Slashdot Mirror

The solution I'm currently experimenting with is to use simscan with qmail to pipe the mail through spamassassin before indicating final acceptance to the remote MTA. Even if it's sent by <> or sent to postmaster, SA3's scoring rules identify it remarkably well and the sending MTA gets a 5xx and it's game over. As another poster mentioned, 5xx errors are a great way to reduce bounce spam. Plus, legitimate senders who get false positives will know something went wrong, instead of their email going into the black hole of a spam folder.

$0.02,
ptd

I know this is a bit late but hopefully the poster will read this.

Disclaimer: I do not do webhosting. I am merely a client talking favorably about my host.

I do my mail administration using stuff from Inter7, specifically qmailadmin and vpopmail. It is terribly easy to use. My only complaints are that it does not let you forward outside of your own domain (I think), but that's not really needed so it doesn't really matter.

Both programs are Free As In Beer. They make some allusions to open-source on their webpage, so they might be Free As In Speech, I don't know.

I know this is a bit late but hopefully the poster will read this.

Disclaimer: I do not do webhosting. I am merely a client talking favorably about my host.

I do my mail administration using stuff from Inter7, specifically qmailadmin and vpopmail. It is terribly easy to use. My only complaints are that it does not let you forward outside of your own domain (I think), but that's not really needed so it doesn't really matter.

Both programs are Free As In Beer. They make some allusions to open-source on their webpage, so they might be Free As In Speech, I don't know.

And there still is no SSL support on IMAP server(s). To protect my account, I have to ssh in and create a tunnel -- this way I am only exposed to a hacker already on the department net...

Wow dont tell the people who wrote courier that their Courier-IMAP-SSL doesn't exist.

• use the company as contact info
• set email address as that-domain-name@domains.webhost.com
• have incoming email to that email address sit on protected servers forever, but give the client webmail access to it in their members login area
• that way incoming spam will never bother them, but be there if they need it (like if changing registrars)

I'll bet something like vpopmail could do easy unlimited accounts on the fly like that, so that a webhost company wouldn't even need to charge extra for this service.

Postfix + Amavis is a wicked combo for content filtering. For virtual domain admin, check out Jamm. If you want great POP/IMAP mailbox support for your virtual domains, add Courier IMAP to your setup.

Some of the features you might like in Postfix over Qmail include SMTP AUTH, TLS/SSL support, nice content-filtering support, great spam blocking features (HELO checking, RHSbl support, DNSbl support, sender address checking, many others), and extensive database and LDAP support. The virtual domain support is full-featured, although very different to Qmail's in terms of implementation, and with something like Jamm your users can have full control of their domains and/or mailboxes via a web interface.

And yes, I know there are patches for Qmail to do most or all of the above. It's just easier to do with Postfix IMO.

I like this combo
Qmail (pick a mirror)
And
Horde/IMP
The Horde site also has calendar modules and other cool stuff as well. (You can use it with Courier IMAP too)

I like this combo
Qmail (pick a mirror)
And
Horde/IMP
The Horde site also has calendar modules and other cool stuff as well. (You can use it with Courier IMAP too)

Oops, the last link is outdated. Try this one: http://www.inter7.com/qwho.html

How many users do you serve with qmail?

qmail can handle millions of users. Many large sites run qmail. Hotmail used to run on qmail. Yahoo! uses it for their outgoing mail.

• Rock-solid FreeBSD base
• qmail + CourierIMAP + qmailadmin (for easy web-based admin of e-mail accounts) + tie-ins to tarpitting, SpamAssassin or other anti-UCE measures
• Very secure -- Matt has set the whole thing up to be more secure than what most users would configure on their own. E-mail accounts don't have corresponding system accounts, POP-before-SMTP is enabled and a host of other lock-down measures are in place.
• Works with both IMAP and traditional POP services
• Comes with either SquirrelMail or SqWebMail as a default webmail client, although I've gotten it to work with Horde's Imp project as well.

