Courier Mail Server

marc lindahl writes: 

>  
>  
>> From: Sam Varshavchik <mrsam@...> 
>> 
>> Most likely you failed to configure PAM to authenticate the imap service.
>> See INSTALL. 
>  
> OK, moving along....
>  
> It turns out you need to create a Maildir in each user's home directory.
> May seem obvious but it's not in the INSTALL instructions, and I'm starting
> from a fresh RH7.2, and as an ex-sendmail I'm unfamiliar with Maildirs (and
> by default they are not created by the system.  But I think I solved that by
> making one in /etc/skel which will then be copied to any newly created
> account). 

The RH 7.2 RPMs will update /etc/skel automatically, so new accounts will 
receive $HOME/Maildir. 

> But for some reason, I can't do it from another machine.  I'm wondering is
> xinetd getting in the way, or is there some reason why it's letting me
> telnet (to port 143) from local but not remotely?

Courier does not use xinetd. 

You most likely have a firewall ipchains table.  See Red Hat's documentation 
for instructions on reconfiguring ipchains. 


-- 
Sam

> From: Sam Varshavchik <mrsam@...>
> 
> The RH 7.2 RPMs will update /etc/skel automatically, so new accounts will
> receive $HOME/Maildir.

There's RH7.2 RPMs for courier?  Where?  That probably would have saved me
alot of time!

> You most likely have a firewall ipchains table.  See Red Hat's documentation
> for instructions on reconfiguring ipchains.

Yeah, that's what it was.... during setup I config'd it for a 'weak'
firewall.  For now, I disabled ipchains (fortunately there's a webmin module
for it, so that was easy)

THanks!


p.s. a couple questions about smptd:

1. is there something like poprelayd or pop-before-smtp  to dynamically
update allowed relays?  (Would it work also with IMAP logins, hopefully?)
2. anyone have any idea (before I put this online) how effective the
'require authorization' option is at stopping spam?
3. is there a way to open up the allowed relays to, er, anything?

marc lindahl writes: 

>  
> 
>> From: Sam Varshavchik <mrsam@...> 
>> 
>> The RH 7.2 RPMs will update /etc/skel automatically, so new accounts will
>> receive $HOME/Maildir.
> 
> There's RH7.2 RPMs for courier?  Where?

http://www.courier-mta.org/status.html 

> 1. is there something like poprelayd or pop-before-smtp  to dynamically
> update allowed relays?  (Would it work also with IMAP logins, hopefully?)

No. 

> 2. anyone have any idea (before I put this online) how effective the
> 'require authorization' option is at stopping spam?

It would be wise for you to actually read what that option does, instead of 
speculating. 

-- 
Sam

> From: Sam Varshavchik <mrsam@...>
>> 
>> There's RH7.2 RPMs for courier?  Where?
> 
> http://www.courier-mta.org/status.html

I see instructions on how to build my own RPMs from the source, but I don't
see a link to any built RPMs, and didn't see them on the sourceforge ftp
site....  that's why I installed from source, what's the point of building
your own RPM and then installing it, if you're just doing one machine?


>> 2. anyone have any idea (before I put this online) how effective the
>> 'require authorization' option is at stopping spam?
> 
> It would be wise for you to actually read what that option does, instead of
> speculating. 

The only reference I could find among the somewhat scattered documentation
was http://www.courier-mta.org/install.html#esmtpauth which tells me that an
auth step (in my case PAM) similar to that used to check mail is performed
before sending mail.  Seems like that would make it harder for my smtp to be
used as an unauthorized relay.

Regardless, my question was directed to any experienced mail administrators
out there, and their empirical observations regarding this issue.

On Sun, 3 Feb 2002, marc lindahl wrote:

>  I see instructions on how to build my own RPMs from the source, but I
>  don't see a link to any built RPMs, and didn't see them on the
>  sourceforge ftp site....  that's why I installed from source, what's
>  the point of building your own RPM and then installing it, if you're
>  just doing one machine?

It's easy, and you can apply any or no optimisations. Just do it, don't
worry about it. Works perfectly.

-- 
Juha
Take off every sig!

