Category: Email

Renew self-signed IMAPS/POP certificates on Plesk server

May 2, 2008

With courier-imap, if the self signed certificate used by IMAPS or POPS expires then use this procedure to issue a new certificate: 1. Edit /usr/share/courier-imap/mkimapdcert and add a -set-serial option to the openssl “req” line like “-set_serial 2”. 2. Optional: On the same line change “-days 365” to increase the validity period for the certificate. 3. Optional: Edit /etc/courier-imap/imapd.cnf to set certificate contents. 4. Remove the old certificate at /usr/share/courier-imap/imapd.pem 5. Run /usr/sbin/mkimapdcert 6. Restart courier with “/sbin/service courier-imap restart” 7. Edit /usr/share/courier-imap/mkpop3dcert and add a -set-serial option to the openssl “req” line like “-set_serial 2”. 8. Optional: On the same line change “-days 365” to increase the validity period for the certificate. 9. Optional: Edit /etc/courier-imap/pop3d.cnf to set certificate contents. 10. Remove the old certificate at /usr/share/courier-imap/pop3d.pem 11. Run /usr/sbin/mkpop3dcert 12. Restart courier with “/sbin/service courier-imap restart”

Bind Zimbra On Specific IP Address

March 29, 2008

Here’s how to configure Zimbra services to bind to a specific IP address. These instructions apply to ZCS 5.x only. Assume that the IP address is [IP]. SMTP (TCP 25) Edit /opt/zimbra/postfix/conf/master.cf. Change:

smtp      inet  n       -       n       -       -       smtpd

1 2	smtp inet n - n - - smtpd

To:

[IP]:smtp      inet  n       -       n       -       -       smtpd

1	[IP]:smtp inet n - n - - smtpd

WEB (TCP 80/443/admin ports) Edit /opt/zimbra/jetty/etc/jetty.xml.in After every line starting with:

<Set name="port">

1 2	<Set name="port">

Add:

<Set name="host">[IP]</Set>

1	<Set name="host">[IP]</Set>

POP/IMAP Su to zimbra account. Start zmprov:

./zmprov -s [IP]

1	./zmprov -s [IP]

Determine server name:

gas

gas

Change bind addresses:

ms [DOMAIN] zimbraPop3BindAddress [IP]
ms [DOMAIN] zimbraPop3SSLBindAddress [IP]
ms [DOMAIN] zimbraImapBindAddress [IP]
ms [DOMAIN] zimbraImapSSLBindAddress [IP]

ms [DOMAIN] zimbraPop3BindAddress [IP]

ms [DOMAIN] zimbraPop3SSLBindAddress [IP]

ms [DOMAIN] zimbraImapBindAddress [IP]

ms [DOMAIN] zimbraImapSSLBindAddress [IP]

One additional trick is needed. Add these two IPTables rules to map 127.0.0.1:7071 to [IP]:7071.


/sbin/iptables -t nat -A PREROUTING -p tcp --destination 127.0.0.1  \
   --dport 7071 -j DNAT --to-destination [IP]
/sbin/iptables -t nat -A OUTPUT -p tcp --destination 127.0.0.1  \
   --dport 7071 -j DNAT --to-destination [IP]
/sbin/iptables -t nat -A PREROUTING -p tcp --destination 127.0.0.1  \
   --dport 80 -j DNAT --to-destination [IP]
/sbin/iptables -t nat -A OUTPUT -p tcp --destination 127.0.0.1  \
   --dport 80 -j DNAT --to-destination [IP]
/sbin/service iptables restart
/sbin/service iptables save

/sbin/iptables -t nat -A PREROUTING -p tcp --destination 127.0.0.1 \

--dport 7071 -j DNAT --to-destination [IP]

/sbin/iptables -t nat -A OUTPUT -p tcp --destination 127.0.0.1 \

--dport 7071 -j DNAT --to-destination [IP]

/sbin/iptables -t nat -A PREROUTING -p tcp --destination 127.0.0.1 \

--dport 80 -j DNAT --to-destination [IP]

/sbin/iptables -t nat -A OUTPUT -p tcp --destination 127.0.0.1 \

--dport 80 -j DNAT --to-destination [IP]

/sbin/service iptables restart

/sbin/service iptables save

Postfix + Spam Assassin + ClamAV on RHEL

February 14, 2008

Some notes on setting up a Postfix server to use ClamAv and SpamAssassin. Follow the steps below to set this up on a normal Redhat box with a default Postfix setup. See step 8 for a bonus trick with header_checks to enable spam deletion. 1) Create two service accounts (set shell to /bin/false):

   
   clamav
   spamfilter

clamav

spamfilter

2) Install the latest ClamAV. Configure it to run as the “clamav” user (which is the default I think). Add “/usr/local/sbin/clamd” to rc.local. Find the clamd.conf (defaults to /usr/local/etc or /etc), and make the following settings:


#Example (you have to add the # sign to comment this out, or clamd won't start)
LocalSocket /tmp/clamd.socket
TCPSocket 3310
TCPAddr 127.0.0.1

#Example (you have to add the # sign to comment this out, or clamd won't start)

LocalSocket /tmp/clamd.socket

TCPSocket 3310

TCPAddr 127.0.0.1

Also update freshclam.conf (the Example line has to be commented out in it as well), run freshclam and add a cron job to run freshclam on a regular basis. Start clamd before proceeding to step 3. 3) Download and install a package called clamsmtp (http://memberwebs.com/stef/software/clamsmtp/). No configure options needed. After doing the make install, create /usr/local/etc/clamsmtpd.conf with the following

Add RBL to Postfix

January 22, 2008

Add the following line to the bottom of /etc/postfix/main.cf or extend the existing smtpd_client_restrictions line:

smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net

1	smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net

Whitelist host on qmail install

July 28, 2007

To whitelist a host on a qmail install (qmailrocks in this case) do the following: Edit /etc/tcp.smtp and add this line:

XXX.XXX.XXX.:allow,RBLSMTPD=""

1	XXX.XXX.XXX.:allow,RBLSMTPD=""

Replacing XXX.XXX.XXX. with the ip of the host to be whitelisted. Next rebuild the cdb file with:

qmailctl cdb

1	qmailctl cdb

This first procedure prevents RBL checks on the host. To whitelist a host or domain in spam assassin, edit vi /etc/mail/spamassassin/local.cf and add a line like this: