Linux Mail Server Setup

Postfix SMTP Server Setup Howto for RHEL/CentOS 6

INSTALL POSTFIX AND DOVECOT 

 [root@ttc ~]# yum install -y postfix dovecot

Edit the file /etc/postfix/main.cf and uncommend the lines below.

inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
home_mailbox = Maildir/

In mydestination make the comment in other two lines

If Your are using ipv4 set ipv4 like in ipv6 also for both set all

inet_protocols = ipv4

Make sure that all mail_spool_directory lines are commented out. 

Otherwise, it will override the setting in the home_mailbox line above. 

Start the Service

# chkconfig postfix on
       # service postfix restart
       # service postfix status
 

Add a user like nan

Type in the command newaliases in a terminal window. 

This will rebuild the aliases database file. 

# newaliases
 

In the Terminal window, type in the highlighted commands below

[root@ttc ~]# telnet localhost smtp
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 ttc.hpserver.com ESMTP Postfix
ehlo localhost
250-ttc.hpserver.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:<nan>
250 2.1.0 Ok
rcpt to:<nan>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Hi Nan  This is test mail 
Created on 22/12/2011
.
250 2.0.0 Ok: queued as DB7C213F6AC
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@ttc ~]# 
      

To check if the mail indeed exists

 [root@ttc ~]# cat /home/nan/Maildir/new/1324552225.V808I9f698M53702.ttc.hpserver.com

Return-Path: <nan@ttc.hpserver.com>
X-Original-To: nan
Delivered-To: nan@ttc.hpserver.com
Received: from localhost (localhost.localdomain [127.0.0.1])
    by ttc.hpserver.com (Postfix) with ESMTP id DB7C213F6AC
    for <nan>; Thu, 22 Dec 2011 16:39:18 +0530 (IST)
Message-Id: <20111222110948.DB7C213F6AC@ttc.hpserver.com>
Date: Thu, 22 Dec 2011 16:39:18 +0530 (IST)
From: nan@ttc.hpserver.com
To: undisclosed-recipients:;

Hi Nan  This is test mail
Created on 22/12/2011
[root@ttc ~]#

Dovecot POP3/IMAP Server Setup

Configure Dovecot

The settings for Dovecot are spread out across several files. Edit the files listed below and uncomment and updates its lines accordingly. 

/etc/dovecot/dovecot.conf

protocols = pop3 imap lmtp

/etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:~/Maildir

/etc/dovecot/conf.d/20-pop3.conf

pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

Start the Dovecot service

[root@ttc ~]# service dovecot restart
Stopping Dovecot Imap:                                     [FAILED]
Starting Dovecot Imap:                                     [  OK  ]
[root@ttc ~]# chkconfig dovecot on
In the Terminal window, type in the highlighted commands below.

[root@ttc ~]# telnet localhost pop3
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
+OK Dovecot ready.
user nan
+OK
pass nan
+OK Logged in.
list
+OK 2 messages:
1 471
2 479
.
retr 1
+OK 471 octets
Return-Path: <nan@ttc.hpserver.com>
X-Original-To: nan
Delivered-To: nan@ttc.hpserver.com
Received: from localhost (localhost.localdomain [127.0.0.1])
    by ttc.hpserver.com (Postfix) with ESMTP id CF3D313F6AC
    for <nan>; Thu, 22 Dec 2011 16:12:14 +0530 (IST)
Message-Id: <20111222104228.CF3D313F6AC@ttc.hpserver.com>
Date: Thu, 22 Dec 2011 16:12:14 +0530 (IST)
From: nan@ttc.hpserver.com
To: undisclosed-recipients:;

HI This is test mail to you on 22/12/2011
.
retr 2
+OK 479 octets
Return-Path: <nan@ttc.hpserver.com>
X-Original-To: nan
Delivered-To: nan@ttc.hpserver.com
Received: from localhost (localhost.localdomain [127.0.0.1])
    by ttc.hpserver.com (Postfix) with ESMTP id DB7C213F6AC
    for <nan>; Thu, 22 Dec 2011 16:39:18 +0530 (IST)
Message-Id: <20111222110948.DB7C213F6AC@ttc.hpserver.com>
Date: Thu, 22 Dec 2011 16:39:18 +0530 (IST)
From: nan@ttc.hpserver.com
To: undisclosed-recipients:;

Hi Nan  This is test mail
Created on 22/12/2011
.
quit

Setting up samba with Iptables and Selinux

1. Install samba on the server
• # yum install samba
2. Create the group that all the samba users will be contained in, for example 'samba'
• # groupadd samba
3. Create samba users and add it to the above group, which is in this example is 'samba'. Below is the example to create a user named 'user1' and add it to group 'samba'. Set the password for user1
• # useradd user1 -g samba
• # passwd user1
4. Create the directory to be shared. In this example, i will use /home/shared. Change the ownership to root and group ownership to the 'samba' group. Change permission so that only user and group can read write and execute
• # mkdir /home/shared
• # chown -R root.samba /home/shared
• # chmod -R 775 /home/shared

    5.  Add the Port Numbers in the Ip tables
           [root@localhost ~]# iptables -I INPUT -p tcp -m tcp --dport 137 -j ACCEPT
           [root@localhost ~]# iptables -I INPUT -p tcp -m tcp --dport 138 -j ACCEPT
           [root@localhost ~]# iptables -I INPUT -p tcp -m tcp --dport 139 -j ACCEPT
           [root@localhost ~]# iptables -I INPUT -p tcp -m tcp --dport 445 -j ACCEPT
    6.  Save and Restart the Iptables

           [root@localhost ~]# service iptables save

           iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

           [root@localhost ~]# service iptables restart

    7. Add SELinux Settings
          # setsebool -P samba_export_all_rw on
    8.  Change the Setting in /etc/samba/smb.conf

         [Share]
         path = /var/share
         browseble = yes
         writable = yes
         valid users = nttf
      9.Add user/users to samba
        # smbpasswd -a user1
     10. Start smb service, restart if it has already been started
        [root@localhost ~]# service smb restart
        Shutting down SMB services:                                [  OK  ]
        Starting SMB services:                                     [  OK  ]

How to Open Samba Client in terminal

smbclient //<hostname>/<sharename> -U <username>

[root@localhost ~]# smbclient //192.168.0.212/share -U nttf
Enter nttf's password:
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.5.4-68.el6]
smb: \> ls
  .                                   D        0  Fri Dec 16 14:00:21 2011
  ..                                  D        0  Fri Dec 16 12:00:26 2011

        53566 blocks of size 524288. 48561 blocks available
smb: \>

VNC Configuration

There are several ways to configure the vnc server. This HOWTO shows you how to configure VNC using the 'vncserver' service as supplied by CentOS.

1. Installing the required packages

The server package is called 'vnc-server'. Run the command rpm -q vnc-server.

The result will be either package vnc-server is not installed or something like vnc-server-4.0-11.el4.

If the server is not installed, install it with the command: yum install vnc-server.

The client program is 'vnc'. You can use the command yum install vnc to install the client if rpm -q vnc shows that it is not already installed.

Make sure to install a window manager in order to get a normal GUI desktop. You can use the command yum groupinstall "GNOME Desktop Environment" to install the Gnome Desktop and requirements, for example. Other popular desktop environments are "KDE" and "XFCE-4.4". XFCE is more light-weight than Gnome or KDE and available from the "extras" repository.

If you are running CentOS 5, yum groupinstall "GNOME Desktop Environment" may complain about a missing libgaim.so.0. This is a known bug. Please see CentOS-5 FAQ for details.

If you are running CentOS 6, the server is tigervnc-server not vnc-server.

2. Configuring un-encrypted VNC

We will be setting up VNC for 3 users. These will be 'larry', 'moe', and 'curly'.

You will perform the following steps to configure your VNC server:

1. Create your VNC users.
2. Set your users' VNC passwords.
3. Edit the server configuration.
4. Create and customize xstartup scripts.
5. Start the VNC service.
6. Test each VNC user.
7. Setup the VNC service to start on reboot.
8. Additional optional enhancements

2.1. Create your VNC users

As root:

$ su -
# useradd larry
# useradd moe
# useradd curly
# passwd larry
# passwd moe
# passwd curly

2.2. Set your users' VNC passwords

Login to each user, and run vncpasswd. This will create a .vnc directory.

[~]$ cd .vnc
[.vnc]$ ls
passwd

2.3. Edit the server configuration

Edit /etc/sysconfig/vncservers, and add the following to the end of the file.

