bin/clamdscan %s --quiet --disable-summary" \
--dmasquerade --skipsend \
--dkverify=both --dksign=both --private_key=/var/indimail/control/domainkeys/indimail
DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message while it is in transit. DKIM has been approved as a Proposed Standard by IETF and published it as RFC 4871. There are number of vendors/software available with provide DKIM signing. IndiMail is one of them. You can see the full list here.
DKIM uses public-key cryptography to allow the sender to electronically sign legitimate emails in a way that can be verified by recipients. Prominent email service providers implementing DKIM (or its slightly different predecessor, DomainKeys) include Yahoo and Gmail. Any mail from these domains should carry a DKIM signature, and if the recipient knows this, they can discard mail that hasn't been signed, or that has an invalid signature.
IndiMail from version 1.5 onwards, comes with a drop-in replacement for qmail-queue for DKIM signature signing and verification (see qmail-dkim(8) for more details). You need the following steps to enable DKIM. IndiMail from version 1.5.1 onwards comes with a filter dk-filter, which can be enabled before mail is handed over to qmail-remote or qmail-remote (see spawn-filter(8) for more details).
Create your DKIM signature
% cd /var/indimail/control/domainkeys
# openssl genrsa -out rsa.private 768
# openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
# mv rsa.private private
# chown qmailq:indimail private (name of our selector)
# chmod 440 private
Create your DNS records$ grep -v ^- rsa.public | perl -e 'while(<>){chop;$l.=$_;}print "t=y; p=$l;\n";'_domainkey.indimail.org. IN TXT "t=y; o=-;"Set SMTP to sign with DKIM signatures
default._domainkey.indimail.org. IN TXT "DNS-public-key"
# cd /service/qmail-smtpd.25/variables
# echo "/var/indimail/bin/qmail-dkim" > QMAILQUEUE
# echo "/var/indimail/control/domainkeys/private" > DKIMSIGN
# svc -d /service/qmail-smtpd.25; svc -u /service/qmail-smtpd.25
Set SMTP to verify DKIM signatures
You can setup qmail-stmpd for verification by setting
DKIMIVERIFY environment variable instead of DKIMSIGN environment variable.
# cd /service/qmail-smtpd.25/variables
# echo "/var/indimail/bin/qmail-dkim" > QMAILQUEUE
# echo "" > DKIMVERIFY
# svc -d /service/qmail.smtpd.25; svc -u /service/qmail-smtpd.25
DKIM Author Domain Signing Practices IndiMail supports ADSP. A DKIM Author Signing Practice lookup is done by the verifier to determine whether it should expect email with the From: address to be signed.
The Sender Signing Practice is published with a DNS TXT record as follows:
_adsp._domainkey.indimail.org. IN TXT "dkim=unknown"
The dkim tag denotes the outbound signing Practice. unknown means that the indimail.org domain may sign some emails. You can have the values "discardable" or "all" as other values for dkim tag. discardable means that any unsigned email from indimail.org is recommended for rejection. all means that indimail.org signs all emails with dkim.
You may decide to consider ADSP as optional until the specifications are formalised. To set ADSP you need to set the environment variable SIGN_PRACTICE=adsp. i.e
# echo adsp > /service/smtpd.25/variables/SIGN_PRACTICE
You may not want to do DKIM signing/verificaton by SMTP. In that case, you have the choice of using the QMAILREMOTE, QMAILLOCAL environment variables which allows IndiMail to run any script before it gets passed to qmail-remote, qmail-local respectively.
Setting qmail-remote to sign with DKIM signatures
On your host which sends out outgoing mails,
it only make sense to do DKIM signing and not verification.