> From: Juha Saarinen <juha@...>
> 
> On Sun, 3 Feb 2002, marc lindahl wrote:
> 
>> I see instructions on how to build my own RPMs from the source, but I
>> don't see a link to any built RPMs, and didn't see them on the
>> sourceforge ftp site....  that's why I installed from source, what's
>> the point of building your own RPM and then installing it, if you're
>> just doing one machine?
> 
> It's easy, and you can apply any or no optimisations. Just do it, don't
> worry about it. Works perfectly.
>

So what's the advantage to doing this, rather than installing from the
source?

On Sat, 2002-02-02 at 23:17, marc lindahl wrote:
>=20
> I see instructions on how to build my own RPMs from the source, but I don=
't
> see a link to any built RPMs, and didn't see them on the sourceforge ftp
> site....  that's why I installed from source, what's the point of buildin=
g
> your own RPM and then installing it, if you're just doing one machine?

Le'see... The build and install are scripted, so you can't screw them
up.  Upgrades won't wipe out config files.  You can choose to install
parts of courier, rather than the whole things...

There's plenty of good reasons.

> >> 2. anyone have any idea (before I put this online) how effective the
> >> 'require authorization' option is at stopping spam?
> >=20
> > It would be wise for you to actually read what that option does, instea=
d of
> > speculating.=20
>=20
> The only reference I could find among the somewhat scattered documentatio=
n
> was http://www.courier-mta.org/install.html#esmtpauth which tells me that=
 an
> auth step (in my case PAM) similar to that used to check mail is performe=
d
> before sending mail.  Seems like that would make it harder for my smtp to=
 be
> used as an unauthorized relay.

Exactly.  It's relay authentication.  It has nothing to do with incoming
SPAM (which your request sounded like you expected).  If you *only*
relay messages for people who authenticate, then spammers would have to
sniff someone's password, or otherwise break into their account to use
you as a relay.

Relay authentication removes the need for pop-before-smtp, or other
silly (and crude) hacks.

On Sun, 3 Feb 2002, marc lindahl wrote:

>
>  So what's the advantage to doing this, rather than installing from the
>  source?

The advantage is that Sam has kindly written a SPEC file for the RPM
package, that puts stuff where it belongs in the RHL file system layout;
it also provides the RHL init scripts. Also, if you stick to RPM packages,
you'll find upgrading much less of a chore.

-- 
Juha
Take off every sig!

marc lindahl writes: 

>  
> 
>> From: Sam Varshavchik <mrsam@...>
>>> 
>>> There's RH7.2 RPMs for courier?  Where?
>> 
>> http://www.courier-mta.org/status.html
> 
> I see instructions on how to build my own RPMs from the source, but I don't
> see a link to any built RPMs, and didn't see them on the sourceforge ftp
> site....  that's why I installed from source, what's the point of building
> your own RPM and then installing it, if you're just doing one machine?

Makes upgrades easier. 

Integrity verification. 

Things happen.  You may need to rebuild the machine, for some reason. 

> 
>>> 2. anyone have any idea (before I put this online) how effective the
>>> 'require authorization' option is at stopping spam?
>> 
>> It would be wise for you to actually read what that option does, instead of
>> speculating. 
> 
> The only reference I could find among the somewhat scattered documentation
> was http://www.courier-mta.org/install.html#esmtpauth which tells me that an
> auth step (in my case PAM) similar to that used to check mail is performed
> before sending mail.  Seems like that would make it harder for my smtp to be
> used as an unauthorized relay.

Right.  Except that nobody will be able to send you any mail, since it is 
unlikely that every other mail relay in the world knows the userid and 
password for your mail server. 

This option is designed to be used on port 587 only, the message submission 
protocol, which requires authentication. 


-- 
Sam

> From: Sam Varshavchik <mrsam@...>
> 
> Makes upgrades easier.
> 
> Integrity verification.

Sold!

> 
> Things happen.  You may need to rebuild the machine, for some reason.

True... I already have remade courier a few times while learning about the
various options, etc.



> Right.  Except that nobody will be able to send you any mail, since it is
> unlikely that every other mail relay in the world knows the userid and
> password for your mail server.

True... Doh!

> 
> This option is designed to be used on port 587 only, the message submission
> protocol, which requires authentication.

I know Outlook Express 5 is a P.O.S. but does anyone know if it supports
port 587?

Hey... what about this idea - on port 25, requiring authorization to relay,
but no authorization to deliver to any locally configured (hosted or
specifically set up relays) mailboxes?