VNCSERVERS="1:larry 2:moe 3:curly"
VNCSERVERARGS[1]="-geometry 640x480"
VNCSERVERARGS[2]="-geometry 640x480"
VNCSERVERARGS[3]="-geometry 800x600"

Larry will have a 640 by 480 screen, as will Moe. Curly will have an 800 by 600 screen.

2.4. Create xstartup scripts ( Skip this step for CentOS 6 )

We will create the xstartup scripts by starting and stopping the vncserver as root.

# /sbin/service vncserver start
# /sbin/service vncserver stop

Login to each user and edit the xstartup script. To use Larry as an example, first login as larry

[~]$ cd .vnc
[.vnc] ls
mymachine.localnet:1.log  passwd  xstartup

Edit xstartup. The original should look like:

#!/bin/sh
# Uncomment the following two lines for normal desktop:
# unset SESSION_MANAGER
# exec /etc/X11/xinit/xinitrc
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
twm &

Add the line indicated below to assure that an xterm is always present, and uncomment the two lines as directed if you wish to run the user's normal desktop window manager in the VNC. Note that in the likely reduced resolution and color depth of a VNC window the full desktop will be rather cramped and a look bit odd. If you do not uncomment the two lines you will get a gray speckled background to the VNC window.

#!/bin/sh
# Add the following line to ensure you always have an xterm available.
( while true ; do xterm ; done ) &
# Uncomment the following two lines for normal desktop:
unset SESSION_MANAGER
exec /etc/X11/xinit/xinitrc
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
twm &

2.5. Start the VNC server

Start the vncserver as root.

# /sbin/service vncserver start

2.6. Test each VNC user

2.6.1. Testing with a java enabled browser

Let us assume that mymachine has an IP address of 192.168.0.10. The URL to connect to each of the users will be:

Larry is http://192.168.0.10:5801
Moe   is http://192.168.0.10:5802
Curly is http://192.168.0.10:5803

Connect to http://192.168.0.10:5801. A java applet window will pop-up showing a connection to your machine at port 1. Click the [ok] button. Enter larry's VNC password, and a 640x480 window should open using the default window manager selected for larry . The above ports  5801, 5802 and 5803  must be open in the firewall {iptables) for the source IP addresses or subnets of a given client.

2.6.2. Testing with a vnc client

For Larry: vncviewer 192.168.0.10:1
For   Moe: vncviewer 192.168.0.10:2
For Curly: vncviewer 192.168.0.10:3

To test larry using vncviewer, vncviewer 192.168.0.10:1. Enter Larry's VNC password, and a 640x480 window should open using Larry's default window manager. The vncviewer client will connect to port 590X where X is an offset of 1,2,3 for Larry, Moe, and Curly respectively, so these ports must be open in the firewall for the IP addresses or subnets of the clients.

2.6.3. Starting vncserver at boot

To start vncserver at boot, enter the command /sbin/chkconfig vncserver on.

For basic VNC configuration the procedure is now complete. The following sections are optional refinements to enhance security and functionality.

3. VNC encrypted through an ssh tunnel

You will be connecting through an ssh tunnel. You will need to be able to ssh to a user on the machine. For this example, the user on the vncserver machine is Larry.

1. Edit /etc/sysconfig/vncservers, and add the option -localhost.

   VNCSERVERS="1:larry 2:moe 3:curly"
   VNCSERVERARGS[1]="-geometry 640x480 -localhost"
   VNCSERVERARGS[2]="-geometry 640x480 -localhost"
   VNCSERVERARGS[1]="-geometry 800x600 -localhost"
   

2. /sbin/service vncserver restart
3. Go to another machine with vncserver and test the VNC.
   1. vncviewer -via larry@192.168.0.10 localhost:1
   2. vncviewer -via moe@192.168.0.10 localhost:2
   3. vncviewer -via curly@192.168.0.10 localhost:3

By default, many vncviewers will disable compression options for what it thinks is a "local" connection. Make sure to check with the vncviewer man page to enable/force compression. If not, performance may be very poor!

4. Recovery from a logout ( Not implemented for CentOS 6 )

If you logout of your desktop manager, it is gone!

• We added a line to xstartup to give us an xterm where we can restart our window manager.
  • For gnome, enter gnome-session.
  • For kde, enter startkde.