# cd /service/qmail-send.25/variables
# echo "/var/indimail/bin/spawn-filter" > QMAILREMOTE
# echo "/var/indimail/bin/dk-filter" > FILTERARGS
# echo "/var/indimail/control/domainkeys/private" > DKIMSIGN
# svc -d /service/qmail-send.25; svc -u /service/qmail-send.25
Setting qmail-local to verify DKIM signatures
On your host which serves as your incoming gateway
for your local domains, it only makes sense to do
DKIM verification with qmail-local
# cd /service/qmail-send.25/variables
# echo "/var/indimail/bin/spawn-filter" > QMAILLOCAL
# echo "/var/indimail/bin/dk-filter" > FILTERARGS
# echo "/var/indimail/control/domainkeys/private" > DKIMVERIFY
# svc -d /service/qmail-send.25; svc -u /service/qmail-send.25
Testing outbound signatures
Once you have installed your private key file and added your public key to your DNS data, you should test the server and make sure that your outbound message are having the proper signatures added to them. You can test it by sending an email to sa-test (at) sendmail dot net. This reflector will reply (within seconds) to the envelope sender with a status of the DomainKeys and DKIM signatures.
If you experience problems, consult the qmail-dkim man page or post a comment below and I’ll try to help.
You can also use the following for testing.
All the above was quite easy. If you don't think so, you can always use the magic options--dkverify (for verification) or --dksign --private_key=
References
- http://www.brandonturner.net/blog/2009/03/dkim-and-domainkeys-for-qmail/
- http://qmail.jms1.net/patches/domainkeys.shtml
Referense URL:
http://indimail.blogspot.com/
http://indimail.blogspot.com/2009/10/troublesome-mysql-configuration.html
Troublesome MySQL Configuration
Quite a few of users who attempt to install IndiMail first time, face the biggest issue with MySQL installation and configuration. Most of the issues relate to the following- MySQL version less than 5.1: MySQL fails to startup under supervise
- MySQL version less than 5.1: svctool fails to create a default database for IndiMail during rpm installation.
- /etc/my.cnf uses socket=/var/lib/mysql/mysql.sock. IndiMail uses /tmp/mysql.sock. Connection to MySQL fails if you use mysql(1) (without -S opton).
/var/indimail/bin/svc -u /service/mysql.3306
to start up MySQL.
The solution to the second problem is to create a blank MySQL database by running the following command
/var/indimail/bin/svc -d /service/mysql.3306
/bin/rm -r /var/indimail/mysqldb/data
/usr/bin/mysql_install_db --user=mysql --datadir=/var/indimail/mysqldb/data
chown -R mysql:mysql /var/indimail/mysqldb/data
/var/indimail/bin/svc -u /service/mysql.3306
mysql -u root -p
mysql> use mysql;
mysql> update user set password=PASSWORD('some_pass') where user='root';
mysql> CREATE USER indimail identified by 'ssh-1.5-';
mysql> CREATE USER mysql identifed by '4-57343-';
mysql> CREATE USER admin identified by 'benhur20';
mysql> CREATE USER repl identified by 'slaveserver';
mysql> GRANT SELECT,CREATE,ALTER,INDEX,INSERT,UPDATE,DELETE, \
mysql> CREATE TEMPORARY TABLES, \
mysql> LOCK TABLES ON indimail.* to 'indimail';
mysql> GRANT RELOAD,SHUTDOWN,PROCESS,SUPER on *.* to admin;
mysql> GRANT REPLICATION_SLAVE on *.* to repl;
The third problem can be solved by replacing socket=/var/lib/mysql/mysql.sock with socket=/tmp/mysql.sock in /etc/my.cnf or equivalent file.
Changing the Port 25 to 587 for the security purpose:
/var/indimail/sbin/svctool --smtp=587 --servicedir=/service \
--qbase=/var/indimail/queue --qcount=5 --qstart=1 --authsmtp --antispoof \
--cntrldir=control --localip=0 --maxdaemons=150 --maxperip=25 --persistdb \
--starttls --fsync --syncdir --memory=104857600 --chkrecipient --chkrelay --masquerade \
--min-free=52428800 --content-filter --virus-filter \
--qhpsi="/var/indimail/bin/clamdscan %s --quiet --disable-summary" \
--dmasquerade --skipsend \
--dkverify=both --dksign=both --private_key=/var/indimail/control/domainkeys/indimail
posted by Balaji at
3:04 AM
0 Comments
