Difference between revisions of "Email/fr"

From SME Server
Jump to: navigation, search
m (Serveur seulement)
m (Erreurs qpsmtpd «Connection Timed Out»)
 
Line 14: Line 14:
 
Si le Serveur SME ne reçoit pas de courrier, vous devez vous assurer que les connexions SMTP atteignent votre serveur SME (paramètres DNS, configuration du routeur, blocs de ports ISP) et vous devez examiner les journaux /var/log/qpsmtpd/current pour déterminer ce que le Serveur SME fait avec les connexions entrantes. La plupart des problèmes sont des problèmes de DNS, de routeur ou d'ISP et n'ont rien à voir avec le fonctionnement ou la configuration du serveur SME.
 
Si le Serveur SME ne reçoit pas de courrier, vous devez vous assurer que les connexions SMTP atteignent votre serveur SME (paramètres DNS, configuration du routeur, blocs de ports ISP) et vous devez examiner les journaux /var/log/qpsmtpd/current pour déterminer ce que le Serveur SME fait avec les connexions entrantes. La plupart des problèmes sont des problèmes de DNS, de routeur ou d'ISP et n'ont rien à voir avec le fonctionnement ou la configuration du serveur SME.
  
====Erreurs qpsmtpd «Connection Timed Out»====
+
====Erreurs qpsmtpd « Connection Timed Out »====
 
Voir [[Bugzilla:6888]] et [[Bugzilla:2360]].
 
Voir [[Bugzilla:6888]] et [[Bugzilla:2360]].
  
Une erreur qpsmtpd «timeout» peut se produire, ce n'est pas un problème qui est causé par le Serveur SME directement, mais il peut devenir un problème en fonction du matériel et des paramètres de configuration qui sont contenus dans et autour d'autres environnements.
+
Une erreur qpsmtpd «timeout» peut se produire, ce n'est pas un problème qui est causé par le serveur KOOZALI SME directement, mais il peut devenir un problème en fonction du matériel et des paramètres de configuration qui sont contenus dans et autour d'autres environnements.
  
 
On en parle (en anglais) sous différentes dénominations :  
 
On en parle (en anglais) sous différentes dénominations :  
Line 28: Line 28:
 
L'utilitaire [http://linux.die.net/man/8/tracepath tracepath] (inclus dans SME 8.0) peut être utilisé pour localiser des valeurs MTU anormales entre votre Serveur SME et n'importe quel hôte distant.
 
L'utilitaire [http://linux.die.net/man/8/tracepath tracepath] (inclus dans SME 8.0) peut être utilisé pour localiser des valeurs MTU anormales entre votre Serveur SME et n'importe quel hôte distant.
  
Vous pouvez découvrir le plus petit MTU entre vous et google.com (par exemple) en exécutant cette commande, puis localiser la plus petite valeur de «pmtu» dans les résultats :
+
Vous pouvez découvrir le plus petit MTU entre vous et google.com (par exemple) en exécutant cette commande, puis localiser la plus petite valeur de « pmtu » dans les résultats :
 
  tracepath google.com
 
  tracepath google.com
  

Latest revision as of 22:27, 4 December 2018


Est-ce que cet article vous a été utile ?
Svp, envisagez de faire un don ou du volontariat.
Merci !

Informations sur le sous-système de courrier électronique utilisé dans le Serveur SME comprennant l'envoi / la réception, le filtrage de pourriels, la recherche de virus, le webmail, les domaines et les utilisateurs.

Contents

Dépannage

J'ai de la difficulté à configurer SME pour envoyer et recevoir des courriels.

L'envoi et la réception de courriels sont des fonctionnalités distinctes. Vous devez faire des recherches sur chacune individuellement.

Envoi

Si le Serveur SME n'envoie pas de courriel, vous devez examiner les journaux /var/log/qmail/current pour voir ce qui se passe lors des tentatives. La plupart du temps, les problèmes peuvent être résolus en faisant les envois via le (smtp du) serveur de messagerie de votre fournisseur de services Internet, en utilisant éventuellement le cryptage et / ou l'authentification. Lisez le manuel.

Réception

Si le Serveur SME ne reçoit pas de courrier, vous devez vous assurer que les connexions SMTP atteignent votre serveur SME (paramètres DNS, configuration du routeur, blocs de ports ISP) et vous devez examiner les journaux /var/log/qpsmtpd/current pour déterminer ce que le Serveur SME fait avec les connexions entrantes. La plupart des problèmes sont des problèmes de DNS, de routeur ou d'ISP et n'ont rien à voir avec le fonctionnement ou la configuration du serveur SME.

Erreurs qpsmtpd « Connection Timed Out »

Voir Bugzilla:6888 et Bugzilla:2360.

Une erreur qpsmtpd «timeout» peut se produire, ce n'est pas un problème qui est causé par le serveur KOOZALI SME directement, mais il peut devenir un problème en fonction du matériel et des paramètres de configuration qui sont contenus dans et autour d'autres environnements.

On en parle (en anglais) sous différentes dénominations :

Comme évoqué dans Bugzilla: 6888, une solution de contournement a été trouvée qui peut aider à atténuer le problème.

L'utilitaire tracepath (inclus dans SME 8.0) peut être utilisé pour localiser des valeurs MTU anormales entre votre Serveur SME et n'importe quel hôte distant.

Vous pouvez découvrir le plus petit MTU entre vous et google.com (par exemple) en exécutant cette commande, puis localiser la plus petite valeur de « pmtu » dans les résultats :

tracepath google.com

Si tracepath renvoie une valeur inférieure à 1500 entre votre serveur PME et un serveur de messagerie duquel vous devez recevoir un courrier électronique, vous devrez peut-être réinitialiser le MTU sur le serveur SME pour qu'il corresponde à la plus petite valeur renvoyée.

Par exemple, si tracepath renvoie 1492 (valeur typique pour les connexions Internet à l'aide de PPPoE), vous devrez configurer le MTU sur votre serveur SME à la même valeur (1492) à l'aide des commandes suivantes :

config setprop InternalInterface MTU 1492
signal-event post-upgrade; signal-event reboot

Webmail cassé après mise à jour

Après le «post-upgrade» habituel et le redémarrage, webmail est rompu avec des messages comme suit dans le journal des messages :

Apr 20 17:29:53 mail [4614]: PHP Fatal error:  Call to a member function on a non-object in /home/httpd/html/horde/imp/lib/Block/tree_folders.php on line 65
Apr 20 17:29:53 mail [4614]: PHP Warning:  Unknown(): Unable to call () - function does not exist in Unknown on line 0

En guise de solution de contournement, déconnectez-vous de Horde, fermez le fureteur Internet, rouvrez, connectez-vous à Horde, Webmail devrait maintenant être pleinement fonctionnel. (Fondée sur la correction suggérée dans Bugzilla: 5177).

Pourriels

Spamassassin

Filtre à pourriels avec le gestionnaire du serveur

En utilisant le panneau Configuration/Messagerie électronique/Modifier les paramètres de filtrage des courriels, ajuster les réglages à ces valeurs par défaut raisonnables.

  • Détection de virus : Activée
  • Filtre anti pourriel : Activé
  • Sensibilité du filtre : Personnalisé
  • Niveau personnalisé de marquage : 4
  • Niveau de rejet personnalisé : 12
  • Envoyer les pourriels dans la corbeille : Activé
  • Modifier le sujet des pourriels : Activé

Je recommande également de bloquer tout le contenu de fichiers exécutables. Pour ce faire, sélectionnez (mettez en surbrillance) tous les types de pièces jointes autres que les fichiers zip (les deux derniers).

Cliquer sur « Enregistrer ».

Comment ça marche

Lors de la réception d'un message entrant, le serveur teste d'abord les listes RBL et DNSBL, si cette option est activée. Si l'expéditeur est en liste noire, les messages sont bloqués complètement et Spamassassin ne le voit jamais.

Avec cette configuration, les messages les plus pourris, ceux marqués comme 12 ou plus, seront rejetés au niveau SMTP. Les messages de pourriels entre 4 et 12 seront acheminés vers le dossier « junkmail » des utilisateurs (IMAP). Cela est fait afin que les utilisateurs peuvent vérifier les faux positifs ... les messages valides qui ont été classés comme pourriel par SpamAssassin.

Les utilisateurs peuvent vérifier leurs dossiers de courrier indésirable pour les faux positifs via webmail, ou, s'ils utilisent un client de messagerie IMAP, en vérifiant simplement le dossier « junkmail » de leur client de messagerie.

https://servername/webmail


Important.png Note :
suivant les courrielleurs, le dossier « junkmail » est traduit en français ou non. S'il est traduit, ce peut être « Indésirables », ... Dans ce cas, noter que dans le serveur SME, le dossier reste nommé « junkmail ».

Activer/désactiver le filtrage par utilisateur

Cette procédure ne désactive pas vraiment le filtrage du courrier indésirable, elle empêche simplement le pourriel d'être acheminé vers le dossier « junkmail ».

Le filtrage par utilisateur est activé par défaut. Désactivez le filtrage avec la commande suivante, en tant que « root » :

db accounts setprop NomUtilisateur SortSpam disabled
db accounts show NomUtilisateur                                   # seulement pour afficher les réglages
signal-event user-modify NomUtilisateur

Utiliser le dossier « Junkmail »

Le comportement par défaut de Spamassassin est de mettre les pourriels dans la boîte de réception, ce qui est très pratique pour les utilisateurs en cas de faux positif, mais ce n'est pas pratique pour l'apprentissage et, surtout, cela ne facilite pas la vie de l'utilisateur. Si vous voulez mettre directement les pourriels dans le dossier « junkmail », lancez la commande ci-dessus.

config setprop spamassassin SortSpam enabled
signal-event email-update

Durée de rétention des messages

Configurer Spamassassin pour la suppression automatique des pourriels. Vous pouvez changer, dans la configuration de Spamassassin, le « nombre de jours » au bout duquel les pourriels seront automatiquement effacés. Pour effacer après 2 mois :

db configuration setprop spamassassin MessageRetentionTime 60  
signal-event email-update

Niveau de score d'un pourriel et score pour le rejet d'un pourriel

Le « niveau personnalisé de rejet de pourriel » ne fonctionnera que lorsque la « Sensibilité du filtre » est réglé sur « Personnalisé ».

