CentOS Postfix + Dovecot + SASL auth + mySQL + Postfixadmin HowTo

This is a small guide, showing how to install postfix, dovecot and postfixadmin on a server running CentOS.

Main steps:
- install dovecot

# yum install dovecot

- configure dovecot: modify/replace /etc/dovecot.conf. The authentication is defined as sql, which dovecot supports by defaolt on CentOS contents with something similar to this:

protocols = imap pop3
listen =
ssl_disable = yes
mail_location = maildir:~/
mail_debug = no
verbose_proctitle = yes

# id of postfix
first_valid_uid = 89
last_valid_uid = 89

first_valid_gid = 89
last_valid_gid = 89

maildir_copy_with_hardlinks = yes

protocol imap {
mail_plugins = quota imap_quota
imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep
}

protocol pop3 {
pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}

protocol lda {
postmaster_address = postmaster@elegance-net.eu
hostname =
auth_socket_path = /var/run/dovecot/auth-master
}

auth_executable = /usr/libexec/dovecot/dovecot-auth
auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@

auth_debug = no

auth default {
mechanisms = plain login
passdb sql {
args = /etc/dovecot-mysql.conf
}
userdb prefetch {
}
userdb sql {
args = /etc/dovecot-mysql.conf
}
user = nobody
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0666
user = postfix
group = postfix
}
}
}

dict {
}

plugin {
quota = maildir
}

- configure SQL authentication backend for dovecot: create a file, name it dovecot-mysql.conf and place it in /etc:

# file /etc/dovecot-mysql.conf, ver 1.0.7 - 1.1.3 compatible
connect = host=127.0.0.1 port=3306 user=postfix password=mysecretpassword dbname=postfix
driver = mysql
default_pass_scheme = MD5-CRYPT
password_query = SELECT password,CONCAT('/mail/', maildir) AS userdb_home, '89' AS userdb_uid, '89' AS userdb_gid, NULL as allow_nets FROM mailbox WHERE username = '%u' AND domain = '%d' AND active = '1'
user_query = SELECT CONCAT('/mail/', maildir) AS home, '' as mail, '89' AS uid, '89' AS gid, ROUND ( quota / 1024 ) AS quota FROM mailbox WHERE username = %u AND domain = %d

In the above ecample, /mail is the base directory where I store e-mails. I've put 'NULL as allow_nets' because I want to make room for dovecot's 'allow_nets' restrictions support, so I may be able to restrict some user's connecting IP address to a small IP/subnet list. This field is not present on postfixadmin installation, but may be added later to the database structure by modifying 'mailbox' table structure with a tool like phpmyadmin. 89 is postfix's user id, specified statically in dovecot and postfix configuration.


- install development prerequisites: mysql-devel, pcre-devel, rpm-build

# yum install mysql-devel pcre-devel rpm-build

- fetch postfix source RPM from a CentOS mirror and install it

# wget ftp://ftp.iasi.roedu.net/pub/mirrors/centos.org/5.3/os/SRPMS/postfix-2.3.3-2.1.el5_2.src.rpm
# rpm --install -vh postfix-2.3.3-2.1.el5_2.src.rpm

- fetch the VDA (Virtual Delivery Agent) patch for the corresponding postfix version, from http://vda.sourceforge.net/ and move it to /usr/src/redhat/SOURCES, unpack it

# wget http://vda.sourceforge.net/VDA/postfix-2.3.3-vda.patch.gz
# cp postfix-2.3.3-vda.patch.gz /usr/src/redhat/SOURCES
# gzip -d postfix-2.3.3-vda.patch.gz

- copy this text and paste into a file, name it postfix.spec.diff

--- postfix_el5.spec 2008-08-11 14:27:21.000000000 +0300
+++ postfix.spec 2009-10-15 20:41:38.000000000 +0300
@@ -1,7 +1,8 @@
-%define LDAP 2
-%define MYSQL 0
+#%define LDAP 2
+%define MYSQL 1
%define PCRE 1
-%define SASL 2
+#%define SASL 2
+%define DOVECOT_SASL 1
%define TLS 1
%define IPV6 1
%define POSTDROP_GID 90
@@ -12,11 +13,16 @@
# requested but use the preferred SASL V2 if LDAP is not requested.
# Sometime soon LDAP will build agains SASL V2 and this won't be needed.

