Table of Contents
The SCOoffice Mail Server supports POP-Before-SMTP by default using the the Dynamic Relay Authentication Control (DRAC) server. This feature prevents people from using the site as a relay unless they previously have authenticated with the server via POP or IMAP.
The rpc.dracd program uses the Berkeley DB package to maintain a relay authorization map for Postfix. The Cyrus server has been modified to make an RPC call to notify the rpc.dracd daemon to add new host entries to the authorization map for each user after they have logged in using POP or IMAP. The rpc.dracd daemon is then responsible for adding or updating entries in the authorization map and for periodically expiring old entries (by default, every 30 minutes).
For more information, see:
the dracauth(3) and rpc.dracd(1m) manual pages
The DRAC home page (http://mail.cc.umanitoba.ca/drac/index.html)
The SCOoffice Mail Server provides integration with anti-virus software. To enable supported anti-virus software:
Install the anti-virus software.
Tell Postfix to enable virus scanning on the system by uncommenting the content_filter parameter in the /etc/postfix/main.cf file and running postfix reload.
Edit the /etc/opt/lsb-sco.com/msg/vscan.conf file and remove the comments appropriate to your anti-virus software.
For more information, see:
the vscan.conf(5) manual page
the current list of supported anti-virus software packages in the Late News document on the SCOoffice Mail Server documentation website:
your anti-virus software product documentation
Postfix provides support for filtering the headers of incoming mail messages. In addition to routine message sorting, this can be useful in the early stages of a virus' distribution when the subject heading is known but anti-virus checking software has not been updated to protect against it.
Postfix MTA can protect against such attacks using a "header_checks" file. For example, to block all messages with the subject header ILOVEYOU from being received or propagated:
Create the file /etc/postfix/header_checks with the contents:
/^Subject: ILOVEYOU/ REJECT
Change the file ownership to the postfix account:
chown postfix /etc/postfix/header_checks
Then modify the file /etc/postfix/main.cf to include:
header_checks = regexp:/etc/postfix/header_checks
Restart Postfix using either:
In the System menu, click on Mail Services, then click on Reload in the postfix display.
Enter:
/etc/rc.d/init.d/postfix reload
To configure Sophos MailMonitor for SMTP anti-virus software with the SCOoffice Mail Server, follow this procedure:
Familiarize yourself with "Sophos MailMonitor for SMTP (Unix) Release Notes", which are available at:
Install Sophos Anti-Virus for Unix on your SCOoffice Mail Server system before installing MailMonitor. MailMonitor requires SAVI, which is provided by Sophos Anti-Virus for Unix. It is available for download from the Sophos website at:
Make sure you get the version labelled "Linux on Intel using libc6" (linux.intel.libc6.tar).
Install Sophos MailMonitor. It is also available for download from the Sophos website at:
Make sure you get the version labelled "MailMonitor for SMTP on Unix (Linux/Intel)" (mmsmtp.linux.intel.tar).
Run install.sh from the mmsmtp-install directory as directed. Make sure that you set the following values:
127.0.0.1:10025
127.0.0.1
10026
Tell Postfix to enable virus scanning on the system by uncommenting the content_filter parameter in the /etc/postfix/main.cf file and running postfix reload.
Edit the /etc/postfix/master.cf file and comment out the first line, which begins with 127.0.0.1:10025. Normally this line runs the msgvscan(8) which is not used by Sophos MailMonitor. The edited line should read:
# 127.0.0.1:10025
Restart Postfix:
/etc/rc.d/init.d/postfix stop
/etc/rc.d/init.d/postfix start
Start the mmsmtpd daemon by entering:
/usr/local/sophos/mmsmtp/bin/mmsmtpd -start
There should be several mmsmtp-1.0 processes up and running. They can be monitored by checking the /var/log/mmsmtp/mmsmtp.log files.
Verify that the two ports (10025, 10026) are working by entering:
telnet localhost 10025
EHLO localhost
MAIL FROM: root@your_domain
RCPT TO: admin@your_domain
DATA
From: root@your_domain
To: admin@your_domain
Subject: Test
This is a test
.
QUIT
Repeat this process with port 10026.
The results of the telnet commands to these ports should be similar to:
trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 127.0.0.1 ESMTP Postfix
A test virus called "Eicar" is available from Sophos. Attach it to an email message and you (and the admin and postmaster accounts as well) should receive email that a virus has been detected. The email with the virus will be placed by default in the /var/spool/mmsmtp/quarantine directory.
It is not neccessary to edit the vscan.conf(5) file (uncommenting lines, as you would when configuring other anti-virus software) because that file is not used by Sophos MailMonitor.
The SCOoffice Mail Server provides SSL (Secure Socket Layer) configuration by default. That is, https can be used immediately using demonstration keys, and should be used to provide secure web connections.
However, many SSL benefits are not available without a signed certificate and key. These can be obtained:
from commercial Certificate Authority (CA) providers, using Webmin to generate a Certificate Signing Request (CSR) .
using Webmin to generate a self-signed certificate and key.
We recommend using commercial products, because they guarantee unique certificates, and they provide legal protection. Nonetheless, self-signed certificates are adequate for many installations.
Both self-signed certificates and CSRs can be managed with Webmin. In the Webmin interface, select System and Certificate and Key Management. Then select either:
Use the defaults provided and fill out other forms as desired. The Common Name field must match the SCOoffice Mail Server address. When you receive the signed certificate and key from the Certificate Authority, you must import it using the Webmin Import Key or Signed Certificate facility.
Use the defaults provided and fill out other forms as desired. The Common Name field must match the SCOoffice Mail Server address. When you generate the key, you will be prompted to overwrite the demonstration keys in the /etc/ssl/private directory; you can safely do so.
Once you have acquired or generated a key, you must provide the Cyrus and Postfix services with read/write access to the key. Assuming that the new key is /etc/ssl/private/hostkey.pem, enter:
cd /etc/ssl
cp private/hostkey.pem cyrus-key.pem
chown cyrus cyrus-key.pem
chmod 600 cyrus-key.pem
cp private/hostkey.pem postfix-key.pem
chown postfix postfix-key.pem
chmod 600 postfix-key.pem
For more information about SSL configuration, see "Section 4.8. Using Certificate and Key Management" in the Caldera OpenLinux System Administration Guide.