  1. Ouvrez le gestionnaire du serveur.
  2. Cliquez sur « Messagerie électronique » dans le panneau « Configuration » à gauche.
  3. Cliquez sur « Modifier les paramètres de filtrage des courriels ».
  4. Modifiez « Sensibilité du filtre » à « Personnalisé » et ajustez les paramètres à votre goût.

Cela est ainsi parce que, par défaut, aucun courriel (sauf pour les virus) n'est rejeté sans que l'administrateur ait d'abord effectué une action.

Comme référence, le réglage suivant aura les résultats suivants :

Sensibilité Niveau de marquage de pourriel Niveau de rejet de pourriel
Personnalisé Valeur du niveau de marquage
(niveau personnalisé du marquage)
Valeur du niveau de rejet
(niveau de rejet personnalisé)
très haut 2 Pas de rejet
haut 3 Pas de rejet
moyen 5 Pas de rejet
bas 7 Pas de rejet
très bas 9 Pas de rejet

En-tête « X-Spam-Level » dans les courriels

SME ne crée pas d'en-tête « X-Spam-Level » dans les courriels traités par défaut. Voir [X-Spam-Level].

Pour activer cette fonctionnalité :

/usr/bin/yum install --enablerepo=smecontribs smeserver-qpsmtpd-spamassassinlevelstars
signal-event email-update

(Fondé sur Bugzilla:3505)

Important.png Note :
depuis SME8, cette fonctionnalité semble être incluse --Unnilennium (talk) 09:05, 3 February 2014 (MST)

Taille limite de courriel pour le module d'extension qpsmtpd de Spamassassin

Ce paramètre de configuration db définit la taille maximale de courriel au-dessus de laquelle Spamassassin n'appliquera pas les règles de filtrage de pourriel telles qu'elles ont été définies.

Le paramètre par défaut est 500 kb ; pour augmenter la taille maximale, appliquez les commandes suivantes à partir d'un terminal « administrateur » :

db configuration setprop spamassassin MaxMessageSize 2000000 

augmente la taille du message à 2 Mb ; appliquer la modification avec :

signal-event email-update

(Fondé sur Bugzilla:7606).

Niveaux de règles personnalisées

Vous pouvez personnaliser le score attribué par une règle Spamassassin spécifique (SARE_ADULT2 dans ce cas) comme suit :

 mkdir -p /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf
 cd /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf
 echo "score SARE_ADULT2 20.000" >> 20localscores
 signal-event email-update

Vous pouvez maintenant ajouter des tests supplémentaires et des scores personnalisés en modifiant le fragment de modèle nouvellement créé 20localscores et en ajoutant de nouveaux scores personnalisés en utilisant :

nano -w /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores
signal-event email-update

Chaque score personnalisé va sur sa propre ligne. Si vous entrez un score entre parenthèses, le score « personnalisé » sera ajouté à la note par défaut du test spécifié (utilisez « score TEST_NAME (-1) » pour réduire le score de « TEST_NAME » de 1).

Vous pouvez supprimer ces personnalisations en utilisant :

rm -f /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores
signal-event email-update

Références :

Politique de rejet / d'annulation de courrier électronique SPF

[SPF | Sender Policy Framework]

Warning.png Attention :
Veuillez noter que ces instructions ne s'appliquent pas à SME 9.2 où la version de qpsmtpd (0.96) fait tout cela en dehors de la boîte. En effet, si le modèle personnalisé ci-dessous est appliqué à (ou laissé dans ?) un système SME 9.2, alors vous pouvez constater que les courriels sont refusés alors qu'ils devraient être acceptés !

Le Serveur SME peut protéger des enregistrements fondés sur SPF en utilisant Spamassassin et le module d'extension 'sender_permitted_from'. Les lignes suivantes activeront le module d'extension :

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
echo sender_permitted_from spf_deny 1 > 30spf
/sbin/e-smith/expand-template /var/service/qpsmtpd/config/peers/0

Ensuite, définissez vos scores de règles personnalisées en utilisant la section Niveaux de règles personalisées de cette page. Vous devez fonder ces scores sur vos paramètres dans le Gestionnaire du serveur> Configuration> Messagerie électronique> Modifier les paramètres de filtrage des courriels ou via les commandes db config pour ceux qui possèdent ce niveau de compétences.

echo "score SPF_SOFTFAIL 6.000" >> 20localscores 
echo "score SPF_FAIL 14.000" >> 20localscores
signal-event email-update

Dans nos tests, un courriel qui ne correspond pas aux enregistrements SPF et dont le propriétaire du domaine expéditeur a défini un échec faible, se verra attribuer 6 points et sera classé dans le dossier « junkmail ». Si le propriétaire du domaine de l'expéditeur a défini un échec fort, le courrier électronique aura reçu 14 points et sera ensuite rejeté.
Références (mais les instructions ont changé pour répondre à la nouvelle structure qmail) :

Pyzor Timeout

See Bugzilla: 5973

Warning.png Warning:
SME server 7.# users be aware of an issue that can appear in the /var/log/spamd/current logs

" pyzor: [5281] error: TERMINATED, signal 15 (000f)".


This can be mitigated by the adding of a template fragment.

Template fragment to set a pyzor_timeout based on a value in the config db. If no value is set, there is no output (so pyzor uses it's internal default).

mkdir -p /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout
cd /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout
nano 50pyzor_timeout

Contents of 50pyzor_timeout

{
  my $pyzor_timeout = ($spamassassin{PyzorTimeout} || 0);
  if ($pyzor_timeout ne '0')
  {
     return "pyzor_timeout " . ($pyzor_timeout);
  }
}

Then a value can be set using:

config setprop spamassassin PyzorTimeout 15
signal-event email-update

Liste blanche et liste noire

Si le courrier arrive et qu'il est mal classé comme pourriel par Spamasassin, vous pouvez ajouter l'expéditeur à la liste blanche de Spamassassin afin que les futurs messages provenant de cet expéditeur ne soient pas filtrés. Inversement, vous pouvez ajouter un spammeur à la liste noire de Spamassassin afin que vous ne revoyiez plus ses pourriels. Ajoutez des expéditeurs (ou leurs domaines entiers) à la liste blanche globale (ou à liste noire) avec des commandes similaires à celles-ci (en tant que root) :

db spamassassin setprop wbl.global *@vonage.com White
db spamassassin setprop wbl.global *domain2.com White
db spamassassin setprop wbl.global user@domain3.com White
db spamassassin setprop wbl.global spammer@spamdomain.com Black

Vous pouvez bloquer un TLD (domaine de premier niveau - comme .org) entier mais, s.v.p., soyez conscient que vous pourriez être en train de refuser un courriel légitime à l'avenir.

db spamassassin setprop wbl.global *@*.xyz Black
db spamassassin setprop wbl.global *@*.link Black

Développez le modèle et enregistrez la configuration dans la base de données :

signal-event email-update

Vous pouvez afficher les listes avec cette commande :

db spamassassin show

Ces listes peuvent également être contrôlées par le gestionnaire du serveur avec la contribution wbl http://wiki.contribs.org/Email_Whitelist-Blacklist_Control/fr

Tests

Vous pouvez consulter les statistiques d'auto-apprentissage avec cette commande. Vous pourrez noter l'accumulation des jetons de spam (ou non). Notez que le filtrage bayésien doit recevoir 200 messages de pourriels avant qu'il ne commence à fonctionner, alors ne vous attendez pas à des résultats instantanés.

sa-learn --dump magic

Vous pouvez consulter le journal du filtre anti-spam avec cette commande :

tail -50 /var/log/spamd/current | tai64nlocal

Vérifiez la configuration de SpamAssassin comme ceci :

spamassassin -D --lint

Si jamais vous voyez une erreur telle que :

warn: bayes: cannot open bayes databases /etc/mail/spamassassin/bayes_* R/W: tie failed: Permission denied

Essayez de régler certaines autorisations avec ces commandes :

chown :spamd /var/spool/spamd/.spamassassin/*
chmod g+rw /var/spool/spamd/.spamassassin/*

Liste « trou noir » en temps réel (RBL)

[RBL]

Activation de la RBL
Les RBL sont désactivées par défaut pour permettre une adaptation maximale (votre fournisseur d'accès peut être sur un RBL et vous ne le savez peut-être pas). Vous pouvez activer les RBL :

config setprop qpsmtpd DNSBL enabled RHSBL enabled
signal-event email-update

Vous pouvez voir vos RBL par :

config show qpsmtpd

Vous pouvez ajouter à vos RBL par :

config setprop qpsmtpd RBLList <rbl-list-name>
signal-event email-update

Beaucoup diront que c'est le mieux, certains disent que les valeurs par défaut du Serveur SME sont trop agressives et affectent certains comptes webmail gratuits et populaires, mais la plupart seraient d'accord que vous pouvez régler des paramètres stables, conservateurs et non agressifs par :

config setprop qpsmtpd RBLList zen.spamhaus.org
signal-event email-update

Un cadre conservateur pour la DNSBL Associated SBLList est :

config setprop qpsmtpd SBLList dbl.spamhaus.org
signal-event email-update


Note : plus d'information sur ce sujet peut être trouvée ici : [1] [2]

Problèmes possibles avec RBL

Quand un fournisseur de DNS externe est configuré dans le menu de la configuration du serveur (en console), il peut interférer avec certaines listes noires activées ici (RHSBL et DNSBL). L'adresse black.uribl.com est connue pour renvoyer tous les courriels dans ce cas avec un message de rejet remis à l'expéditeur. Vous pouvez dans ce cas :

  • Retirer black.uribl.com de votre liste SBLList :
config setprop qpsmtpd SBLList multi.surbl.org:rhsbl.sorbs.net:dbl.spamhaus.org
signal-event email-update
  • Laisser le serveur SME comme seul résolveur DNS en supprimant le fournisseur de DNS/intermédiaire dans le menu de la console.

Voir http://uribl.com/about.shtml#abuse pour plus d'informations sur cette question avec black.uribl.com

Listes obsolètes

Ces listes ne peuvent pas être utilisées avec le Serveur SME. Un fragment migré va les supprimer de vos paramètres à chaque fois que vous reconfigurerez votre serveur.