I know you spec'd Gentoo, but this is a great solution backed by an active user community/e-mail list. It's worth a look.

most daemons/services are capable of authenticating users via PAM or from an SQL database.

for apache, PAM auth, mysql auth and postgresql auth.

for ftp you could use proftpd and ignore system accounts completely, it supports quite a few alternative methods.

for the email solution use something like vpopmail with no system users and supported by quite a few MTA/POP3 agents.

If you don't want the OS to handle the passwords, then you can set it up so it doesn't. By default system accounts are normally used which I assume is from the era of people having shells and doing * from it, ftp/read mails/etc in which case things would use the standard system accounts..

As a fall through address is something that is basically a method to deliver mail, how can a popper do this at all?

Mail comes into your MTA, not your popper :}
(I think im just misunderstanding)

You are misunderstanding. vpopmail is a virtual domain manager for qmail.

Also, I dont use pop or imap myself at all. I still use pine (and no i will not change heh)

Switch to using maildir anyway. Seriously. Pine will work with maildir format, but now you can also hook other stuff on top : courier to provide imap service (I always do it over ssl myself), and web access (again over ssl) with either sqwebmail or squirrelmail. Best of all worlds!

Also, I dont use pop or imap myself at all. I still use pine (and no i will not change heh)

Switch to using maildir anyway. Seriously. Pine will work with maildir format, but now you can also hook other stuff on top : courier to provide imap service (I always do it over ssl myself), and web access (again over ssl) with either sqwebmail or squirrelmail. Best of all worlds!

Postfix is only slightly more flexible in some ways (for example, the MySQL backend) but those ways aren't difficult to integrate into qmail; it's just that nobody's bothered to do it yet.

vpopmail is a virtual domain manager for qmail. It supports MySQL and a number of other backends. You don't even need to recompile qmail to use it, thanks to qmail's very modular design.

I have used qmail for quite a few years now and it is great! Installing it and configuring it was 1000% easier then sendmail. Virtual domains are so simple in qmail. I don't even want to think about doing this with sendmail, gives me a headache just thinking about it. If you install vpopmail available from
Inter7. makes the domain management even easier plus it works mysql.
I know I will never switch.

I guess that would be the same argument of Linux version Microsoft. Linux may have commercial support but it is still 'free'. Inter7. (among others) provide commercial support for qmail and their products like Vpopmail (virtual mail add-on for Qmail). Vpopmail is free also.
Many companies use Qmail like Netzero ...if I remember correctly they use qmail for all their smtp and possibly their pop3.

As far as I'm concerned, there is no point in even using a mail client anymore. With SquirrelMail connected to an IMAP Server and displayed over an SSL connection, I can see no reason to use anything other than webmail. And it has the added advantage of being accessible from anywhere with internet access (and a browser).

Well, I submitted the following to Ask Slashdot and it was rejected, so I guess I will ask here. With all the stupid-assed, inane questions that frequently get asked of Slashdot I thought mine would be a shoe-in, as it's an actual real-world issue whose answer is not available in the first ten lines of a Google search, but I guess the retardedness factor was too low in my post. Can anyone either a) help with the questions below, or b) help me make the question stupid enough that Slashdot will approve it?

Ask Slashdot: Using Webmail for a Company's Main Email Client?
Posted by SmartSlashdotEditor on 9:01 Saturday 21 September 2002
from the slashdot-too-stupid-to-really-post-this dept.
Evro writes: "I work for a small company and this week I finished setting up the IMAP server that is expected to replace our Exchange 5.5 system. I had really high hopes for the new system, but it seems to be acting very quirky. Everyone wants to continue using Outlook 2000 as the mail client, and it gives us nothing but problems when trying to use imap-ssl - users can check their mail, then 5 minutes later it says they can't open messages that are already in their inbox; even regular IMAP gives problems from time to time. Plus there's the annoyance of Outlook not saving sent mail to the server's Sent folder. I personally use Mozilla mail and it works pretty well, but I don't think these people are quite ready for Mozilla's quirks yet, though the fact that Mozilla works as well as it does is what leads me to believe the problem is with the clients rather than the server. I've set up Squirrel Mail as a webmail interface, and that's been received much better than Outlook, Outlook Express, or Eudora (which worked well technically, but nobody liked the interface) as mail clients. Squirrel Mail (over https) seems to do everything I would expect a mail client to do, does it pretty well, and is extremely easy to use and set up. My question is, has anyone setup a mail system for their (or any) company in which the main interface is a webmail client such as Squirrel Mail? If so, what problems have you encountered, and/or what pitfalls can you foresee?"

