Setting up Postfix + MySQL + Courier-IMAP + Mailman + vmail + Procmail + SpamAssassin

I just finished setting up Postfix + MySQL + Courier-IMAP + Mailman + vmail + Procmail + SpamAssassin. This combination will give you email sending, receiving, and picking up via IMAP, POP3 or POP3+SSL, true virtual domains and email accounts, mailing lists with a web interface, and a simple web interface for creating virtual domains and email accounts. These instructions should work with Fedora Core 1 and Red Hat 9, and I hope these instructions will also be helpful for people with other distributions. This document is based on the vmail setup document, but I have added much more detail as well as specific instructions for Red Hat-based distributions, as well as explanations of the structure of the mail system and some information on Mailman, Procmail, and SpamAssassin (more to come later).

Overview

Basic defintions. Postfix is a mail transfer agent which handles SMTP (for sending and receiving email). Courier-IMAP is the IMAP and POP3 component (for retrieving email) of the Courier mail system, which can be configured to work with other mail transfer agents (like Postfix). Procmail is used to actually deliver the email, and passes the email through SpamAssassin. SpamAssassin is a spam email filter. Mailman is a mailing list system with a web interface for configuring the mailing lists (but basic configuration must be done by hand), and vmail is a simple PHP-based web interface for setting up virtual domains and virtual domain-based email accounts. MySQL is used to store authentication information and virtual domain account information.

To get all this software to work together, we have to configure them to use a compatible format for storing/delivering mail (when Postfix receives mail it needs to store it in a form that Courier-IMAP understands, so users can retrieve their email via POP3 or IMAP, and it should send it to Procmail for the actual delivery), authentication (Courier-IMAP needs to know how to check user passwords when users retrieve their email), administration (vmail needs to be configured to store user and virtual domain information in a way that Postfix and Courier-IMAP can understand), spam filtering (Procmail needs to filter email through SpamAssassin) and since Mailman also creates email aliases, we also need to configure Postfix and Mailman so they are using a compatible format for these aliases (Mailman creates its own aliases, and Postfix needs to know how to read these aliases).

For in depth information about using the postfix virtual agent check out this howto.

We assume a base directory of /usr/local/vmail, user "vmail", database user "vmail" here, use whatever values you want, these are only examples, but be sure to put the right settings in the php and perl scripts.

Make a user

  vmail:*:uid:gid::0:0:vmail:/usr/local/vmail:/nonexistent
  
  Note: change uid:gid to whatever free uid and
    gid are available for the vmail account.
    Note the uid and gid for later reference.

Postfix

IMPORTANT: For security reasons it is a good idea to configure Postfix to run chrooted, which means that certain Postfix processes (like the SMTP server) will only be able to see files underneath /var/spool/postfix. For instructions on configuring Postfix in a chrooted environment, read the INSTALL document in the Postfix source directory. The problem is when you run Postfix chrooted, it will not be able to access the /var/lib/mysql/mysql.sock file to talk to MySQL on localhost, since that file is outside of the chroot jail. Symlinks to files outside the chroot jail will also fail. You can create a hard link to the socket, but that link will be invalidated whenever you restart mysqld. You can do two things to get around this: either re-create the hard link by editing the mysqld startup script and adding the link command there (/etc/rc.d/init.d/mysqld), which seems a bit kludgy to me, or, a better solution is to specify 127.0.0.1 as the host name to pfsqlfiles (see below), instead of localhost, which will force Postfix to use TCP to talk with MySQL. Note that your mysqld server must be configured to accept TCP connections on the standard port (at least from the local machine) --- this is the default so you probably don't need to do anything special here.

The pfsqlfiles script will make the mysql info files for postfix, to save some annoying typing. It will prompt for database info (remember to use 127.0.0.1) and write the files to the current directory.

Set permissions on the files so the postfix user can read them and others can't access them.

MySQL

  mysql -u root -p < vmail.sql

  mysql> GRANT select, insert, update, delete
  ON vmail.* TO vmail@localhost IDENTIFIED BY 'password';
  mysql> GRANT select, insert, update, delete
  ON vmail.* TO vmail@hostname IDENTIFIED BY 'password';
  mysql> FLUSH PRIVILEGES;

Debugging MySQL problems: You may wish to start mysqld with the log option turned on so you can debug common problems with configuration. To do this, edit the /etc/rc.d/init.d/mysqld script file and add --log=/var/log/mysql.log as the last argument to /usr/bin/safe_mysqld and restart mysqld with "service mysqld restart". You will then be able to track problems with logins or permissions by looking at /var/log/mysql.log. Be sure to take the log option out once you have everything working, because logging will slow down the performance of the MySQL database.

vmail

$server = 'localhost';
$user = 'vmail';
$pass = 'password'; // <== database password you chose above
$db = 'vmail';

// vmail home dir (set this)
$vmailbase = '/usr/local/vmail';

// vmail uid, gid
$uid = uid; // <== set this to the uid of the vmail user
$gid = gid; // <== set this to the gid of the vmail group

// main admins email address
$admin = 'admin_email_address'; // <== send to a real person

// dir name for admin login (http://url.to/vmail/admindir/)
$admindir = 'admin';

The maintain script handles deleting maildirs on deleted accounts, renaming maildirs, etc...
I add an /etc/crontab entry to run it as the vmail user:

*/5	*	*	*	*	vmail	/usr/local/vmail/maintain

admin setup

	# vmadmin +admin

Now you can browse to http://your.url.to/vmail/admin/ to login as the superuser and add a domain. Your base url will be the normal login for postmasters.

You can also use the vmadmin script to edit things on the command line, but its not quite polished yet. make sure to su to the vmail user to run it.

The web interface is pretty self explainitory, just take a look around...

Courier-IMAP

  --with-authmysql --with-mysql-libs=/usr/local/lib/mysql/ \
    --with-mysql-includes=/usr/local/include/mysql

  PLIST_SUB+=     MYSQLFLAG=""
    endif

Add --with-authpwd to CONFIGURE_ARGS if you're going to be serving regular system accounts also.
Then you can make -DWITH_MYSQL and courier will compile with authmysql correctly.

Authdaemond also, by default, just chooses the first authentication module it finds in the /usr/lib/courier-imap/libexec/authlib directory. You can either move all the authdaemond.* files out of that directory except for authdaemond.mysql, or set AUTHDAEMOND="authdaemond.mysql" in the /usr/lib/courier-imap/etc/authdaemonrc file.

Mailman

procmail

SpamAssassin