  • RBLList
      combined.njabl.org
      list.dsbl.org
      multihop.dsbl.org
      dnsbl.ahbl.org
  • SBLLIST
      blackhole.securitysage.com
      bulk.rhs.mailpolice.com
      fraud.rhs.mailpolice.com
      porn.rhs.mailpolice.com
      adult.rhs.mailpolice.com
      bogusmx.rfc-ignorant.org
      ex.dnsbl.org

Serveur seulement

Certaines des règles de filtrage anti-pourriels ne peuvent fonctionner que si le serveur SME connaît l'adresse IP externe du modem. Si vous mettez un Serveur SME en mode « serveur seulement » derrière d'autres pare-feux, il perdra certaines des règles anti-pourriels. Par exemple, la règle qui bloque les tentatives où les spammeurs tentent « HELO A.B.C.D » où A.B.C.D est votre adresse IP externe.

Malheureusement, de nombreux administrateurs pensent que la redirection de port SMTP offre une sécurité supplémentaire. Ce n'est pas le cas, cela limite la capacité du Serveur SME à appliquer certaines règles.

Je veux activer GreyListing

GreyListing support is under the covers et peut facilement être activé pour ceux qui savent ce qu'ils font. Cependant, de nombreux utilisateurs expérimentés ont constaté qu'ils ont passé plus de temps à la configuration de la liste grise qu'ils en ont reçu en services rendus. Voir la Greylisting.

Filtrage bayésien

De Wikipedia:

Les classificateurs Naive Bayes fonctionnent en corrélant l'utilisation des jetons (généralement des mots, ou parfois d'autres choses), avec des pourriels et des courriels, puis en utilisant le théorème de Bayes pour calculer la probabilité qu'un courrier électronique soit ou non un spam.

Le serveur SME prend en charge le filtrage bayésien, mais il n'est pas activé par défaut.

L'activation du filtrage bayésien, de l'auto-apprentissage et de la formation sur le spam / ham permet à spamassassin d'apprendre à partir des courriels reçus et d'améliorer les performances du filtre anti-spam. Bugzilla: 6822

Autoapprentissage bayésien

La commande suivante activera le filtre d'apprentissage bayésien et réglera des seuils pour le filtre bayésien.

config setprop spamassassin UseBayes 1
config setprop spamassassin BayesAutoLearnThresholdSpam 6.00
config setprop spamassassin BayesAutoLearnThresholdNonspam 0.10
expand-template /etc/mail/spamassassin/local.cf
sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_*
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex
chmod 640 /var/spool/spamd/.spamassassin/bayes_* 
config setprop spamassassin status enabled
config setprop spamassassin RejectLevel 12
config setprop spamassassin TagLevel 4
config setprop spamassassin Sensitivity custom
signal-event email-update

Ces commandes :

  • activeront spamassassin ;
  • configuront spamassassin pour rejeter tout courriel de score supérieur à 12 ;
  • marqueront comme pourriel dans l'objet ceux de score compris entre 4 et 12 ;
  • activeront le filtre bayésien ;
  • 'autoapprendront' comme POURRIEL tout courriel de score supérieur à 6.00 ;
Note : SpamAssassin a besoin d'au moins 3 points de l'objet (header) et de 3 points du corps pour auto-apprendre à détecter un pourriel.
Par conséquent, la valeur minimale de fonctionnement de cette option est 6, à modifier par incrément de 3, 12 étant considéré comme une
bonne valeur de fonctionnement.
  • 'auto-apprendront' comme HAM tout courriel de score inférieur à 0.10.

Vérifiez les statistiques bayésiennes avec la commande :

sa-learn --dump magic

La base de données est située dans /var/spool/spamd/.spamassassin/bayes

LearnAsSpam / LearnAsHam (apprentissage spam/ham)

LearnAsSpam & LearnAsHam sont des scripts qui peuvent être installés sur votre serveur pour permettre aux utilisateurs d'« entraîner » manuellement la base de données Bayes. La formation est effectuée par les utilisateurs en déplaçant le courriel indésirable (le spam) de leur boîte de réception vers le dossier « LearnAsSpam », et en COPIANT le courriel véritable envoyé par erreur dans le dossier « pourriels » (junk) dans le dossier « LearnAsHam ». Tous les messages dans LearnAsSpam et LearnAsHam sont supprimés une fois qu'ils ont été traités et leurs jetons ajoutés à la base de données Bayes.

Pour l'installation :

  1. Activer la base de données bayes comme décrit dans Auto-apprentissage bayésien
  2. Installez smeserver-learn comme indiqué sur la page du wiki Learn
  3. Demandez à vos utilisateurs de déplacer tout le courrier indésirable trouvé dans leur boîte de réception vers leur dossier LearnAsSpam et de COPIER tout courriel non spam (ham) trouvé dans leur dossier junkmail dans leur dossier LearnAsHam. .

C'est un moyen très efficace de réduire l'impact du spam sur votre installation. Ne craignez pas de réexécuter des fichiers étiquetés en tant que SPAM, car ils seront soit ignorés si tous leurs modèles sont connus, soit les Bayes risquent d’attraper un modèle de plus qui pourrait vous aider à éviter le prochain SPAM entrant d'être accepté.

Si vous le souhaitez, le code ci-dessous compte le nombre de courriels contenus dans les répertoires LearnAsSpam et LearnAsHam (de tous les utilisateurs). C'est utile pour savoir si vos utilisateurs utilisent ces dossiers. Cependant, Learn vous enverra un rapport après chaque passe. Si vous êtes intéressé(e) par le nombre de courriels laissés dans le répertoire junkmail sans aucune attention, vous pouvez installer smeserver-mailstats et activer l'option pour les compter.

#!/bin/bash
#  ContaLearn.sh

#for compatibility with older versions without rpm, testing
[  `/sbin/e-smith/db configuration getprop LearnAsSpam dir` ] &&
LearnAsSpam=`/sbin/e-smith/db configuration getprop LearnAsSpam dir` || LearnAsSpam='LearnAsSpam';
[  `/sbin/e-smith/db configuration getprop LearnAsHam dir` ] &&
LearnAsHam=`/sbin/e-smith/db configuration getprop LearnAsHam dir` || LearnAsHam='LearnAsSpam';
JunkMail='junkmail';

echo
date
declare -i tspam
declare -i tham
declare -i tleft
declare -i tnseen

printf "%-25s %-11s %-11s %-11s %-11s \n" "User" "LearnAsSpam" "LearnAsHam" "JunkMail" "NotSeen"
pushd /home/e-smith/files/users/ >>/dev/nul
for u in `ls ` #| grep -v admin`
do
[ "$u" = "admin" ] && mailpath="/home/e-smith/" ||  mailpath="/home/e-smith/files/users/$u" ;
  spam=`ls -1 $mailpath/Maildir/.$LearnAsSpam/cur |wc -l`
  ham=`ls -1 $mailpath/Maildir/.$LearnAsHam/cur |wc -l`
  left=`ls -1 $mailpath/Maildir/.$JunkMail/cur |wc -l`
  nseen=`ls -1 $mailpath/Maildir/.$JunkMail/new |wc -l`
  if  [[ $spam > 0 ]] || [[ $ham > 0 ]] || [[ $left > 0 ]] || [[ $nseen > 0 ]];   then
     printf "%-25s %-11d %-11d %-11d %-11d \n" $u $spam $ham $left $nseen
  fi
  tspam=$tspam+$spam
  tham=$tham+$ham
  tleft=$tleft+$left
  tnseen=$tnseen+$nseen
done
echo "----------------------------------------------------------------------"
printf "%-25s %-11d %-11d %-11d %-11d \n" "Total:" $tspam $tham $tleft $tnseen
echo
popd >>/dev/nul

Contribution Learn

La contribution Learn est destinée à installer et configurer les outils d'apprentissage Bayesien LearnAsSpam & LarnAsHam.

Remettre la base de données Bayésienne à zéro

Fondé sur ce fil de forum http://forums.contribs.org/index.php/topic,50712.msg258844.html#msg258844, il peut être avantageux de vider les bases de données Bayésiennes au bout de quelques années et de les re-créer, de façon à tester la performance du filtrage des pourriels.

Suivre ces instructions pour arrêter l'auto-apprentissage Bayésien, effacer la base de données, créer une base de données vide et redémarrer l'auto-apprentissage Bayésien :

config setprop spamassassin UseBayes 0
signal-event email-update
'rm' /var/spool/spamd/.spamassassin/bayes* 
config setprop spamassassin UseBayes 1
expand-template /etc/mail/spamassassin/local.cf
sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_*
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex
chmod 640 /var/spool/spamd/.spamassassin/bayes_* 
signal-event email-update

The Sonora Communications "Spam Filter Configuration for SME 7" howto

http://www.sonoracomm.com/support/19-inet-support/49-spam-filter-configuration-for-sme-7

GeoIP : blocage de pourriel fondé sur des informations géographiques

Le module d'extension GeoIP pour Spamassasin nous permet de savoir d’où notre serveur de messagerie reçoit un courriel. Si nous recevons trop de pourriels d'un endroit particulier, cela aidera à le localiser. Nous pouvons ensuite utiliser cette information pour rejeter les connexions provenant de cet endroit, qui augmentent la charge de notre serveur.


Important.png Note :
cela peut être un moyen grossier de bloquer le spam et aussi, potentiellement, de bloquer les utilisateurs légitimes !

Vous pouvez trouver des informations sur son installation et son utilisation sur la page GeoIP.

Anti Virus

SME Server uses Clam AntiVirus (http://www.clamav.net) as the default and built-in anti virus engine.

Signatures

By default SME Server will automatically get virus signature database updates from ClamAV.

Other people and organizations have developed additional signatures which can also be used with ClamAV to provide extra protection. Databases of these signatures can be downloaded and installed on SME Server, and used by ClamAV

In order to automate the download and installation of the additional databases, as well as control which databases you use, follow the instruction in the Virus:Additional Signatures Howto

Heuristic Scan

HeuristicScanPrecedence is a new option in clamav 0.94.

When enabled, if a heuristic scan (such as phishingScam) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time.

To enable this feature:

config setprop clamav HeuristicScanPrecedence yes
expand-template /etc/clamd.conf
sv t clamd

Default is disabled.

Attachment Filtering

The functionality to block possible executable and virus files attached to emails has been incorporated into SME Server v7.x. See the Email panel in server manager.