-%if %{LDAP} <= 1 && %{SASL} >= 2
+%if %{LDAP} && %{SASL} && %{LDAP} <= 1 && %{SASL} >= 2
%undefine SASL
%define SASL 1
%endif

+
+%if %{DOVECOT_SASL}
+%undefine SASL
+%endif
+
%if %{PFLOGSUMM}
%define pflogsumm_ver 1.1.0
%endif
@@ -84,6 +90,8 @@

# Optional patches - set the appropriate environment variables to include
# them when building the package/spec file
+Patch11: postfix-2.3.3-vda.patch
+

BuildRoot: %{_tmppath}/%{name}-buildroot

@@ -98,11 +106,16 @@
Requires: openldap >= 2.0.27
%endif

-%if %{SASL}
-BuildRequires: cyrus-sasl >= 2.1.10, cyrus-sasl-devel >= 2.1.10
-Requires: cyrus-sasl >= 2.1.10
+%if %{DOVECOT_SASL}
+#BuildRequires: dovecot >= 1.0.0, cyrus-sasl-devel >= 2.1.10
+Requires: dovecot >= 1.0.7-7
%endif

+#%if %{SASL}
+#BuildRequires: cyrus-sasl >= 2.1.10, cyrus-sasl-devel >= 2.1.10
+#Requires: cyrus-sasl >= 2.1.10
+#%endif
+
%if %{PCRE}
Requires: pcre
BuildRequires: pcre, pcre-devel
@@ -136,6 +149,7 @@
%patch8 -p1 -b .large-fs
%patch9 -p1 -b .cyrus
%patch10 -p1 -b .CVE-2008-2936
+%patch11 -p1 -b .vda

%if %{PFLOGSUMM}
gzip -dc %{SOURCE53} | tar xf -
@@ -182,19 +196,24 @@
CCARGS="${CCARGS} -DHAS_MYSQL -I/usr/include/mysql"
AUXLIBS="${AUXLIBS} -L%{_libdir}/mysql -lmysqlclient -lm"
%endif
-%if %{SASL}
- %define sasl_v1_lib_dir %{_libdir}/sasl
- %define sasl_v2_lib_dir %{_libdir}/sasl2
- CCARGS="${CCARGS} -DUSE_SASL_AUTH -DUSE_CYRUS_SASL"
- %if %{SASL} <= 1 - %define sasl_lib_dir %{sasl_v1_lib_dir} - AUXLIBS="${AUXLIBS} -L%{sasl_lib_dir} -lsasl" - %else - %define sasl_lib_dir %{sasl_v2_lib_dir} - CCARGS="${CCARGS} -I/usr/include/sasl" - AUXLIBS="${AUXLIBS} -L%{sasl_lib_dir} -lsasl2" - %endif +#%if %{SASL} +# %define sasl_v1_lib_dir %{_libdir}/sasl +# %define sasl_v2_lib_dir %{_libdir}/sasl2 +# CCARGS="${CCARGS} -DUSE_SASL_AUTH -DUSE_CYRUS_SASL" +# %if %{SASL} <= 1 +# %define sasl_lib_dir %{sasl_v1_lib_dir} +# AUXLIBS="${AUXLIBS} -L%{sasl_lib_dir} -lsasl" +# %else +# %define sasl_lib_dir %{sasl_v2_lib_dir} +# CCARGS="${CCARGS} -I/usr/include/sasl" +# AUXLIBS="${AUXLIBS} -L%{sasl_lib_dir} -lsasl2" +# %endif +#%endif + +%if %{DOVECOT_SASL} + CCARGS="${CCARGS} -DUSE_SASL_AUTH -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\"" %endif + %if %{TLS} if pkg-config openssl ; then CCARGS="${CCARGS} -DUSE_TLS `pkg-config --cflags openssl`" @@ -274,17 +293,17 @@ perl -i -pe 's:/cyrus/bin/deliver:/usr/lib/cyrus-imapd/deliver:' $RPM_BUILD_ROOT%{postfix_config_dir}/master.cf cat $RPM_BUILD_ROOT%{postfix_config_dir}/postfix-files -%if %{SASL} -# Install the smtpd.conf file for SASL support. -# See README-Postfix-SASL-RedHat.txt for why we need to set saslauthd_version -# in the v1 version of smtpd.conf -mkdir -p $RPM_BUILD_ROOT%{sasl_v1_lib_dir} -install -m 644 %{SOURCE100} $RPM_BUILD_ROOT%{sasl_v1_lib_dir}/smtpd.conf -echo "saslauthd_version: 2" >> $RPM_BUILD_ROOT%{sasl_v1_lib_dir}/smtpd.conf
-
-mkdir -p $RPM_BUILD_ROOT%{sasl_v2_lib_dir}
-install -m 644 %{SOURCE100} $RPM_BUILD_ROOT%{sasl_v2_lib_dir}/smtpd.conf
-%endif
+#%if %{SASL}
+## Install the smtpd.conf file for SASL support.
+## See README-Postfix-SASL-RedHat.txt for why we need to set saslauthd_version
+## in the v1 version of smtpd.conf
+#mkdir -p $RPM_BUILD_ROOT%{sasl_v1_lib_dir}
+#install -m 644 %{SOURCE100} $RPM_BUILD_ROOT%{sasl_v1_lib_dir}/smtpd.conf
+#echo "saslauthd_version: 2" >> $RPM_BUILD_ROOT%{sasl_v1_lib_dir}/smtpd.conf
+#
+#mkdir -p $RPM_BUILD_ROOT%{sasl_v2_lib_dir}
+#install -m 644 %{SOURCE100} $RPM_BUILD_ROOT%{sasl_v2_lib_dir}/smtpd.conf
+#%endif