5. Remote login with vnc-ltsp-config

To allow remote login access via a vnc-client to the Centos system, the RPM packages named vnc-ltsp-config and xinetd can be installed. When a vnc-client connects to one of the configured ports, the user will be given a login screen. The sessions will *not* be persistent. When a user logs out, the session is gone.

The rpm package vnc-ltsp-config is easily installed via the EPEL repository noted in Available Repositories

Note: There are no major dependencies for the package so the vnc-ltsp-config*.rpm could easily be downloaded and installed without the need for enabling the EPEL repository.

Install, as root via:

# yum install xinetd vnc-ltsp-config
# /sbin/chkconfig xinetd on
# /sbin/chkconfig vncts on
# /sbin/service xinetd restart

Next, as root edit the file "/etc/gdm/custom.conf".

• To the next blank line below the "[security]" section add "DisallowTCP=false"
• To the next blank line below the "[xdmcp]" section add "Enable=true"
• Make sure you are in a position to either run "gdm-restart" for default Gnome installs or just reboot the CentOS box.

This will add the ability to get the following default vnc-client based session connections:

resolution	color-depth	port
1024x768	16	5900/tcp
800x600	16	5901/tcp
640x480	16	5902/tcp
1024x768	8	5903/tcp
800x600	8	5904/tcp
640x480	8	5905/tcp

DNS Server

Install the required packages:

[root@nan ~]# yum install -y bind bind-utils bind-libs


Ensure that the service is set to start on system boot:

[root@nan ~]# chkconfig named on


Otherwise start the service

[root@nan ~]# service named start

Use the iptables command to create your firewall rules:

[root@nan ~]# iptables -I INPUT  -p udp -m udp --dport 53 -j ACCEPT
[root@nan ~]# iptables -I INPUT  -p tcp -m tcp --dport 53 -j ACCEPT


Save the rules you just created:

[root@nan ~]# service iptables save


SELinux Boolean provides protection to the DNS service.
You need to adjust it for the DNS service to work properly.

Query for the Boolean value you need to change:

[root@nan ~]# getsebool -a | grep named_dis
named_disable_trans --> off

Disable the SELinux protection:

[root@nan ~]# setsebool -P named_disable_trans=1

Verify that the Boolean has changed:

[root@nan ~]# getsebool -a | grep named_dis
named_disable_trans --> on

Check the context type

[root@nan ~]# chcon -t named_conf_t /etc/named.conf

Verify with this command:

[root@nan ~]# ls -Z /etc | grep named.conf

Configuring a DNS Server

To begin configuring the DNS server, check out these key config files for a
BIND server:

/etc/named.conf                            Main config file
/etc/rndc.key                                 Key file
/etc/rndc.conf                               Key config file
/usr/share/doc/bind-9*/sample     Directory that holds sample files


Verify that the localhost is used for DNS queries on

[root@nan ~]# cat /etc/resolv.conf

# Generated by NetworkManager

domain localdomain

search localdomain server.com

nameserver 192.168.16.2

nameserver 192.168.25.111   // Add the name server IP address

Configure BIND  IP address [192.168.25.111/24], Domain name [nan.server.com]. However, Please use your own IPs and domain name when you set config on your server.

[root@nan ~]# cat /etc/named.conf

// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
    # Add the ip address in listen-on port
    # If You want all port means make # line
    listen-on port 53 { 127.0.0.1; 192.168.25.111;};

    # listen-on-v6 port 53 { ::1; };

    directory     "/var/named";

    dump-file     "/var/named/data/cache_dump.db";

        statistics-file "/var/named/data/named_stats.txt";

        memstatistics-file "/var/named/data/named_mem_stats.txt";

   # set any in allow-query 
    allow-query     { any; };

    #allow-query-cache    { any; };

    recursion yes;

 

    dnssec-enable yes;

    dnssec-validation yes;

    dnssec-lookaside auto;

    /* Path to ISC DLV key */

    bindkeys-file "/etc/named.iscdlv.key";

};

logging {

        channel default_debug {

                file "data/named.run";

                severity dynamic;

        };

};

zone "." IN {

    type hint;

    file "named.ca";

};

#Our sample domain is server.com defined here

zone    "server.com" IN {
    type master;
    file "server.zone";
    allow-update{none;};
};
zone "example.com" IN {
    type master;
    file "example.zone";
    allow-update{none;};
};
zone "111.25.168.192.in-addr.arpa" IN {
    type master;
    file    "111.25.168.192.db";
    allow-update{none;};
};
include "/etc/named.rfc1912.zones";

Now that you have
an /etc/named.conf file, you need to create the zone  files.