Additional file signature patterns can be added to the SME defaults. See the Virus:Email Attachment Blocking Howto for further information

Email Clients

"concurrency limit reached" when using IMAP

Sometime shows as Thunderbird giving this error message, This Mail-server is not a imap4 mail-server

To workaround thunderbirds limitations change, this thunderbird setting to false

  • Preferences, Advanced, Config editor (aka about:config): filter on tls.
  • set security.enable_tls to false

You can also increase the ConcurrencyLimitPerIP and/or ConcurrencyLimit value for imap and/or imaps (secure)

config setprop imap ConcurrencyLimitPerIP 20
config setprop imaps ConcurrencyLimitPerIP 20
signal-event post-upgrade; signal-event reboot
Important.png Note:
for sme9, only the key imap has properties ConcurrencyLimitPerIP,checkConcurrencyLimit,ProcessMemoryLimit. If you set these properties to the key imaps, a migrate fragment will remove them automatically

config show imap
tail -f /var/log/imap/current | tai64nlocal

More detail can be found here.


Information.png Tip:
You can see if you are running out of the number of available connections in your log file /var/log/imaps/current and look for messages like the log extract below where the ConcurrencyLimitPerIP was set to 20. A 21st connection was attempted and was denied.
tcpsvd: info: pid 30693 from 10.1.0.104
tcpsvd: info: concurrency 30693 10.1.0.104 21/20
tcpsvd: info: deny 30693 0:10.1.0.21 ::10.1.0.104:49332 ./peers/10.1.0

Information.png Tip:
Mobile devices have a tendency to frequently disconnect and connect from the network. When this disconnect happens, the sessions on the server are not always immediately cleaned up (they get cleaned up after a time out of some minutes). When the email client reconnects, they create new network connections and you get into the situation that these new connections get denied because of the concurrency limit. On the mobile device this may be noted as a "Unable to connect to server" message.

Information.png Tip:
Some email clients use a separate connection per imap folder, so the concurrency limits may occur for users that have many imap folders.

Mail server is not an IMAP4 mail server

This is a bug in Thunderbird, the previous tips may help

The Bat

The gives this error message, but they are wrong.
"This server uses TLS v3.0 which is considered to be obsolete and insecure. The server must use TLS v3.1 or above."


Outlook/Outlook Express give error 10060/0x800CCC90

Most likely OUTLOOK (EXPRESS) isn't configured correctly.

-open OUTLOOK
-click TOOLS > ACCOUNTS
-click CHANGE (on the right-hand side)
-find INCOMING MAIL SERVER & OUTGOING MAIL SERVER (on right-hand side)
-type: mail.yourdomain.tld (in both places)
-click MORE SETTINGS (on bottom-right)
-click OUTGOING SERVER tab (at the top)
-checkmark "MY OUTGOING SERVER REQUIRES AUTHENTICATION"
-bullet "USE SAME SETTINGS AS INCOMING MAIL SERVER"
-click ADVANCED tab (at the top)
-find OUTGOING SERVER
-checkmark "THIS SERVER REQUIRES A SECURE CONNECTION" (under outgoing server)
-change 25 to 465
-[possibly required, secure IMAP is 993]
-click OK > NEXT > FINISHED
-you're finished, your email should work now

Outlook 2013 on Windows 10 gives "An unknown error occurred, error code 0x8004011c" when attempting an IMAP connection for a DOMAIN user

This is a known issue with the above combination of Windows and Outlook version as of 2015-02-18 (see: Bug 9618).

The following registry key resolves the issue: To work around this problem, set the value of the ProtectionPolicy registry entry to 1 to enable local backup of the MasterKey instead of requiring a RWDC in the following registry subkey:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb] "ProtectionPolicy"=dword:00000001

The PortectionPolicy entry may need to be created

Outlook 2013 on Windows 8.1 gives error 0x800CCC1A when sending over SMTP port 465

This is a known issue with the above combination of Windows and Outlook version as of 2015-02-18 (see: Bug 8854).

The following client-side workaround has been suggested on the dovecot mailinglist:

Disable TLS1.2 on the Windows 8.1 client, using a registry entry:

 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.2\Client]
 "DisabledByDefault"=dword:00000001
 "Enabled"=dword:00000000

If the registry entry above does not exist on your system, you will have to create it manually.

Whether this is OpenSSL or Microsoft's "fault" is currently not answered.

Outlook test message doesn't come through

You clicked the TEST ACCOUNT SETTINGS in OUTLOOK didn't you? This is a bug in OUTLOOK. The test message sends a test email with 'no Date header'. As the name suggests, this means a message without any date. Since the server doesn't accept mail with 'no Date header' (because it's required) the message is rejected. To test, send an actual message from OUTLOOK.

If you want, you can try THUNDERBIRD. It's like OUTLOOK but made by a different company. It's completely free and works very well at home and at the office.

I can't receive/send email from my application (ACT!, vTiger, MS Outlook, etc)

Most likely, this is a bug the application you're using and not a problem with the SMESERVER. The application sends an email with 'no Date header'. As the name suggests, this means a message without any date. Since the server doesn't accept mail with 'no Date header' (because it's required) the message is rejected.

As a workaround you can disable the check for the 'Date header'. To disable this check on the internal interface:

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
echo "# 17check_basicheaders disabled by custom template" > \
17check_basicheaders
signal-event email-update

To disable this check for the external interface:

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
echo "# 17check_basicheaders disabled by custom template" > \
17check_basicheaders
signal-event email-update

After I upgrade my SME Server, my email folders have disappeared when using IMAP

After upgrade, if there are missing IMAP folders, the client may need to re-subscribe to folders. This may affect either webmail users or users who use an IMAP email client.

Entourage: Using SME's Self-Signed Certificate for SSL Connections from Entourage on OS X 10.4

The main problem here is that Entourage will only support trusted, PEM Base-64 Encoded certificates. To use IMAPS or SMTPS from Entourage with your SME server, you will need to:

1. Login to your Mac as a user with administrative privileges

2. Open Safari and browse to https://smeserver/server-manager.  
   When you receive the warning about your certificate:
   - click on "Show Certificate"
   - click and drag the gold-rimmed image of a certificate to your desktop.  
   You will now have myserver.mydomain.tld.cer on your desktop.

3. Locate and open the Microsoft Cert Manager
   - "Import" the certificate you downloaded in step 2.

4. Highlight the imported certificate and "Export" it. 
   - Select the "PEM..." format
   - add "pem." to the beginning of the filename
   - export it to your Desktop

5. Double-click on the new pem.myserver.mydomain.tld.cer  
   - Apple's Keychain Access application will open.
   - Select the X509Anchors Keychain and click "OK"

6. While still in Apple's Keychain Access, select the "Certificates" category
   - Drag pem.myserver.mydomain.tld.cer into the certificates window.

You should now be able to connect to your SME from your Entourage using IMAPS.

If you are accessing your SME server using a different name than the one encoded in the certificate you will still receive a security warning from Entourage, but "OK" will now grant access to your folders.

Notes:

  • Procedure mostly taken from http://www.kerio.com/manual/kmsug/en/ch09s06.html
  • I still get various other IMAP errors due, I suspect, to the "concurrency limit reached" issue.
  • Click on "Show Keychains" in Apple's "Keychain Access" if you need to delete a certificate and try again.

How do I get my e-mail to show the correct From Address

The From address on an e-mail is not supplied by the server. It is supplied by the e-mail client.

  • Configure your Account in your e-mail client with the correct FROM address.
  • You can change the FROM address in webmail with the following:
    • Login to webmail as the user, go to options-personal information and change the identity to have the correct FROM address. You can have multiple identities with a single user.

Some system generated email is created by the server, some contribs may send mail externally, in these cases you need a valid domain name for the server, buy one or use a free provider like dyndns.org

Server Settings

qmail ConcurrencyLocal

The default value for /var/qmail/control/concurrencylocal is 20. This setting controls the maximum amount of simultaneous local deliveries.

There is a optional database property (does not show unless changed from the default setting) called ConcurrencyLocal for qmail in the config database. The ConcurrencyLocal property changes the value stored in /var/qmail/control/concurrencylocal.

It can be set, for example to decrease the local concurrency limit

config setprop qmail ConcurrencyLocal 6
signal-event email-update

qmail ConcurrencyRemote

The default value for /var/qmail/control/concurrencyremote is 20. This setting controls the maximum amount of simultaneous remote deliveries.

There is a optional database property (does not show unless changed from the default setting) called ConcurrencyRemote for qmail in the config database. The ConcurrencyRemote property changes the value stored in /var/qmail/control/concurrencyremote.

It can be set, for example to decrease the remote concurrency limit

config setprop qmail ConcurrencyRemote 10
signal-event email-update

Refer also this comment by CB

http://forums.contribs.org/index.php/topic,50091.msg251320.html#msg251320

How long retry before return e-mail as undeliverable

To configure how long SME server will try to delivery a message before return a permanent error

mkdir -p /etc/e-smith/templates-custom/var/qmail/control
echo 172800 > /etc/e-smith/templates-custom/var/qmail/control/queuelifetime
expand-template /var/qmail/control/queuelifetime
sv t qmail

The default value is 604800 seconds, or one week.
The example above shows 172800 seconds, or two days (a weekend for infra upgrade!)

source: http://forums.contribs.org/index.php/topic,47471.0.html


Double bounce messages

To stop admin receiving double bounce messages

config setprop qmail DoubleBounceTo someoneuser
signal-event email-update

Or just delete them. You risk losing legitimate double bounces (which are rare, but you want to look at them when they do occur)

config setprop qmail DoubleBounceTo devnull
signal-event email-update

see a longer explaination here

Keep a copy of all emails

You may need to keep a copy of all emails sent to or from your email server. This may be for legal, or other reasons.

The following instructions will create a new user account (maillog) and forward every email that goes through your SME server to it.

First, log onto the server-manager and create the user maillog

Go to the SME Command Line (logon as root) and issue the following commands:

config setprop qpsmtpd Bcc enabled
signal-event email-update

Optionally make the forwarding of the emails invisible to the end user. Without it, there will be an X-Copied-To: header in each email. Run this command before the signal-event

config setprop qpsmtpd BccMode bcc

If you want to view the emails, point your email client at the SME and log on as maillog.

Keep a copy of outgoing emails only

In addition to the commands in the previous section we will also have to create a custom template as follows:

Log in as root or a user with root privileges

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/13bcc /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
nano -w 13bcc

change the code to:

{
     return "# bcc disabled" unless ($qpsmtpd{Bcc} eq "enabled");
     return "bcc mode " . $qpsmtpd{BccMode} . " outgoing " . $qpsmtpd{BccUser};
}

Save by pressing Ctrl x at the same time and confirm with y

Then enable the changes with

signal-event email-update

More info:

perldoc /usr/share/qpsmtpd/plugins/bcc


Set Helo hostname

Default is set to the hostname.domain, but sometime you might want to have something else to answer with the same as your reverseDNS. You can do one of the followings to only adjust the helo name:

config setprop smtpd HeloHost mydomainname
signal-event email-update

or the following to adjust the way your server will present itself everywhere (httpd, qpsmtd...) This might trigger the generation of new ssl certificate, so use it only if you are sure this is what you want to do.

config set DomainName mydomainname
signal-event domain-modify
signal-event email-update

Set max email size

  • IMPORTANT: bugzilla: 7876 points out that if your system has /var/service/qpsmtpd/config/databytes it should be deleted. (Fixed as of smeserver-qpsmtpd-2.4.0-7.el6.sme.noarch - see bugzilla: 8329).

There are several components involved in sending email on a SME server. Each component has a size limit that may affect an email message that passes through the server.

Be aware that email size is not the same thing as attachment size. Binary attachments to email are encoded using techniques that result in email sizes that can be as much as 30% larger than the original attachment. Most major email clients (Thunderbird, Apple Mail, Outlook) allow you to enable a "message size" column in the message list that will show you the size of your email messages (More).

Subsystem Function Default Limit Command to change size Notes
qmail Delivers email to local mailboxes and to remote servers 15000000 config setprop qmail MaxMessageSize xx000000 Value is in BYTES. 15000000 equals approximately 15MB.
No value means no limit.
clamav Used to scan emails and attachments 15M config setprop clamav MaxFileSize 15M Value includes human-readable abbreviations. "15M" equals 15 MegaBytes.
qpsmtpd The clamav plugin to qpsmtpd is called with a specified size limit. 25000000 config setprop qpsmtpd MaxScannerSize xx000000 Value is in BYTES.
Question: does this value override the setting of 'MaxFileSize', or will the smaller value prevail?
php The php maximum file upload size will determine the largest file you can attach to an email message using horde (or any other php email client) 10M config setprop php UploadMaxFilesize 10M

clamav

A note about clamav:
ClamAV includes settings to prevent the scanning of archives that could cause problems if fully expanded; if an attachment cannot be scanned, it will be rejected.

In order for changes to take effect, run:

signal-event email-update

These attributes could result in the rejection of a compressed attachment on a SME server:

  • ArchiveMaxCompressionRatio (default 300)
  • MaxFiles (default 1500)
  • MaxRecursion (default 8)

spamassassin

By default the qpsmtpd 'spamassassin' plugin does not pass any messages over 500,000 bytes to spamassassin for scanning.

To change this behavior:

 db configuration setprop spamassassin MaxMessageSize 2000000 

increases message size to 2,000,000 bytes. Apply the change with

signal-event email-update

Change Horde Webmail Login Page 'Welcome To' Title

The login page for Webmail defaults to "Welcome to Horde Webmail". In order to change this to something like "Welcome to MyDomain Mail"

config setprop horde Name "MyDomain Mail"
signal-event email-update

See also:

Other configurable Horde settings DB_Variables Configuration#Horde_(webmail)

Forum post 31093

Add the admin user as an administrator for Horde

config setprop horde Administration enabled 
signal-event email-update

Large attachments not displaying in webmail

Due to limits set in the PHP configuration it might be that webmail will not display large attachments (see also bugzilla:3990). The following entries are related to the error and can be found in the log files:

/var/log/messages

Mar 13 00:00:12 box1 httpd: PHP Fatal error:  Allowed memory size of 33554432 bytes exhausted (tried to allocate 154 bytes) in /home/httpd/html/horde/imp/lib/MIME/Contents.php on line 173

/var/log/httpd/error_log

Allowed memory size of 33554432 bytes exhausted (tried to allocate 0 bytes)

The default MemoryLimit setting in PHP is set to 32M the value can be changed using the commands below replacing XX with the value you desire.

Important.png Note:
You can set the MemoryLimit any value you like but be sure to add the capital M as a suffix for Megabytes.

db configuration setprop php MemoryLimit XXM
expand-template /etc/php.ini
sv t httpd-e-smith

Disable mail to a user from an external network

However, this seems to only affect /var/qmail/control/badrcptto - denying external delivery to your users but allowing outbound emails: http://forums.contribs.org/index.php?topic=40449.5

Can be either a user, pseudonym or group

db accounts setprop groupname/username Visible internal
signal-event email-update

If you want to remove

db accounts delprop groupname/username Visible
signal-event email-update
  • If you need to restrict emails for all users you can perform this command line
db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts setprop $USER Visible internal; done
signal-event email-update

If you want to remove

db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts delprop $USER Visible; done
signal-event email-update

I can't receive mail at: user@mail.domain.tld

Add mail.domain.tld as a virtualdomain.

-login to SERVER-MANAGER
-click DOMAINS (on the left)
-click ADD
-type: mail.domain.tld

How do I find out who is logged into webmail and what IP number.

This is logged is in /var/log/messages.

How do I enable smtp authentication for users on the internal network

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/05auth_cvm_unix_local .
signal-event email-update

(note the "." at the end of the 3rd line)
Authentication for the local network will now follow the setting of config::qpsmtpd::Authentication

ie do

config setprop qpsmtpd Authentication enabled
signal-event email-update

How do I disable SMTP relay for unauthenticated LAN clients

http://forums.contribs.org/index.php?topic=38797.msg176490#msg176490

  • Enable smtp authentication as shown above
  • Disable un-authenticated smtp relay for the local network(s)using:
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients
echo "# SMTP Relay from local network denied by custom template" >\
/etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80relayFromLocalNetwork
signal-event email-update
  • Configure your email clients to use smtps with authentication:

- change outgoing smtp port to 465 and select SSL
- enable Authentication against the outgoing mail server

Allow SMTP relay of mail without encryption/authentication

Change the configuration of the system from the default, so that it no longer requires encryption/authentication before allowing relaying of mail.

Disable smtp authentication as shown in Bugzilla: 6522

config setprop qpsmtpd RelayRequiresAuth disabled
signal-event email-update

SMTP Authentication TLS before Auth disable & enable

Since SME v7.5 the default for SMTP Authentication is 'requires TLS before Auth' to increase security. Where a SME7.4 or earlier server with SMTP & SSMTP authentication enabled has been upgraded, users are now unable to send mail. Users will need to enable TLS or Auto for the Authentication encryption setting in their email clients. Some older email clients and devices do not support TLS.

A fix was released in SME7.5.1 to allow this setting to be disabled (ie revert to SME7.4 functionality). Upgrade to SME7.5.1 before using these commands.

To disable this (AUTH without TLS) & revert to SME7.4 defaults do

config setprop qpsmtpd TlsBeforeAuth 0
signal-event email-update

To change back to the sme7.5 & greater default (AUTH with TLS) do

config setprop qpsmtpd TlsBeforeAuth 1
signal-event email-update

See http://forums.contribs.org/index.php/topic,46218.0.html

http://bugs.contribs.org/show_bug.cgi?id=5997

Internet provider's outgoing port 25 is blocked: How to set an alternative outgoing port for the SMTP server

If your Internet provider is blocking outgoing smtp port 25 on your internet connection but your provider is offering an alternative outgoing port (or when using some relay service) you can simply set this alternative port by adding it to the 'Address of Internet provider's mail server' value in the 'E-mail delivery settings' screen of the server-manager like this:

<internet providers mail server name or ip-address>:<alternative port>

For example: mail.mydomain.com:587

This setting does not alter the incoming smtp mail server port on SME server, which will still use port 25. Refer to a workaround in http://wiki.contribs.org/PortRedirect

How do I enable and configure a disclaimer in email messages

A disclaimer message can be added to the footer of all outgoing email messages.

The message can be the same for all domains or it can be different for all domains.

This functionality is part of sme7.2 release so make sure you have upgraded before doing this.

To create a general disclaimer for all domains on your sme server

config setprop smtpd disclaimer enabled
nano -w /service/qpsmtpd/config/disclaimer

Enter the required disclaimer text

To save & exit

Ctrl o
Ctrl x

To make the changes take effect

signal-event email-update


To create domain specific disclaimers, create seperate domain based disclaimer text files

Delete the general (all domains) disclaimer file if you have already created it

rm  /service/qpsmtpd/config/disclaimer
config setprop smtpd disclaimer enabled
nano -w /service/qpsmtpd/config/disclaimer_domain1.com.au
nano -w /service/qpsmtpd/config/disclaimer_domain2.com
nano -w /service/qpsmtpd/config/disclaimer_domain3.org

Enter the required text in each disclaimer file

To save & exit

Ctrl o
Ctrl x

After making any changes remember to do

signal-event email-update


Note if you only wish to have a disclaimer for some domains, then only create a disclaimer text file for those domains


Note also the criteria for when a disclaimer is attached

(see http://bugs.contribs.org/show_bug.cgi?id=2648)

eg a disclaimer is added to internal to external messages but not internal to internal messages.

There are also various switches that can be applied

(see http://bugs.contribs.org/show_bug.cgi?id=2648).


To disable the disclaimer function for all domains on your sme server

config setprop smtpd disclaimer disabled
signal-event email-update

Email WBL server manager panel

There is a server-manager contrib to allow GUI control of email white and black lists, detailed in the wiki article: Email_Whitelist-Blacklist_Control.

The panel allows easy configuration of functionality that is built into qmail, qpsmtpd and spamassassin. For more information google for qmail & qpsmtpd, read the spamassassin section in this wiki article and see Email#Default_Plugin_Configuration default qpsmtpd plugin confguration).

There are two main sections, Blacklist and Whitelist, where you can control settings.

Note that there are subtle differences in syntax between whitelist and blacklist entries

Blacklist - Black lists are used for rejecting e-mail traffic

 DNSBL status      - DNSBL is an abbreviation for "DNS blacklist". 
                     It is a list of IP addresses known to be spammers.
 RHSBL status      - RHSBL is an abbreviation for "Right Hand Side Blacklist". 
                     It is a list of domain names known to be spammers.
 qpsmtpd badhelo   - Check a HELO message delivered from a connecting host. 
                     Reject any that appear in badhelo during the 'helo' stage.
 qmail badmailfrom - Check envelope sender addresses. 
                     Reject any that appear (@host or user@host) in badmailfrom during the 'mail'           
                     stage.
 spamassassin blacklist_from - Any envelope sender of a mail (*@host or user@host) matching an 
                               entry in blacklist_from will be rejected by spamassassin.

