<HTML><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><meta name="Generator" content="Microsoft Word 12 (filtered medium)"><style> /* Font Definitions */ @font-face {font-family:PMingLiU; panose-1:2 2 5 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:"\@PMingLiU"; panose-1:2 2 5 0 0 0 0 0 0 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri","sans-serif"; color:windowtext;} .MsoChpDefault {mso-style-type:export-only;} @page Section1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.Section1 {page:Section1;} </style></head><body lang="EN-US" link="blue" vlink="purple">Feel free to report these suggestions as bugs against ubuntu doc package <hr>From: James Rodríguez de Castro <decastro@netvigator.com> Sent: Saturday, December 13, 2008 10:36 AM To: ubuntu-doc@lists.ubuntu.com Cc: rjls@jabber.org; bhuvan@collab.net Subject: Problems with mail section of Ubuntu Server Doc <div class="Section1">Hi there<o:p></o:p><o:p> </o:p>I have run into a few problems with the mail section of Ubuntu Server documentation and have two suggested changes and some questions.<o:p></o:p>I am trying to set up a mail server using Postfix, Dovecot, Amavis, clamAV, Spamassassin etc… just like the guide explains, using Maildir/ storage format and IMAP server based storage, with SASL authentication and TLS certificates for server and client authentication.<o:p></o:p><o:p> </o:p>Problem 1) and question<o:p></o:p>In /etc/postfix/main.cf<o:p></o:p>The recommended default contains the line:<o:p></o:p>mailbox_command = procmail -a "$EXTENSION"<o:p></o:p>As set out in the guide, and with the guide only as guidance, this does not work. Mails simply don’t get delivered at all. I think $EXTENSION is undefined (maybe there needs to be some further entries in /etc/postfix/master.cf which have not yet made it into the documentation to set up the user .procmailrc files etc..), and there are no instructions on how to configure procmail which can be a whole new subject in itself.<o:p></o:p>However, if you replace the line with :<o:p></o:p>mailbox_command = /usr/lib/dovecot/deliver<o:p></o:p>then mails do get delivered. Is there any reason why the procmail line is there – maybe relating to spam filtering etc.? If yes, then that needs to be documented, an if not then the dovecot/deliver alternative needs to be substituted into the default installation and the reference to procmail removed (or just replaced with a comment that says something like “if you are a procmail expert this is where you WOULD insert it”)<o:p></o:p><o:p> </o:p>Problem 2) Multiplication of certificates.<o:p></o:p>The Postfix installation routine goes through creating an smtpd.crt certificate and smtpd.key pair to use for authenticating the server, which then get referenced in the /etc/postfix/main.cf file. This is presumably a TLS server certificate.<o:p></o:p>The Dovecot configuration does the same but with a ssl-cert-snakeoil certificate and key pair, which do its SSL authentication.<o:p></o:p>Am I correct in thinking that we could (and probably should) use the same certificate and key pair for both functions?<o:p></o:p>In which case maybe we should see instructions to create server.crt and server.key, and use this single pair instead of smtpd.crt, smtpd.key, ssl-cert-snakeoil and ssl-key-snakeoil in both Postfix and Dovecot, and change the default /etc/postfix/main.cf and /etc/dovecot/dovecof.conf accordingly. OR, is there a clear reason why Postfix and Dovecot SHOULD be using different server cert/key pairs, and if so, what is this reason?<o:p></o:p><o:p> </o:p>Problem 3) TLS certificates.<o:p></o:p>I have been unable so far with the provided instructions in the Server guide to set up TLS client authentication. If I set Evolution to use SSL for receiving emails it works, if I choose “TLS” it says “connection refused”. When it does work using SSL, the full message header says “the client did not present a certificate”. I suspect this whole class of symptoms could be to do with the required x509v3 extensions for the CA, server cert, and client certs somehow not playing nice with each other.<o:p></o:p>Could you please document which extensions are needed for each type of certificate so that it all works together without problems?<o:p></o:p><o:p> </o:p>Problem 4) Mail filtering.<o:p></o:p>I have followed to the letter the instructions for setting up amavis, clamav, spamassasin, pyzor-razor etc. and tested it, and the full header of received messages (from inside our local network) shows an X-entry referring to antivirus scanning having been done, but nothing relating to spam like the guide says I should be seeing. I have not yet opened this server to the external internet as it doesn’t seem ready for prime time yet. As there is no entry in the header referring to spam scoring etc.. I am beginning to think that the spam filtering side is not working. Why could this be? Does it depend on procmail being up, in which case Problem 1) above could be related?<o:p></o:p>Also, where does one see filtered spam and how does this get configured? The Server Guide is silent on the subject, and it should perhaps mention ‘configuration file X sets out the path / folder / whatever where Spamassasin will drop suspected spam’, and ‘if any non-spam message gets tagged as spam, this (file Y) is how you tell Spamassasin about it so that it doesn’t do it again’<o:p></o:p><o:p> </o:p>Request 1)<o:p></o:p>Could you sent me a set of /etc/postfix main.cf and master.cf, plus /etc/dovecot/dovecot.conf that you have configured according to your latest recommendations and which are known to work together for Maildir/, IMAP with SASL and TLS, and Amavis/ClamAV/Spamassasin?<o:p></o:p><o:p> </o:p>Request 2) <o:p></o:p>Could you please send me the required extensions for 1) the CA certificate, 2) the server certificate, 3) the client certificates? Also, what should the Common Name be for the client certificates? Should it be “user1” or <a href="mailto:user1@example.com">user1@example.com</a> ?<o:p></o:p><o:p> </o:p>Hope this is all clear and look forward to hearing back soon!<o:p></o:p><o:p> </o:p>Thanks in advance<o:p></o:p><o:p> </o:p>James R de Castro<o:p></o:p></div></body></HTML>