Back to the sea ; the mail server (SMTP, IMAP, GreyList, RBL…), episode X

Like I did with NetBSD, this is how to build an almost complete Mail Server with OpenBSD.

We’re gonna use a Dovecot IMAP server and a Postfix SMTP server. Postfix will use Dovecot as a SASL service. Both will use LDAP to identify valid users and e-mail aliases. Mail sanitization will be provided by RBL, from Postfix, and by the spamd shipped with OpenBSD.

Prerequisites

You’ll need an OpenBSD server and a few depending services:

  • a DNS server ;
  • a LDAP server ;
  • a CA ; if you don’t use external certificate services.

The previous articles from the series explain how to implement those services.

Installation

Start with installing Postfix and Dovecot from the binary packages:

# pkg_add http://ftp.fr.openbsd.org/pub/OpenBSD/4.8/packages/amd64/postfix-2.7.1-ldap.tgz
# pkg_add http://ftp.fr.openbsd.org/pub/OpenBSD/4.8/packages/amd64/dovecot-1.2.13p0-ldap.tgz

The server certificate should already be installed from the previous articles steps ; I use the same DNS/CN name as I only have one publically known certificate:

# file /etc/ssl/server.crt /etc/ssl/private/server.key
/etc/ssl/server.crt: ASCII text
/etc/ssl/private/server.key: ASCII text

Create the virtual mail storage space:

# groupadd -g 3000 vmail
# useradd -m -u 3000 -g vmail -c "Virtual Mail" -d /home/vmail -s /sbin/nologin vmail
# rm -rf /home/vmail/.??*
# chmod 750 /home/vmail

Configure the system to allow services to trust my private CA ; this is required for LDAPS connection:

# cat >> /etc/openldap/ldap.conf
TLS_CACERT /etc/ssl/TMFCA/cacert.pem

Configuration

We’ll first configure the IMAP server, then the SMTP server.
This is because Postfix needs a socket from Dovecot to authenticate users.

The IMAP server (Dovecot)

Modify the main configuration file:

# diff /usr/local/share/examples/dovecot/dovecot-example.conf /etc/dovecot.conf
23c23
< #protocols = imap imaps
---
> protocols = imaps
98,99c98,99
< ssl_cert_file = /etc/ssl/dovecotcert.pem
< #ssl_key_file = /etc/ssl/private/dovecot.pem
---
> ssl_cert_file = /etc/ssl/server.crt
> ssl_key_file = /etc/ssl/private/server.key
146c146
< #login_chroot = yes
---
> login_chroot = yes
302,303c302,303
< #mail_uid =
< #mail_gid =
---
> mail_uid = vmail
> mail_gid = vmail
376c376
< #verbose_proctitle = no
---
> verbose_proctitle = yes
619c619
< protocol pop3 {
---
> #protocol pop3 {
699,700c699,700
<   pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
< }
---
> #  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
> #}
844c844
< #auth_verbose = no
---
> auth_verbose = yes
968c968
<   passdb bsdauth {
---
>   #passdb bsdauth {
971c971
<   }
---
>   #}
996c996
<   #passdb ldap {
---
>   passdb ldap {
998,999c998,999
<     #args =
<   #}
---
>     args = /etc/dovecot-ldap.conf
>   }
1027c1027
<   userdb passwd {
---
>   #userdb passwd {
1034c1034
<   }
---
>   #}
1074c1074
<   #userdb ldap {
---
>   userdb ldap {
1076,1077c1076,1077
<     #args =
<   #}
---
>     args = /etc/dovecot-ldap.conf
>   }
1089c1089
<   user = root
---
>   user = nobody
1108c1108
<   #socket listen {
---
>   socket listen {
1119c1119
<     #client {
---
>     client {
1123,1126c1123,1128
<       #path = /var/run/dovecot/auth-client
<       #mode = 0660
<     #}
<   #}
---
>       path = /var/spool/postfix/private/auth
>       mode = 0660
>       user = _postfix
>       group = _postfix
>     }
>   }

Create the LDAP authentication configuration file:

