edin.no-ip.com

Not every one need a complete solution of virtual hosting email system: you may only hope to have a simple email system within your personal server, and let you check your system log remotely. For this, you may hope you email system come with:

1. Support both SMTP, SSMTP with authentication
2. Support both POP3, POP3S, IMAP2, IMAPS

And that's all! This simple HOWTO will guide you though the detail steps.

Install required packages

Prepare your user account

First of all, we need to have a full picture about how user is being authenticated:

1. SMTP authentication request, from remote client to Exim4.
2. Internal request of authentication information, from Exim4 to Courier.
3. courier-authdaemon use it authentication backend to query user information, e.g. PAM under normal Debian's Courier setup; for the case of multi-hosting server, we will use MySQL as backend.
4. PAM will look up user information from /etc/passwd, /etc/group, and /etc/shadow, which means: host's local user account information.

So let's work it out. Create Maildir under /etc/skel/, therefore every new user will come with a valid Maildir under their home directory:

If you have an existing user account without Maildir under home directory, run the following command:

If you hope to create a new user account, just simply create in Debian style:

Configure Courier

Actually you don't need to anything for courier: Debian default setup for courier will configure it to use PAM as authentication backend, check /etc/courier/authdaemonr and you will find that:

We will need to reconfigure the pop3d.pem and imapd.pem. here i will make use of Debian etch make-ssl-cert:

(Optional, you may only use this if default PAM authentication backend is not function as well) Check the permission of courier authdaemon socket and its directory. By default, the directory is 700 and so not readable:

ls -lad /var/run/courier/authdaemon /var/run/courier/authdaemon/socket

And should have similar result:

drwx------ 2 daemon daemon 4096 2009-01-23 11:33 /var/run/courier/authdaemon
srwxrwxrwx 1 root   root      0 2009-01-23 11:33 /var/run/courier/authdaemon/socket

Run the following command to change it as 755 and double check its status, e.g.:

chmod 755 /var/run/courier/authdaemon

Check the ports for services with netstat -utal | egrep -e 'pop|imap'. You should have similar result:

NOTE!! Remember to configure your firewall or else you may/may not able to access your services though Internet.

Then test your IMAP with telnet localhost imap2, and work out as follow:

Configure Exim4

First of all, generate the X.509 certification for Exim4:

As mentioned in section "2.1.3. Using Exim Macros to control the configuration" and "2.2.2. Enabling TLS support for Exim as server" from /usr/share/doc/exim4-base/README.Debian.gz, you should create a file with name /etc/exim4/conf.d/main/000_localmacros (split configuration) or /etc/exim4/exim4.conf.localmacros (non-split configuration), and insert lines as following:

Also edit /etc/default/exim4 as following, so Exim4 will listen on both port 25 and 465:

(Optional, you may only use this if default PAM authentication backend is not function as well) Also, you will need to uncomment the following line within /etc/exim4/exim4.conf.template (around line 1811), to active the courier authentication backend:

# This is now the (working!) example from
# http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
# Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
plain_courier_authdaemon:
  driver = plaintext
  public_name = PLAIN
  server_condition = \
    ${extract {ADDRESS} \
              {${readsocket{/var/run/courier/authdaemon/socket} \
              {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
              {yes} \
              fail}
  server_set_id = $auth2
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

login_courier_authdaemon:
  driver = plaintext
  public_name = LOGIN
  server_prompts = Username:: : Password::
  server_condition = \
    ${extract {ADDRESS} \
              {${readsocket{/var/run/courier/authdaemon/socket} \
              {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
              {yes} \
              fail}
  server_set_id = $auth1
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

Finally, run reconfigure Exim4:

Here is my sample configuration:

1. Split configuration into small files?: No
2. General type of mail configuration: internet site; mail is sent and received directly using SMTP
3. System mail name: your FQDN, same as that when you configure the X.509 certification
4. IP-addresses to listen on for incoming SMTP connections: left it blank
5. Other destinations for which mail is accepted: left it blank, or your FQDN, or the domain of your server
6. Domains to relay mail for: left it blank
7. Machines to relay mail for: left it blank, or input your local domain range (e.g. 192.168.0.0/16)
8. Keep number of DNS-queries minimal (Dial-on-Demand)? No
9. Delivery method for local mail: Maildir format in home directory

Check the ports for services with netstat -utal | egrep -e 'smtp|ssmtp'. You should have similar result:

NOTE!! Remember to configure your firewall or else you may/may not able to access your services though Internet.

Try to send a mail to yourself with echo "my test" | mail -s "test message" root, check /var/log/exim4/mainlog and should have similar result:

Also send a mail to someone else in public with echo "my test" | mail -s "test message" someone@elsewhere.com, check /var/log/exim4/mainlog and should have similar result:

Check if TLS active with swaks -a -tls -q HELO -s localhost -au root -ap '<>', and should have similar result:

Check is password authentication is active with TLS with swaks -a -tls -q AUTH -s localhost -au root, answer the password, and should have similar result:

Check your email service with external email client

Up to this moment, you should setup your email service correctly and check with localhost. Next should be your most daily task and target: use your email service with external email client. Here is a very simple guide for setting up ThunderBird 2.x:

1. Go to Tool > Account Settings
2. Add Account
3. Email Account > Your personal information > setup as POP or IMAP, field in SMTP information if this is your first email account.
4. Back to the Account Settings page, go to your email account > Server Settings, configure Security Settings as SSL (port 993 for IMAPS and 995 for POP3S).
5. Back to the Account Settings page, go to your email account > Outgoing Server (SMTP), edit your target SMTP setting, and also set it up as SSL (port 465 for SSMTP)

That's all! Let's enjoy with your new email server :)