Whitelists - White lists are used for accepting e-mail traffic

 Whitelists status           - White Lists: ACCEPT
 qpsmtpd whitelisthosts      - Any IP address listed in whitelisthosts will be exempted 
                               from any further validation during the 'connect' stage.
 qpsmtpd whitelisthelo       - Any host that issues a HELO matching an entry in whitelisthelo 
                               will be exempted from further validation during the 'helo' stage.
 qpsmtpd whitelistsenders    - Any envelope sender of a mail (host or user@host) matching an 
                               entry in whitelistsenders will be exempted from further validation
                               during the 'mail' stage.
 spamassassin whitelist_from - Any envelope sender of a mail (*@host or user@host) matching an 
                               entry in whitelist_from will be exempted from spamassassin rejection.

How to block email from one address to another address with check_badmailfromto plugin

Enable the check_badmailfromto plugin. Adapted from this Forum post

This is based heavily on the similar check_badmailfrom, but this plugin references both the FROM: and TO: lines, and if they both are present in the badmailfromto config file (a tab delimited list of FROM/TO pairs), then the message is blocked as if the recipient (TO) didn't exist. This is specifically designed to not give the impression that the sender is blocked (good for cases of harassment).

To control mail from external locations to internal locations do

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
nano -w /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto

Type in the following followed by Enter

check_badmailfromto

Then save the file and exit

Ctrl o
Ctrl x

Then do

ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto
signal-event email-update

To control mail sent from internal locations to internal locations, in addition to the above also do

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
signal-event email-update

Create and configure the badmailfromto custom template fragment

mkdir -p /etc/e-smith/templates-custom/var/qmail/control/badmailfromto
nano -w /etc/e-smith/templates-custom/var/qmail/control/badmailfromto/template-begin

Type in the From and To pairs that you want to stop email delivery for, with a tab between them and a carriage return at the end of the line, with additional pairs on a new line ie

user@bad-domain.com tab user@yourdomain.com enter
user@bad-domain2 tab user2@yourdomain enter

Note also that wildcards or blank spaces are not supported

eg

john@aol.com      mary@yourdomain
bill@yahoo.com      paul@yourdomain.com

then save using

Ctrl o
Ctrl x

Expand the template to update the /var/qmail/control/badmailfromto config file

expand-template /var/qmail/control/badmailfromto

Restart mail services

signal-event email-update

Redirect mail.domain.net to Webmail

Setup external dns records

Add mail.domain.net in Domains panel in server-manager

db domains setprop mail.dom.ain TemplatePath ProxyPassVirtualHosts ProxyPassTarget http://sme.dom.ain/webmail
signal-event remoteaccess-update

where http://sme.dom.ain/webmail is servername.domainname/webmail

E-mail Retrieval

http://wiki.contribs.org/SME_Server:Documentation:Administration_Manual:Chapter13#E-mail_Retrieval

If your ISP does not provide a custom sort field and you experience the following errors occuring when Multidrop is enabled and the "Select Sort Method (for multi-drop)" is set to Default:

fetchmail: warning: multidrop for pop3.mypopserver.com requires envelope option!
fetchmail: warning: Do not ask for support if all mail goes to postmaster!

and/or

fetchmail: warning: multidrop for my.isp.domain requires envelope option! 
fetchmail: warning: Do not ask for support if all mail goes to postmaster! 


Set "Select Sort Method (for multi-drop) to 'Received' or 'for' As described at bugzilla:5602 bugzilla:6483

Domain Authentication

Warning.png Work in Progress:
trex1512 has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

Major mail hosting companies (Google, Yahoo, Microsoft) have made domain-authentication mandatory so as to not mark incoming mail as spam.

To facilitate this support for DomainKeys and DKIM signing needs to be enabled in SME's mail subsystem. These techniques require the adding of records in the DNS zone for the user's domain. The DKIM/DK/SPF/SenderID configuration has to be added to your your DNS server / registrar.

How do I remove an email address from the everyone group

By default, all users are automatically added to the user group "everyone". If you would like to remove a user from this group, connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.

db accounts setprop username EveryoneEmail no
signal-event user-modify
/etc/init.d/qmail restart


How do I remove an email address from any regular group

By default, all users member of a group "group1" are automatically added as recipients of mail sent to group1@domain. If you would like to remove a user from this group, connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.

db accounts setprop group1 EmailExcludeUsers tom,jack 
signal-event group-modify group1

If you want to prevent all the user members from another group "group2" from receiving emails addressed to group1@domain while they are also member of group1, you could connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.

db accounts setprop group1  EmailExcludeGroups group2
signal-event group-modify group1

All members of the group will still be member for all other purpose (samba access to ibays as an example)

This behaviour is only available as per e-smith-qmail-2.4.0-7.sme see bug #9540

Change the number of logs retained for qpsmtpd and/or sqpsmtpd

The normal retention is 5 logs for both qpsmptd and sqpsmtpd. This may or may not fit all installations. This information is pulled from bugzilla.

Check your config to see if any change has been made to the default log retention rules. Note there are different rules for qpsmtpd and sqpsmtpd. You have to make changes to both as you require.

config show qpsmtpd

If the KeepLogFiles property isn't listed, the default rules apply. Determine how many logs you would like to keep and apply that to the following example. In the command below, 15 is used to keep 15 qpsmtpd logs.

db configuration setprop qpsmtpd KeepLogFiles 15

Restart multilog with the following.

sv t /service/qpsmtpd/log

Check that your setting saved.

ps aux | grep qpsmtpd | grep multi

Look for the line that ends with /var/log/qpsmtpd and verify the number after n equals your KeepLogFiles property from above.

DKIM Setup - qpsmtpd version<0.96

A plugin has been written and is available in SME

To activate it manually follow the steps below, or download a shell script that will do the server based stuff for you & guide you on the DNS stuff setup_dkim.sh:-

Note: I'd recommend reviewing the script first to make sure you're happy to run it on your system

Create a folder:

mkdir /var/service/qpsmtpd/config/dkimkeys/

Then:

cd /var/service/qpsmtpd/config/dkimkeys/
openssl genrsa -out dkim.private 1024
openssl rsa -in dkim.private -pubout -out dkim.public
chown qpsmtpd:qpsmtpd -R /var/service/qpsmtpd/config/dkimkeys/
chmod 0700 dkim.private

For each domain you want to sign:

cp -a dkim.private <fully qualified domain name>.private (less the <> brackets)

Then create a template fragment:

mkdir --parent /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
echo "dkim_sign keys dkim">/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign
signal-event email-update

Finally propagate your public key "dkim.public" content (<key text>) to your DNS.

Check with your DNS server / registrar. Something similar to the following should work but it varies depending on provider - replace <fully qualified domain name> with your doman details e.g "mydomain.org" (less the <> brackets):

When extracting the key text from the dkim.public file it's on multiple lines. For the key to work for us in the DNS TXT record we need to exclude the header & footer lines & have just the key text as a single line string (the setup_dkim.sh script provides this info in the format required).

default._domainkey.<fully qualified domain name> IN TXT "k=rsa; p=<key text>; t=y"


With Zonedit the following works within your Zone :

Subdomain : default._domainkey

Type : TXT

Text : "v=DKIM1;k=rsa; p=<key text>; t=y"


If you want to customize the signing you can add parameters to the line in /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign. Parameters and value are separated by a space only.

  1. keys : "dk" or "domainkeys" for domainkey signature only, "dkim" for DKIM signature only, default "both" (n.b. above template example is dkim ONLY)
  2. dk_method : for domainkey method , default "nofws"
  3. selector : the selector you want, default "default"
  4. algorithm : algorithm for DKIM signing, default "rsa-sha1"
  5. dkim_method : for DKIM, default "relaxed"

NB: key files can not be defined in parameters, they need to be in /var/service/qpsmtpd/config/dkimkeys/{SENDER_DOMAIN}.private


Information.png Tip:
You can verify that your settings are correct by sending an email to check-auth@verifier.port25.com, a free service the purpose of which is to verify if your domain does not contradict mail policies. Please check the answer carefully. See bugzilla:4558#c6

See also : bugzilla:8251 bugzilla:8252

DKIM Setup - qpsmtpd version >= 0.96

Version 0.96 and above supports DKIM natively without the need for extra plugins.

All you have to do is to enable the DKIM signing and promulgate the DNS TXT entries to support it.

Enable the signing:

db configuration setprop qpsmtpd DKIMSigning enabled
signal-event email-update

and then run:

qpsmtpd-print-dns <domain name>

to show the DNS entry(s) required.

Then you have to update your DNS.


Information.png Tip:
You can verify that your settings are correct by sending an email to check-auth@verifier.port25.com, a free service the purpose of which is to verify if your domain does not contradict mail policies. Please check the answer carefully. See bugzilla:4558#c6

also see bugzilla:9694 and https://wikit.firewall-services.com/doku.php/smedev/qpsmtpd_096#documentation

More details are available here

Incoming DKIM checking is also enabled out of the box.

Domain Keys

There is a plugin to check incoming mail has been signed

Please read here for more details : http://bugs.contribs.org/show_bug.cgi?id=4569


Warning.png Warning:
There is a plugin for signing with DomainKeys but it is not installed by default. It has not been tested on Koozali SME Server:

http://wiki.qpsmtpd.org/doku.php?id=plugins:spam:domainkeys_sign


Other information

DomainKeys seem to be deprecated in favour of DKIM.

The DomainKeys plugin only CHECKS incoming email. Spamassassin checks for DKIM.

Temporary_error_on_maildir_delivery

In certains cases you have some mailboxes which can't delivery messages and the qmail log say:

deferral: Temporary_error_on_maildir_delivery._(#4.3.0)/

It is probably that your users want to go beyond the upper limit of their quota, so you have to increase it. This could solve their problems.

External Access

Allow external IMAP mail access

There was a deliberate decision to remove non-SSL protected username/password services from the external interface.


Warning.png Warning:
Keep in mind that your passwords, your data won't be protected and will be in clear text over Internet

to allow unsecure IMAP access

config setprop imap access public
signal-event email-update

But before you do this try to use secure IMAP (IMAPS or imap over ssl) with port 993

POP3 & webmail HTTP

I want to set my SMESERVER to allow POP3 (or webmail HTTP) but it's not an option, I only see POP3S (or webmail HTTPS).