I stand corrected. :^)

But here's the cool part. Spamassassin doesn't do anything with it. It simply marks it as a spam. Then you can use something like procmail to decide what to do with it. Me, personally, I store it into a folder called SPAM. I then configure my imap server (courier imapd) to treat that mailbox as a trashcan, and automatically delete anything in it older than 14 days.

This allows me to check if there are any stragglers that get through, but also allows me to forget about it for a couple of weeks at a time. Spamassassin has been tuned to avoid false positives. I've been using spamassassin for months. During that time, I've not had a single email that was not a spam get marked as a spam. I've had emails that were spams get marked as non-spam (false negative). Which, if there's going to be an error, that's the kind I want. I'd hate to call a real email spam, have it sent to my SPAM mailbox and automatically deleted before I read it. The good news is that not a single false positive has occurred, although a few false negatives have occurred.

So I've started using another tool to help deal with spam. It's called TMDA. It's somewhat more complex to setup and use than spamassissin. But a brief description is that it acts like an email firewall. Outgoing messages can be replied to, but incoming messages require that a person prove that they are a person. After which they'll be allowed unrestricted access to send me email.

TMDA is much more exact than spamassassin, which is mostly complicated guessing. It successfully blocks every spam that spamassassin lets through. However, TMDA is also much more complex from an end user perspective. So it might not be for everyone. For example, I only use spamassassin on my wife's account - not TMDA because she's made it clear to me that she doesn't want to learn how to use it. I personally use both of them at the same time, and I've been 100% spam free for months. I used to get 20-30/day.

$.02

1. Always accept mail to a certain domain (i.e. the local domain for staff/students)
2. Allow machines within our local network to relay mail to the outside world
3. Not allow external sites to relay mail to other outside sites

I don't understand what's difficult about that. I use tcpserver with qmail-smtpd -- I achieve exactly what you want, plus the ability to allow our people to use whatever ISP they want and to relay mail from their IP for 20 minutes after they've successfully checked for mail. I don't recall using a relayclients patch at all, but I do have several other patches applied to my qmail:

• a tarpitting patch, which adds an exponential delay for each extra RECIP after the 5th;
• DNS fixes for super-long domain names, and
• A fix for broken Netscape clients which don't update their progress bar

I also use vpopmail which makes it trivial to run a zillion vhosted mail servers with separate mail policies, mailing lists and quotas and finally qmailadmin which takes care of 99% of the admin needs. What's left is just hand-editing the .qmail-xxx files to do silly things like have one email address go to two mailboxes and so on.

1. Always accept mail to a certain domain (i.e. the local domain for staff/students)
2. Allow machines within our local network to relay mail to the outside world
3. Not allow external sites to relay mail to other outside sites

I don't understand what's difficult about that. I use tcpserver with qmail-smtpd -- I achieve exactly what you want, plus the ability to allow our people to use whatever ISP they want and to relay mail from their IP for 20 minutes after they've successfully checked for mail. I don't recall using a relayclients patch at all, but I do have several other patches applied to my qmail:

• a tarpitting patch, which adds an exponential delay for each extra RECIP after the 5th;
• DNS fixes for super-long domain names, and
• A fix for broken Netscape clients which don't update their progress bar

I also use vpopmail which makes it trivial to run a zillion vhosted mail servers with separate mail policies, mailing lists and quotas and finally qmailadmin which takes care of 99% of the admin needs. What's left is just hand-editing the .qmail-xxx files to do silly things like have one email address go to two mailboxes and so on.

Some smartass somewhere has to mention that qmail and it's impossible-to-manage ezmlm program is a superior solution.

I don't seem to be having any trouble at all adminning small (150 user, 3GB/mo) and mid-size (800-user, ~25GB/mo) qmail installations. This is with Vpopmail too; the mid-size email system is for one domain; there are 36 others on that system too but they're all fairly small. Ezmlm isn't simple, no, but it's no pain in the ass to manage, either. I use QmailAdmin to do most of the dirty work. I set up the new domain, give the owner the postmaster password and point them to the qmailadmin setup. Piece of cake.

And while we're at it, djbdns rocks the house!

qmail is a very good MTA; I wouldn't trade it for anything else. That doesn't mean I think that djb is a god; I can't stand his daemontools, nor do I like djbdns. Go figure.

My ISP (012.net) does that for a while now.. It's really annoying, but we solved after enabling pop on smtp on the remote mail server.

We're using QMail+VPOPMail for that, and it works very nice.

I've set up at least a dozen qmail servers: small ones, big ones, red ones, blue ones...

Sendmail's a whore, and that's really the only other Linux MTA I've used. I've heard good things about Postfix but seriously I haven't found a single thing wrong with qmail:

• It's small and fast
• infinitely configurable
• handles aliases and virtual domains easily
• antispam features
  • RBL and ORBS patches
  • tarpitting patches
• Works with AOL DNS hacks
• bigserver patches
• simple to add "defang" and virus scans
• POP3 and IMAP capable
  • With optional APOP and selective relaying
• Maildir mailbox format better than anything else
• web-adminnable
• Plugin for mailing lists
  • automatic archiving and web indexing
• Third party support available

Jesus I have a lot more respect to the link crazy posts out there. :-)

At any rate -- I've run it for years now and never had a problem. The servers just work. We've used an alias system and serialmail to allow branch offices to pick up mail for their local users without requiring a permanent net connection. The ability to run any program on receipt of a message or delivery to a specific address is very handy, as is the ability for individual users to tailor their own mail deliveries and create their own mailing lists and aliases. Very powerful and very cool.

And, despite what some others have said about the brain damage involved in adding features to the source code: it's not that bad. I do wish, however, that there were at least some comments... The total lack of comments and useful variable names are a hindrance.

Go get it. Install it. Love it.

I've set up at least a dozen qmail servers: small ones, big ones, red ones, blue ones...

Sendmail's a whore, and that's really the only other Linux MTA I've used. I've heard good things about Postfix but seriously I haven't found a single thing wrong with qmail:

• It's small and fast
• infinitely configurable
• handles aliases and virtual domains easily
• antispam features
  • RBL and ORBS patches
  • tarpitting patches
• Works with AOL DNS hacks
• bigserver patches
• simple to add "defang" and virus scans
• POP3 and IMAP capable
  • With optional APOP and selective relaying
• Maildir mailbox format better than anything else
• web-adminnable
• Plugin for mailing lists
  • automatic archiving and web indexing
• Third party support available

Jesus I have a lot more respect to the link crazy posts out there. :-)

At any rate -- I've run it for years now and never had a problem. The servers just work. We've used an alias system and serialmail to allow branch offices to pick up mail for their local users without requiring a permanent net connection. The ability to run any program on receipt of a message or delivery to a specific address is very handy, as is the ability for individual users to tailor their own mail deliveries and create their own mailing lists and aliases. Very powerful and very cool.

And, despite what some others have said about the brain damage involved in adding features to the source code: it's not that bad. I do wish, however, that there were at least some comments... The total lack of comments and useful variable names are a hindrance.

Go get it. Install it. Love it.

I've set up at least a dozen qmail servers: small ones, big ones, red ones, blue ones...

Sendmail's a whore, and that's really the only other Linux MTA I've used. I've heard good things about Postfix but seriously I haven't found a single thing wrong with qmail:

• It's small and fast
• infinitely configurable
• handles aliases and virtual domains easily
• antispam features
  • RBL and ORBS patches
  • tarpitting patches
• Works with AOL DNS hacks
• bigserver patches
• simple to add "defang" and virus scans
• POP3 and IMAP capable
  • With optional APOP and selective relaying
• Maildir mailbox format better than anything else
• web-adminnable
• Plugin for mailing lists
  • automatic archiving and web indexing
• Third party support available

Jesus I have a lot more respect to the link crazy posts out there. :-)

At any rate -- I've run it for years now and never had a problem. The servers just work. We've used an alias system and serialmail to allow branch offices to pick up mail for their local users without requiring a permanent net connection. The ability to run any program on receipt of a message or delivery to a specific address is very handy, as is the ability for individual users to tailor their own mail deliveries and create their own mailing lists and aliases. Very powerful and very cool.

And, despite what some others have said about the brain damage involved in adding features to the source code: it's not that bad. I do wish, however, that there were at least some comments... The total lack of comments and useful variable names are a hindrance.

Go get it. Install it. Love it.

My set up: postfix as the MTA. Courier IMAP to provide IMAP. I actually tunnel my IMAP connection over an href="http://www.openssh.com">OpenSSH connection, but courier IMAP supports SSL as well. The guy that writes Courier, also writes SqWebMail,(webmail) and maildrop(pleasent alternative to procmail) which I have found to be useful. FWIW I use mutt as my mail client.

My set up: postfix as the MTA. Courier IMAP to provide IMAP. I actually tunnel my IMAP connection over an href="http://www.openssh.com">OpenSSH connection, but courier IMAP supports SSL as well. The guy that writes Courier, also writes SqWebMail,(webmail) and maildrop(pleasent alternative to procmail) which I have found to be useful. FWIW I use mutt as my mail client.

I meant to include they will assign for IP-based on exceptions (which I would assume would include SSL). You can do FTP, POP, IMAP, etc... on a virtual host bases (even telnet) but it starts getting tricker (and more limiting).

We run a single IP / multiple host type scenario here... about a dozen and a half websites with individual FTP and email.

• qmail and vpopmail work wonderfully supporting tons of domains under one IP
• Naturally, Apache is what the web server is
• (check freshmeat) ProFTPd seems to use the same interface that Apache uses to give you multiple domains under one IP which remain seperate from each other

I'm not saying all problems can be solved, but the biggest ones (aside from SSL) are gone with some software.

vpopmail in particular is nice... combined with qmailadmin (also on inter7's site) you can give each domain owner the ability to control their email system from a web interface without any hassle on your end. Courier IMAP knows how to handle vpopmail authentication so POP3 and IMAP are done. The only change on the client end is that they must authenticate as "user@domain" instead of just "user". I usually inform people to use user%domain since Netscape tries to be smart and strip off everything after the @.

Investigate the latest version of Courier-IMAP which has built in support for IMAP-SSL/TLS, as opposed to using stunnel.

stunnel is great for a small number of connections, but the overhead of launching a new process every time is fairly significant as you scale up, so Courier does a great job of a lightweight, secure IMAP server.

You have to use maildir - but both Exim and qmail support it natively now, and it's far superior to the traditional mbox format anyway.

For and IMAP server I use the Courier IMAP package. It is a small, featurefull server which support Maildir. It would probably be fine for your needs as it has a very well designed authentication model which supports LDAP (among other things). Courier is faster and smaller than UW-IMAP and Cyrus.

Finally I use TWIG for Webmail. It supports IMAP mail, calendars, contact lists, newsgroups, etc. It is also based on PHP (yay!).

It is a very nice setup, and wasen't too hard to setup. Oh, I forgot to mention that the server is FreeBSD 3.4.

Some of your points above saying that 'qmail assumes' are simply what you assume that qmail assumes.

qmail does not assume that all users have entries in the passwd file, nor does it assumes all users have different UIDs, not in fact does it assume that each user has a home directory.

Just take a look at what vpopmail does to simply provide hints to qmail as to how to handle mail. All the stuff vpopmail does is easy to do manually, and all is easily understood from the available documentation. In fact, before I knew about vpopmail, I created a utility that did basically the exact same function in an hour or two.