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
install -m 644 %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/smtp.postfix
@@ -382,10 +401,10 @@

# Config files not part of upstream

-%if %{SASL}
-%config(noreplace) %{sasl_v1_lib_dir}/smtpd.conf
-%config(noreplace) %{sasl_v2_lib_dir}/smtpd.conf
-%endif
+#%if %{SASL}
+#%config(noreplace) %{sasl_v1_lib_dir}/smtpd.conf
+#%config(noreplace) %{sasl_v2_lib_dir}/smtpd.conf
+#%endif
%config(noreplace) %{_sysconfdir}/pam.d/smtp.postfix
%attr(0755, root, root) %config /etc/rc.d/init.d/postfix

- Apply this patch to the original .spec file to enable MySQL, Dovecot SASL, TLS and Virtual Delivery Agent support to this build:

# cd /usr/src/redhat/SPECS
# patch -p0 < /path/to/the_recently_created/postfix.spec.diff

- Build the package

# rpmbuild -bb /usr/src/redhat/SPECS/postfix.spec
# rpmbuild -bs /usr/src/redhat/SPECS/postfix.spec

- Install your new postfix package, now able to handle virtual users, postfixadmin, TLS and SASL authentication, with dovecot integration

# cd /usr/src/redhat/RPMS/{architecture}/
# rpm --install -vh postfix-2.3.3-2.1.i386.rpm

- Enable automatic startup of postfix, using the system-switch-mail tool, or using chkconfig

- Save a copy of the updated source RPM, you may need the patched .spec file later...

# cp /usr/src/redhat/SRPMS/postfix-2.3.3-2.1.src.rpm /to/your/backup/area/

- Install postfixadmin, set it up, and start administering your mailboxes
- Configure postfix to use the MySQL lookup tables
- Take care when updating system to avoid updating it with a non-compliant build, or add postfix to the protected/excluded packages form yum updates

Apache .htaccess: how to get rid of 'RewriteEngine not allowed here'

Apache error: RewriteEngine not allowed here

A friend of mine has changed his web hosting server, and since that moment one of it's web pages stopped showing. The page displayed instead was a generic page from the Apache web server, telling that there was an internal error and to check the logs.
Here's a line from the log:

[Tue Aug 25 17:07:39 2009] [alert] [client xx.xx.xx.xx] /usr/local/www/htdocs/.htaccess: RewriteEngine not allowed here

I tried to find the answer on the net, and after a short google search and after reading a little bit of apache docs, I found the answer.


How this appeared?

My friend's web site includes a file called .htaccess, which usually is populated with directives for the apache web server. In a default apache setup, this file is read on web page access, but only if the main configuration directives (from httpd.conf or vhost configuration file) allow this. This is specified by the 'AllowOverride AuthConfig' directive. Since I've seen the error, AllowOverride AuthConfig was 'On', so the .htaccess file was processed, but some of it's content is not permitted in this context.


How to allow RewriteEngine on directive in .htaccess

All I needed to do is to modify the apache configuration file referring to htdocs directory. In my case it was the virtual host definition file, but it may be the main apache config file, httpd.conf. I've changed the <directory> section from

<Directory /path/to/htdocs/>
Options +FollowSymLinks
AllowOverride AuthConfig
Order allow,deny
Allow from all
<Directory>

to

<Directory /path/to/htdocs/>
Options +FollowSymLinks
AllowOverride AuthConfig FileInfo
Order allow,deny
Allow from all
<Directory>

And it fixed the problem.

Instanțe apache 2 multiple pe FreeBSD

Mi s-a întâmplat de câteva ori să am nevoie să rulez mai multe instanțe de server apache pe un server. Deși metoda folosirii virtualhost este adesea suficientă, unicitatea anumitor directive din fișierul de configurare httpd.conf face necesară rularea de instanțe multiple.
Una dintre metodele de a rula mai multe servere apache concomitent este folosirea conceptului FreeBSD 'jail', care conferă o multitudine de avantaje, cum ar fi posibilitatea de a instala doar extensiile php strict necesare respectivei instanțe și izolarea mai bună față de server, dar punerea pe picioare a unui jail poate dura destul de mult.

O variantă alternativă este folosirea de profile de instanță apache distincte, care partajează același set de librării și extensii php, însă folosind fișiere de configurare diferite, lucru facilitat chiar de scriptul de pornire a serverului instalat de pachetul apache22. Pentru fiecare profil configurat, urmează a se pune în execuție câte un proces apache, cu setări specifice.
Astfel, în fișierul global de configurare a sistemului, /etc/rc.conf, directivele referitoare la apache22 se extind față de directivele uzuale:

# directive apache22 clasice, comune
apache22_enable="YES"
apache22_http_accept_load="YES"
apache22_http_accept_enable="YES"

# Directive apache22 care permit folosirea de profile
apache22_profiles="default p1"
apache22_default_enable="YES"
apache22_default_http_accept_enable="YES"
apache22_default_configfile="/usr/local/etc/apache22/httpd.conf"
apache22_p1_enable="YES"
apache22_p1_http_accept_enable="YES"
apache22_p1_configfile="/usr/local/etc/apache22/httpd-p1.conf"

Acum voi detalia semnificația directivelor suplimentare

apache22_profiles="p1 p2 p3"

indică scriptului /usr/local/etc/rc.d/apache22 să folosească instanțe multiple, instanțe identificate prin lista separată cu spații. Pentru fiecare profil, fișierul /etc/rc.conf va trebui să includă câte un set de directive de forma "apache22_profil_directiva=valoare".

Directivele specifice fiecărui profil sunt:

apache22_profil_configfile="/cale/catre/fisier/configurare/httpd.profil.conf"
apache22_profil_enable="YES|NO"
apache22_profil_flags="alte_directive_pentru_httpd_specifice_pentru_acest_profil"
apache22_profil_http_accept_enable="YES|NO"
apache22_profil_limits_enable="YES|NO"
apache22_profil_limits_args="limits_args"
apache22_profil_fib="FIB"

Este strict necesară indicarea fișierului de configurare al respectivului profil, toate celelalte directive fiind opționale. O directivă interesantă este "FIB", care nu poate avea efect decât pe FreeBSD mai recent de 7.1, care se referă la 'Forward Information Base' (FIB) asociat cu respectiva instanță apache. Începând de la versiunea 7.1, FreeBSD poate folosi multiple FIB-uri, lucru care permite folosirea de tabele de rutare diferite pentru procese diferite.

În continuare, se crează fișierul de configurare httpd-profil.conf specific respectivului profil, probabil pornind de la o versiune salvată sau de la fișierul de configurare inclus în distribuția Apache22. Va trebui să ajustați câteva setări importante: adresa IP si portul folosit de profil, amplasarea DocumentRoot, si în mod special amplasarea log-urilor, pentru a nu fi scrise în același loc cu logurile altor profile. Atenție mare și la adresa IP/port, dacă sunt mai multe servicii configurate să foloseasca acelasi IP și același port, uul dintre ele nu va putea porni.

Pentru pornirea tuturor instanțelor apache nu mai rămâne de făcut decât:

/usr/local/etc/rc.d/apache22 start

FreeBSD - Conexiune wireless securizată WPA

Pentru reduce riscului de interceptare a comunicațiilor wireless între sistemul FreeBSD și access-point, exploatându-se o rețea wireless absolut nesecurizată ("autorizare" Open System) sau securizată cu un standard slab (WEP), există posibilitatea folosirii unui standard de codificare mai solid, WPA. Pentru configurare, urmați pașii:

- se setează in /etc/rc.conf parametrii:
ifconfig_ral0="WPA up"
ifconfig_ral0_alias0="inet 192.168.0.1 netmask 255.255.255.0"
wpa_supplicant_enable="YES"

Adaptati numele plăcii de retea la situația locală, în exemplul de mai sus am folosit un adaptor PCI Wireless Ralink

- se setează în /etc/wpa_supplicant.conf parametrii referitori la rețeaua wireless: SSID și cheia de securitate
network={
ssid="netname"
psk="yourS3cr3+"
}

"ssid" este numele retelei, iar "psk" este cheia pre-shared.

- Restartați rețeaua și serviciul wpa_supplicant:
# /etc/rc.d/netif restart
# /etc/rc.dwpa_supplicant restart
# /etc/rc.d/routing restart