The SMESERVER is secure by design. POP3 (or webmail HTTP) is viewed as inadequate security and removed as an option from a standard installation to encourage unknowing administrators to select the 'best practice' option -a secure connection with POP3S, IMAPS, or HTTPS.

Warning.png Warning:
Keep in mind that your passwords, your data won't be protected and will be in clear text over Internet

You can still set your SMESERVER to allow POP3 settings by:

config setprop pop3 access public
signal-event email-update

Allow external pop3 access

Email settings > POP3 server access in SME 7.1 server-manager allows only pop3s protocol for clients outside the LAN. Some email clients (eg The Bat! v3.98.4) won't allow pop3s connections to SME 7.1 because of ssl version conflict. Until this is sorted out, a workaround is to hack SME to allow regular pop3 on the external interface using the following commands.

Warning.png Warning:
Keep in mind that your passwords, your data won't be protected and will be in clear text over Internet

config setprop pop3 access public
signal-event email-update
svc -t /service/pop3s  

more information bugzilla:2620

Imap

Folders with a dot in name

Email folder names that have a period ('.') in the folder name, will be split into sub-folders. e.g. folder name 'www.contribs.org' is created as

www
  contribs
        org

qpsmtpd

SME uses the qpsmtpd smtp daemon.

Official Description

qpsmtpd is a flexible smtpd daemon written in Perl. Apart from the core SMTP features, all functionality is implemented in small "extension plugins" using the easy to use object oriented plugin API.

qpsmtpd was originally written as a drop-in qmail-smtpd replacement, but now it also includes smtp forward, postfix, exim and maildir "backends".

qpsmtpd wiki: http://wiki.qpsmtpd.org

Log watching tool

qplogtail is a script to to monitor /var/log/qpsmtpd/current, see bugzilla:3418

Qpsmtpd for SME versions 9.1 and earlier

Warning.png Warning:
Please note that the version of qpsmtpd has been upgraded for SME version 9.2 and later to qpsptpd version 0.96. This change has resulted in a lot of changes to the way it works, the plugins (and their names!) and the corresponding database entries, so this section ONLY applies to SME Version 9.1 and earlier, except where the plugin has been retained, See the next section for the new details.

Default Plugin Configuration

SME uses the following qpsmtpd plugins to evaluate each incoming email.

SME maintains 2 distinct configurations: one for the 'local' networks (as defined in server-manager::Security::Local networks) and another for 'remote' networks (everyone else).

The default configuration of each plugin is indicated in the 'Default Status' column.

Plugin Purpose Default Status
hosts_allow Prohibit more than "InstancesPerIP" connections from any single host (change with 'config setprop smtpd InstancesPerIP'). Allow or deny connections according to the contents of /var/service/qpsmtpd/config/hosts_allow. See hosts_allow SVN code for more details. enabled
peers Allow different plugin configuration based on the sending computer's IP address. By default SME maintains different configurations for the local networks (in /var/service/qpsmtpd/config/peers/local) and for everyone else (in /var/service/qpsmtpd/config/peers/0) enabled
logging/logterse Allow greater logging detail using smaller log files. Optionally supports qplogsumm.pl to compile qpsmtpd statistics. enabled
auth/auth_cvm_unix_local Allow authenticated smtp relay enabled (remote)
disabled (local)
check_earlytalker reject email from servers that talk out of turn enabled (remote)
disabled (local)
count_unrecognized_commands reject email from servers that issue X invalid commands enabled (remote)
disabled (local)
bcc bcc all email to a specific address for archiving disabled
check_relay Check to see if relaying is allowed (in case the recipient is not listed in one of SME's local domains) enabled
check_norelay Check to see if the sending server is specifically forbidden to relay through us. enabled
require_resolvable_fromhost Check that the domain listed in the sender's email address is resolvable enabled (remote)
disabled (local)
check_basicheaders reject email that lacks either a From: or Date: header enabled
rhsbl Reject email if the sender's email domain has a reputation for disregarding smtp RFCs. disabled
(always disabled for local connections)
dnsbl Reject email from hosts listed in your configured dnsbl servers disabled
check_badmailfrom Reject email where the sender address is listed in /var/service/qpsmtpd/config/badmailfrom enabled
check_badrcptto_patterns Reject email addressed to any address matching an expression listed in /var/service/qpsmtpd/config/badrcptto_patterns enabled
check_badrcptto Reject email addressed to any address listed in /var/service/qpsmtpd/config/badrcptto enabled
check_spamhelo Reject email from hosts that say 'helo ...' using a value in /var/service/qpsmtpd/config/badhelo enabled
check_smtp_forward If config show DelegateMailServer or db domains show <domainname> MailServer is set (telling SME to deliver email for all domains or just <domainname> to another server), check_smtp_forward will connect to the specified server and will reject the message outright if the internal mail server would also reject it. disabled
unless an internal mail server is configured.
check_goodrcptto Accept email only if the recipient address matches an entry in /var/service/qpsmtpd/config/goodrcptto. For domains that are configured to use an internal mail server, the entire domain name will be added to .../goodrcptto. enabled
rcpt_ok Return 'OK' if none of the other host checks has returned 'DENY' (??) enabled
pattern_filter Reject email according to content patterns (??) disabled
tnef2mime Convert MS TNEF (winmail.dat) and uuencoded attachments to MIME enabled
disclaimer Add a configurable disclaimer to email messages disabled
spamassassin Check email using spamassassin, and optionally reject it completely if the score exceeds a configurable value. disabled
(always disabled for local connections)
virus/clamav Scan incoming email with ClamAV enabled
queue/qmail-queue Deliver the incoming message to qmail for delivery. enabled

Qpsmtpd for SME versions 9.2 and Later

Warning.png Warning:
Please note that the version of qpsmtpd has been upgraded for SME version 9.2 and later to qpsptpd version 0.96. This change has resulted in a lot of changes to the way it works, the plugins (and their names!) and the corresponding database entries, so this section ONLY applies to SME Version 9.2 and later version, see the previous section for the details.

This section has been taken from the notes prepared by the dev who made the changes, the wiki is here.

Here is a list of the plugins in use, and a note of any changes that might have occurred:

 * logterse: no change
 * tls: no change
 * auth_cvm_unix_local: no change
 * check_earlytalker: **renamed earlytalker**
 * count_unrecognized_commands: no change
 * bcc: no change
 * check_relay: **renamed relay**
 * check_norelay: **merged into the relay plugin**
 * require_resolvable_fromhost: **renamed resolvable_fromhost**
 * check_basicheaders: **renamed headers**
 * rhsbl: no change
 * dnsbl: no change
 * check_badmailfrom: **renamed badmailfrom**
 * check_badrcptto_patterns: **doesn't exist anymore, merged with badrcptto**
 * check_badrcptto: **renamed badrcptto**
 * check_spamhelo: **renamed helo**
 * check_smtp_forward: no change
 * check_goodrcptto: no change
 * rcpt_ok: no change
 * pattern_filter: no change
 * tnef2mime: no change
 * spamassassin: no change
 * clamav: no change
 * qmail-queue: no change

Here is a section for each of the new plugins which are installed by default. The ones that have not changed are documented above.

Karma

The karma plugin tracks sender history. For each inbound email, various plugins can raise, or lower the "naughtiness" of the connection (eg, if SPF check passes, if the message is spammy etc...). For each host sending us email, the total number of connections, and the number of good and bad connections is recorded in a database. If a host as more bad than good connections in its history, emails will be rejected for 1 day. 3 settings are available for this plugin:

 * Karma (enabled|disabled): Default value is disabled. Change to enabled to use the plugin
 * KarmaNegative (integer): Default value is 2. It's the delta between good and bad connection to consider the host naughty enough to block it for 1 day. Eg, with a default value of two, a host can be considered naughty if it sent you 8 good emails and 10 bad ones
 * KarmaStrikes (integer): Default value is 3. This is the threshold for a single email to be considered good or bad. Eg, with the default value of 3, an email needs at least 3 bad karmas (reaches -3) for the connection to be considered bad. On the other side, 3 good karmas are needed for the connection to be considered good. Between the two, the connection is considered neutral and won't be used in the history count

Example: db configuration setprop qpsmtpd Karma enabled KarmaNegative 3 signal-event email-update

URIBL

The URIBL plugin works a bit like RHSBL, except that it checks domain names found in the body of the email. For each URI identified, the corresponding domain name can be submitted to a BL list (through DNS queries). Two settings are available:

 * URIBL (enabled|disabled): Default is disabled. Set this to enabled to use the plugin
 * UBLList: (Comma separated list addresses): Default value is **multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net**. This can be the same as RBLList. You can also set bitmask to use for combined lists (in the default value, the bitmask is 8-16-64-128)

Example: db configuration setprop qpsmtpd URIBL enabled UBLList multi.surbl.org,black.uribl.com signal-event email-update

Helo

Previously, the helo plugin was just checking for some known bad helo hostnames used by spammers (aol.com and yahoo.com). Now, it can check much more than that. This plugin is always enabled and has a single setting:

 * HeloPolicy: (lenient|rfc|strict). The default value is **lenient**. See https://github.com/smtpd/qpsmtpd/blob/master/plugins/helo for a description of the various tests done at each level

Example:

db configuration setprop qpsmtpd HeloPolicy rfc signal-event email-update

Inbound DKIM / SPF / DMARC

DMARC is a policy on top of DKIM and SPF. By default, SPF and DKIM are now checked on every inbound emails, but no reject is attempted. The dmarc plugin can decide to reject the email (depending on the sender policy). dkim and spf plugins are always enabled. dmarc has two settings:

 * DMARCReject (enabled|disabled): Default value is disabled. If set to enabled, the dmarc plugin can decide to reject an email (if the policy of the sender is to reject on alignment failure)
 * DMARCReporting (enabled|disabled): Default value is enabled. If set to enabled, enable reporting (which is the **r** in dma**r**c). Reporting is a very important part of the DMARC standard. When enabled, you'll record information about email you receive from domains which have published a DMARC policy in a local SQLite database (/var/lib/qpsmtpd/dmarc/reports.sqlite). Then, once a day, you send the aggregate reports to the domain owner so they have feedback. You can set this to disabled if you want to disable this feature
 * SPFRejectPolicy (0|1|2|3|4): Default value is 0. Set the policy to apply in case of SPF failure when the sender hasn't published a DMARC policy. Note: this is only used when no DMARC policy is published by the sender. If there's a DMARC policy, even a "p=none" one (meaning no reject), then the email won't be rejected, even on failed SPF tests.
   * 0: do not reject anything
   * 1: reject when SPF says fail
   * 2: reject when SPF says softfail
   * 3: reject when SPF says neutral
   * 4: reject when an error occurred (like a syntax error in SPF entry) or if no SPF entry is published
 * Inbound DKIM checks are only used by DMARC. No reject solely based on DKIM is supported

Example: db configuration setprop qpsmtpd DMARCReject disabled SPFRejectPolicy 2 signal-event email-update

Outbound DKIM signing / SPF / DMARC policy

Everything is now ready for you to sign your outbound emails, and publish your public key, as well as your SPF and DMARC policy. A default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domain you manage:

db configuration setprop qpsmtpd DKIMSigning enabled signal-event email-update

If you want to disable dkim signing for a domain, you can use: db domains setprop domain.com DKIMSigning disabled signal-event email-update

The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:

cd /home/e-smith/dkim_keys mkdir domain.net cd domain.net echo default > selector openssl genrsa -out private 2048 openssl rsa -in private -out public -pubout chown qpsmtpd:qpsmtpd private chmod 400 private signal-event email-update

Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.

Publishing your DNS entries

Signing your outbound emails is just part of the process. You now need to publish some DNS entries so everyone can check if the email they receive matches your policy. This part is not to be done on your SME Server, but on your public DNS provider. A script helps you by creating some sample DNS entries already formatted for a bind-like zone file. To use it:

qpsmtpd-print-dns <domain name> If omitted, the primary domain name is assumed.

Example output: Here are sample DNS entries you should add in your public DNS The DKIM entry can be copied as is, but others will probably need to be adjusted to your need. For example, you should either change the reporting email adress for DMARC (or create the needed pseudonym)


default._domainkey IN TXT "v=DKIM1;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/Qq3Ntpx2QNdRxGKMeKc2r9ULvyYW633IbLivHznN9JvjJIbS54PGIEk3sSxvZSdpTRAvYlxn/nRi329VmcDK0vJYb2ut2rnZ3VO3r5srm+XEvTNPxij5eU4gqw+5ayySDjqzAMEMc5V7lUMpZ/YiqnscA075XiMF7iEq8Quv1y0LokmgwtxzOXEZap34WXlKyhYzH+D""fabF6SUllmA0ovODNvudzvEOanPlViQ7q7d+Mc3b7X/fzgJfh5P9f5U+iSmzgyGctSb6GX8sqsDMNVEsRZpSE3jd2Z33RDWyW21PGOKB/ZrLiliKfdJbd3Wo7AN7bWsZpQsei2Hsv1niQIDAQAB" @ IN SPF "v=spf1 mx a -all" @ IN TXT "v=spf1 mx a -all" _dmarc IN TXT "v=DMARC1; p=none; adkim=s; aspf=r; rua=mailto:dmarc-feedback@domain.net; pct=100"

All you have to do now is publish those records

Testing

You can install spfquery:

yum --enablerepo=epel install libspf2 libspf2-progs

Usage (try -help for help):

spfquery -ip=11.22.33.44 -sender=user@aol.com -helo=spammer.tld

Check record via dig

dig -t TXT +short somedomain.co.uk

Load

The loadcheck plugin can temporarily deny inbound emails if your server is overloaded. This plugin is always enabled and has a single setting:

 * MaxLoad (int number): Default is 7. If your load is above this value, emails from the outside will be deferred.

Other QPSMTPD Plugins

The following qpsmtpd plugins will work on a SME server, but are either not included or are not configured by default.

Plugin Purpose Default Status
connection_time Track the total time for each qpsmtpd connection from 'Accepted connection' through 'click, disconnecting', and output the results to the qpsmtpd log file. not installed - not clear if this works for SME9.2 (anyone?)
GeoIP Track the geographic origin of incoming email and optionally reject email from specified countries not installed - does work for SME 9.2 and later.

Internal or External Mail Servers

SME can be configured as a spam and antivirus filter for one or more "Internal or External" mail servers on a domain-by-domain basis. The mail server specified does not have to be on the same local network as your SME server, & can be hosted on an external site.

Deliver ALL email to a single internal or external mail server

You can set the default delivery location for all domains on your SME server to a single internal or external mail server by setting the mail server address in server-manager::Configuration::E-mail::Change e-mail delivery settings::Address of internal mail server.

Note: Address of internal mail server must be blank if you want any email delivered to the SME server itself.

Deliver email for one domain to an internal or external mail server

You can override the default email delivery destination for individual domains on your SME server (forwarding all email for the specified domain to another server) as follows:

First, create the necessary virtual domains using server-manager::Configuration::Domains::Add Domain.

Then, (assuming your domain is called test.com and the actual mail server is at a.b.c.d issue the following commands:

db domains setprop test.com MailServer a.b.c.d
signal-event email-update

A FQDN can also be used for the MailServer property, eg aspmx.l.google.com instead of the IP address a.b.c.d

db domains setprop test.com MailServer aspmx.l.google.com
signal-event email-update


Remove the internal or external mail server (and return email delivery for test.com to the default for your SME server) using:

db domains delprop test.com MailServer
signal-event email-update

Secondary/Backup Mail Server Considerations

Many people misunderstand the issues of using a secondary or backup mail server (backup MX) to hold your mail before it gets delivered to your SME Server. If you consider putting a backup mail server in place because you are concerned about lost mail because your internet connection may occasionally drop out, think again and consider the issues discussed below.

What is Backup MX

A backup MX is a system whereby through your DNS records you tell other servers on the internet that in order to deliver mail to your domain they first need to try the primary MX record and if they fail to connect they can try to connect to one or more of your listed backup or secondary mail servers. See also http://en.wikipedia.org/wiki/MX_record

The process of delivering email to your SME Server

So lets look at how mail gets delivered without and with a backup mx when your Internet link, ISP or server is down.

Without a backup MX

  • The sending mail server cannot connect to your server.
  • The sending mail server MUST queue the mail and try again later.
  • The mail stays on the sender's server.
  • The sender's server resends the mail at a later date.

The requirement to re-queue is a fundamental part of the SMTP protocol - it is not optional. So, if your server is offline due to a link or ISP outage, the mail just stays at the sender's server until you are once again reachable.

With a backup MX

  • The sending mail server cannot contact your server.
  • The sending mail server sends the mail to your secondary MX.
  • The secondary MX queues the mail until your link/server is up.
  • The mail is queued on an untrusted third-party mail server (think about confidential mail between your company and some business partner).
  • The sending mail server's administrator thinks it has been delivered, according to their logs.
  • You have no, or little, visibility over the queued mail.
  • When your link comes up, the secondary MX sends the mail on to your server.
  • You have added more hops, more systems and more delay to the process.

If you think that a backup MX will protect against broken mail servers which don't re-queue, you can't. Those servers will drop mail on the floor at random times, for example when their Internet link is down.

Those servers are also highly likely to never try your backup MX.

Thankfully those servers are mostly gone from the Internet, but adding a secondary MX doesn't really improve the chances that they won't drop mail destined for your server on the floor.

Backup MX and SPAM Filtering

On top of the issue, indicated above, there is another issue to consider and that is what happens with SPAM due to the use of a Backup MX.

Your SME Server takes care of filtering a lot of SPAM by checking on the full username & domain at the time it is received.

For example if your server hosts example.com and someone sends mail to joeuser@example.com, the server will only accept the mail if joeuser is a local user/alias/group/pseudonym on the server. Otherwise, the mail is rejected during the SMTP transaction.

A backup mail server however, generally does not have a full list of users against which it can check if it should accept the mail for the given domain. Hence it will accept mail for invalid users.

So:

  • If you trust the secondary MX, you will accept a lot of SPAM when the link comes up.
  • If you don't trust it, you will cause a lot of SPAM backscatter as the mail has been accepted at the secondary MX and then later bounced by you.
  • Stopping backscatter is why SME Server rejects invalid addresses during the initial SMTP transaction.

The SPAM backscatter can only be stopped if the secondary MX has a full list of users for your domain to allow filtering to occur.

But:

  • You need to be able to configure this secondary MX with such user/domain lists
  • You need to maintain these secondary configurations when users are added/deleted from your primary server configuration
  • You need to test (regularly) if the secondary is successfully accepting/rejecting mail as required.

Quite a few sites have lost lots of mail through misconfigured backup MX servers. Unfortunately, the time when you find out they are misconfigured is when you go to use them, and then you find that the backup MX has changed configuration and bounced all of your mail.

Then you realise that this mail could have queued at the sender's site if there hadn't been a broken secondary MX bouncing the mail for you.

  • If you bounce mail at your server, you have logs to show what's wrong.
  • If your secondary MX bounces your mail, you usually have no way to determine what happened other than via reports from the original senders that your mail bounced.

Summary

In summary, if your server/Internet connection is available most (let's say >90%) of the time, you are generally better off without a secondary MX.

If your server/link is down more than this (e.g. dialup), you should not be delivering mail directly to your server.

If you still want to consider setting up a seconday MX, ensure that:

  • you have fully control of the configuration of each of the email gateways for your domain
  • each gateway can make decisions on whether to accept/reject mail for the users at the domain

Mail server on dynamic IP

Problems with running a mail server on SME server using a dynamic external IP from ISP

This information comes from http://bugs.contribs.org/show_bug.cgi?id=2057#c10

This is the chronological sequence of events that leads to issues with mail servers on dynamic IPs:

1) Server gets dynamic IP

2) Reboot/power fail (without updating dynamic DNS to "offline")

3) Another server/someone else is allocated your old IP while your server is down

4) The other server/person is running a mail server

5) The other server either gets your mail (which is bad) or bounces your mail (also bad)

You have no control over this issue and you will lose mail when it happens. If you have a dynamic IP, the recommended approach is to get someone with a static IP to queue your inbound mail and send it to you on a non-standard port, preferably with an authentication mechanism which queues the mail if the auth fails, just in case someone else happens to have a mail server on the same port (while highly unlikely, this is possible).

Whether this issue is really a problem to end users, depends on how much you "value" your mail. For a home user having their own mail server, it is probably not a great problem if some messages should happen to go astray, but for all other classes of users, you should really avoid running a mail server on a dynamic IP, without implementing a suitable queueing workaround as suggested. Some ISPs change the IP very infrequently eg yearly, so in those cases it is also not a significant problem. Many/most ISP's will issue a new IP every time a connection is lost & re-established, so these situations are more problematic.