Your other two points are true, although maybe not valid, and they're specific assumptions made by the code. You personally may think that a shared queue with multiple queue runners is the only way to work, but I would like to know whether you tried it qmail's way before deciding that was the way to do it. Admittedly, perhaps qmail isn't flexible in that area, but then again, perhaps qmail does it for a reason. djb is well-known for restricting people from shooting themselves in the foot, even if they might want to aim in the general direction of their foot, and are sure they won't hit it.

That said, I currently have no preference in MTAs between exim, postfix, and qmail, since they all seem to be very good products. I haven't had the time and inclination both at the same time to learn sendmail yet, but I'm sure I'll give it appropriate time before making any judgement.

Yes. Easily. qmail with the vpopmail addon from Inter7 will make you wonder why you ever bothered to try and configure Sendmail.

You might also be interested in their qmailadmin addon which allows web-based management of domains, and sqwebmail which adds a hotmail-esque web interface for checking & sending email.

qmail is different than Sendmail, considerably so. But once you understand how it works, I think it's design is far superior to that of Sendmail. It's much more unixy, IMNSHO. There is ample evidence that qmail is considerably faster and less resource intensive than Sendmail, but what really made the difference for me was the security focus of qmail.

As I said, qmail is different from Sendmail, but there is a lot of contributed documentation available as well as commercial support. The qmail community is large, capable and very motivated. They do have one problem though, they don't have a 4-inch-thick O'Reilly book dedicated to their MTA...
...hmmm, maybe there's a reason for that!

Yes. Easily. qmail with the vpopmail addon from Inter7 will make you wonder why you ever bothered to try and configure Sendmail.

You might also be interested in their qmailadmin addon which allows web-based management of domains, and sqwebmail which adds a hotmail-esque web interface for checking & sending email.

qmail is different than Sendmail, considerably so. But once you understand how it works, I think it's design is far superior to that of Sendmail. It's much more unixy, IMNSHO. There is ample evidence that qmail is considerably faster and less resource intensive than Sendmail, but what really made the difference for me was the security focus of qmail.

As I said, qmail is different from Sendmail, but there is a lot of contributed documentation available as well as commercial support. The qmail community is large, capable and very motivated. They do have one problem though, they don't have a 4-inch-thick O'Reilly book dedicated to their MTA...
...hmmm, maybe there's a reason for that!

Yes. Easily. qmail with the vpopmail addon from Inter7 will make you wonder why you ever bothered to try and configure Sendmail.

You might also be interested in their qmailadmin addon which allows web-based management of domains, and sqwebmail which adds a hotmail-esque web interface for checking & sending email.

qmail is different than Sendmail, considerably so. But once you understand how it works, I think it's design is far superior to that of Sendmail. It's much more unixy, IMNSHO. There is ample evidence that qmail is considerably faster and less resource intensive than Sendmail, but what really made the difference for me was the security focus of qmail.

As I said, qmail is different from Sendmail, but there is a lot of contributed documentation available as well as commercial support. The qmail community is large, capable and very motivated. They do have one problem though, they don't have a 4-inch-thick O'Reilly book dedicated to their MTA...
...hmmm, maybe there's a reason for that!

Yes. Easily. qmail with the vpopmail addon from Inter7 will make you wonder why you ever bothered to try and configure Sendmail.

You might also be interested in their qmailadmin addon which allows web-based management of domains, and sqwebmail which adds a hotmail-esque web interface for checking & sending email.

qmail is different than Sendmail, considerably so. But once you understand how it works, I think it's design is far superior to that of Sendmail. It's much more unixy, IMNSHO. There is ample evidence that qmail is considerably faster and less resource intensive than Sendmail, but what really made the difference for me was the security focus of qmail.

As I said, qmail is different from Sendmail, but there is a lot of contributed documentation available as well as commercial support. The qmail community is large, capable and very motivated. They do have one problem though, they don't have a 4-inch-thick O'Reilly book dedicated to their MTA...
...hmmm, maybe there's a reason for that!