# install -o _dovecot -g _dovecot -m 0640 /usr/local/share/examples/dovecot/dovecot-ldap-example.conf /etc/dovecot-ldap.conf
# diff /usr/local/share/examples/dovecot/dovecot-ldap-example.conf /etc/dovecot-ldap.conf
21c21
< #uris =
---
> uris = ldaps://ldap.tumfatig.net
25c25
< #dn =
---
> dn = cn=email,dc=tumfatig,dc=net
28c28
< #dnpass =
---
> dnpass = password
66c66
< #auth_bind = no
---
> auth_bind = yes
82c82
< #auth_bind_userdn =
---
> auth_bind_userdn = uid=%u,ou=users,dc=tumfatig,dc=net
85c85
< #ldap_version = 3
---
> ldap_version = 3
89c89
< base =
---
> base = ou=users,dc=tumfatig,dc=net
106c106
< #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid
---
> user_attrs = homeDirectory=home,mailbox=mail
113c113
< #user_filter = (&(objectClass=posixAccount)(uid=%u))
---
> user_filter = (&(objectClass=CourierMailAccount)(uid=%u))
121c121
< #pass_attrs = uid=user,userPassword=password
---
> pass_attrs = uid=user,userPassword=password
131c131
< #pass_filter = (&(objectClass=posixAccount)(uid=%u))
---
> pass_filter = (&(objectClass=CourierMailAccount)(uid=%u))

Configure the system to start Dovecot at boot ime:

# cat >> /etc/login.conf
dovecot:
        :openfiles-cur=1024:
        :openfiles-max=2048:
        :tc=daemon:
# cat >> /etc/rc.local
if [ -x /usr/local/sbin/dovecot ]; then
        echo -n ' dovecot';
        su -c dovecot root -c '/usr/local/sbin/dovecot'
fi

Start Dovecot and check the logs.

The SMTP server (Postfix)

OpenBSD ships with Sendmail by default. But it can be replaced with Postfix, from the binary packages.

Enable Postfix:

# /usr/local/sbin/postfix-enable
# cat >> /etc/rc.conf.local
sendmail_flags="-bd"
# vi /etc/syslog-ng/syslog-ng.conf
(...)
unix-dgram ("/var/spool/postfix/dev/log");
(...)
# crontab -e
(...)
# sendmail clientmqueue runner
#*/30   *       *       *       *       /usr/sbin/sendmail -L sm-msp-queue -Ac -q

Edit the main configuration file:

# diff /usr/local/share/examples/postfix/main.cf /etc/postfix/main.cf
76c76
< #myhostname = virtual.domain.tld
---
> myhostname = cherie.tumfatig.net
99c99
< #myorigin = $mydomain
---
> myorigin = $mydomain
163c163
< #mydestination = $myhostname, localhost.$mydomain, localhost
---
> mydestination = localhost
263c263
< #mynetworks = 168.100.189.0/28, 127.0.0.0/8
---
> mynetworks = 10.0.0.0/24, 127.0.0.0/8
295c295,296
< #relay_domains = $mydestination
---
> relay_domains = hash:/etc/postfix/relay_transport
> relay_transport = $relay_domains
314c315
< #relayhost = [mailserver.isp.tld]
---
> relayhost = smtp.free.fr
330c331
< #relay_recipient_maps = hash:/etc/postfix/relay_recipients
---
> relay_recipient_maps = hash:/etc/postfix/relay_recipients
358a360,361
> virtual_mailbox_domains = $transport_maps
> virtual_mailbox_base = /home/vmail
359a363,369
> virtual_minimum_uid = 3000
> virtual_uid_maps = static:3000
> virtual_gid_maps = static:3000
>
> virtual_mailbox_maps = ldap:/etc/postfix/ldap_accounts
> virtual_alias_maps = ldap:/etc/postfix/ldap_aliases
>
366a377
> transport_maps = hash:/etc/postfix/transport
511a523,526
> disable_vrfy_command = yes
> smtpd_delay_reject = yes
> smtpd_helo_required = yes
> strict_rfc821_envelopes = yes
512a528,560
> smtpd_client_restrictions =
>       permit_mynetworks,
>       check_client_access hash:/etc/postfix/access_client,
>       permit_sasl_authenticated,
>       reject_unauth_pipelining,
>       reject_rbl_client bl.spamcop.net,
>       reject_rbl_client zen.spamhaus.org,
>       reject_rbl_client cbl.abuseat.org,
>       permit
>
> smtpd_helo_restrictions =
>       permit_mynetworks,
>       check_helo_access hash:/etc/postfix/access_helo,
>       reject_invalid_helo_hostname,
>       reject_non_fqdn_helo_hostname,
>       reject_unknown_helo_hostname,
>       permit
>
> smtpd_sender_restrictions =
>       permit_mynetworks,
>       reject_non_fqdn_sender,
>       reject_unknown_sender_domain,
>       reject_rhsbl_sender dsn.rfc-ignorant.org,
>       permit
>
> smtpd_recipient_restrictions =
>       permit_mynetworks,
>       reject_non_fqdn_recipient,
>       reject_unknown_recipient_domain,
>       reject_unauth_destination,
>       permit_sasl_authenticated,
>       permit
>
654a703,725
>
> # TLS configuration
> #
> smtpd_tls_cert_file = /etc/ssl/server.crt
> smtpd_tls_key_file = /etc/ssl/private/server.key
>
> smtpd_tls_loglevel = 1
> smtpd_tls_security_level = may
>
> smtpd_tls_auth_only = yes
>
> smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache
> smtpd_tls_session_cache_timeout = 3600s
>
> # SASL configuration
> #
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_type = dovecot
> smtpd_sasl_path = private/auth
>
> smtpd_sasl_security_options = noanonymous, noplaintext
> smtpd_sasl_tls_security_options = noanonymous