Before going any further, you should also understand the different
types of resource records used with DNS and why each one is important.

A            Maps the hostname to an IP address
NS         Contains the IP address or CNAME of the nameserver
MX         Defines where mail for a particular domain goes
PTR       Maps the IP address to a hostname
SOA       Contains general administrative control for the domain
CNAME Used as an alias

In the /var/named directory, you can set up the following example.com.zone file:

[root@nan ~]# cat /var/named/server.zone
$TTL 3D
@    IN    SOA    nan.server.com.    root.nan.server.com. (
                    20111004123    ; serial
                    1D    ; refresh
                    1H    ; retry
                    1W    ; expire
                    3H )    ; minimum
@    IN    NS    nan.server.com.
nan    IN    A    192.168.25.111

Everything is now in place for you to begin using your DNS server. Before starting the service, however, make sure that the config files don’t have any syntax errors.

You can use the configtest option of the named command to accom-
plish this:

# service named configtest


Because no errors are displayed, you can start the service:


# service named start


For verification

[root@nan ~]# dig nan.server.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6_0.1 <<>> nan.server.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35679
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;nan.server.com.            IN    A

;; Query time: 1 msec
;; SERVER: 192.168.25.111#53(192.168.25.111)
;; WHEN: Wed Oct 12 14:00:51 2011
;; MSG SIZE  rcvd: 32

DHCP Configuration

ddns-update-style interim;
ignore client-updates;
allow booting;
allow bootp;
ignore client-updates;
set vendorclass = option vendor-class-identifier;
subnet 192.168.20.0 netmask 255.255.255.0 {

# --- default gateway
    option routers            192.168.20.1;
    option subnet-mask        255.255.255.0;

    option domain-name-servers    192.168.20.1;
    option subnet-mask        255.255.255.0;
    range  192.168.20.128 192.168.20.254;
        filename     "/pxelinux.0";
    default-lease-time 21600;
    max-lease-time 43200;
    next-server    192.168.20.1;
}

How to setup Boot Password (Grub)

Even before the operating system is booted, GRUB enables access to file systems. Users without root permissions can access files in your Linux system to which they have no access once the system is booted. To block this kind of access or prevent users from booting certain operating systems, set a boot password.
As the user root, proceed as follows to set a boot password:

At the root prompt, encrypt the password using grub-md5-crypt:

# grub-md5-crypt
Password: ****
Retype password: ****
Encrypted: $1$lS2dv/$JOcHkLosIn7CJk9xShzzJVw/

Paste the encrypted string into the global section of the file menu.lst:

gfxmenu (hd0,4)/message
color white/blue black/light-gray
default 0
timeout 8
password --md5 $1$lS2dv/$JOcHkLosIn7CJk9xShzzJVw/

Now GRUB commands can only be executed at the boot prompt after pressing P and entering the password. However, users can still boot all operating systems from the boot menu.

Convert RHEL to CentOS

Hi

        Recently i was installed in my desktop RHEL 5 and I was tried to upgrade. On the time it asked Searial Key.  I was tried what the key mentiond in the DVD, but it has not taken. So i decided to convert RHEL to Centos. I Done Using following Steps.

Remove the redhat-release and yum-rhn-plugin repo

rpm -e --nodeps redhat-release
rpm -e --nodeps yum-rhn-plugin

Download the key from

http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

Install the RPM-GPG-KEY-CentOS-5

rpm --import RPM-GPG-KEY-CentOS-5

Download and Install the following rpms in this site  

http://mirror.centos.org/centos/5.6/os/i386/CentOS/

centos-release-5-6.el5.centos.1.i386.rpm 
centos-release-notes-5.6-0.i386.rpm   
yum-3.2.22-20.el5.centos.noarch.rpm
yum-updatesd-0.9-2.el5.noarch.rpm  

Then

Yum clean all

Yum upgrade

Your Centos will upgrade

Have the Centos update with help of Redhat Package