Create the LDAP configuration files:

# cat /etc/postfix/ldap_accounts
server_host = ldaps://ldap.tumfatig.net
search_base = ou=users,dc=tumfatig,dc=net
query_filter = (&(mail=%s)(objectClass=CourierMailAccount))
result_attribute = mailbox
version = 3
bind = yes
bind_dn = cn=email,dc=tumfatig,dc=net
bind_pw = password
# cat /etc/postfix/ldap_aliases
server_host = ldaps://ldap.tumfatig.net
search_base = ou=alias,dc=tumfatig,dc=net
query_filter = (&(mail=%s)(objectClass=CourierMailAlias))
result_attribute = maildrop
version = 3
bind = yes
bind_dn = cn=email,dc=tumfatig,dc=net
bind_pw = password
# chgrp _postfix /etc/postfix/ldap_a*
# chmod 0640 /etc/postfix/ldap_a*
# postmap /etc/postfix/ldap_accounts /etc/postfix/ldap_aliases

Create the other external references:

# cat > /etc/postfix/relay_transport
other.tld     smtp:10.15.5.12
# cat > /etc/postfix/relay_recipients
friend@other.tld  OK
abuse@other.tld       OK
postmaster@other.tld  OK
webmaster@other.tld   OK
# cat > /etc/postfix/transport
tumfatig.net            virtual:
carnat.net              virtual:
# cat > /etc/postfix/access_client
# cat > /etc/postfix/access_helo
funky.smtp.server.tld  OK
# postmap /etc/postfix/relay_transport /etc/postfix/relay_recipients /etc/postfix/transport /etc/postfix/access_client /etc/postfix/access_helo

In OpenBSD, Postfix is chrooted and requires access to files from within its jail:

# tar cpf - /etc/openldap/ldap.conf /etc/ssl/TMFCA/cacert.pem | tar xpf - -C /var/spool/postfix/

Reboot and check that everything loaded OK.

The SPAM Deferral daemon (spamd)

I used to use Postgrey with Postfix to greylist e-mails. This works quite well for direct connections.
OpenBSD ships with a daemon that does greylisting. It’s a bit different in the way it works.

Configure pf to redirect SMTP traffic to spamd:

# vi /etc/pf.conf
table  persist
table  persist file "/etc/mail/nospamd"
pass in on egress proto tcp from any to any port smtp 
        rdr-to 127.0.0.1 port spamd
pass in on egress proto tcp from  to any port smtp
pass in log on egress proto tcp from  to any port smtp
pass out log on egress proto tcp to any port smtp
# touch /etc/mail/nospamd

Have to daemons start at boot time:

# vi /etc/rc.conf.local
spamd_flags=""
spamlogd_flags=""

Reboot to ensure everything starts correctly.

The submission feature

One problem with spamd is that without having previously whitelisted a triple (source, from, to), the SMTP connexion would have a change to get to the AUTH phase. This isn’t a nice feature for mobile users that must authenticate to the SMTP server to be allowed to relay. According to OpenBSD’s mailing list, the right way to deal with mobile users is either use authpf or dedicate a submission port on the SMTP server.

Configure the “authenticate and allow relay port”:

# vi /etc/postfix/master.cf
(...)
submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
(...)
# postfix reload

The configuration is quite straight forward as we already configured the authentication stuff on the normal SMTP port 😉

That’s All Chicks!

2 Comments

  • Back to the sea ; the OpenBSD services, episode I | TuM'Fatig Fri, 14 Jan 2011 21:48:29 +0000 Reply

    […] the mail server (SMTP, IMAP, GreyList, RBL…) […]

  • SOGo: backend on Debian, Web frontend on NetBSD | TuM'Fatig Wed, 09 Feb 2011 11:48:55 +0000 Reply

    […] provide Web, CalDAV and CardDAV access to you e-mail and web clients. You can check my NetBSD and OpenBSD articles to see how to build the backend Mail/Directory/SQL services. Once this is done, you can […]

Leave a Reply

Your email address will not be published. Required fields are marked *

*

%d bloggers like this: