Bewley.net /

Authenticated SMTP

This isn't really related to migration to Maildir, but I'm adding it at the same time.

################################################################################
# this is still under testing
# still to do http://www.securitysage.com/antispam/sasltls.html
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
#smtpd_sasl_local_domain = $myhostname
smtpd_sasl_local_domain = smtp.bewley.net
# You only need the following line if supporting old mail clients
#broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
         permit_sasl_authenticated,
         permit_mynetworks,
         reject_unauth_destination
# This will only allow authentication of users once TLS has been
# started and information being transferred is encrypted.
smtpd_tls_auth_only = yes
#In order to use your certificate, you will need to make the following additions to main.cf:
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = $config_directory/ssl/smtp.bewley.net.pem
smtpd_tls_cert_file = $config_directory/ssl/smtp.bewley.net.pem
smtpd_tls_CAfile = $config_directory/ssl/smtp.bewley.net.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
# this is still under testing
################################################################################

Also in master.cf you need to enable the submission port (587) if you want Outlook to work apparently. I guess it can't just do TLS on port 25.

submission   inet    n       -       n       -       -       smtpd
  -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_etrn_restrictions=reject
  -o local_header_rewrite_clients=permit_sasl_authenticated

Pine

I have users who have been on pine for eons and don't want to change. I'm kinda one of them. Unfortunately, pine can't read Maildir. To work around that, just tell pine to use IMAP rather than the local filesystem. Dovecot will act as the go between. It works quite well actually. Here's a little hack to fix up all your users' ~/.pinerc files. Here is a sample .pinerc you can use.

Notice you won't find pine in the Fedora distribution though. You'll have to get a copy from somewhere like Dag's repository.

#!/bin/bash
################################################################################
# pinemaildir - Dale Bewley  Fri Apr 22 09:34:47 PDT 2005
#-------------------------------------------------------------------------------
# Configure pine to use IMAP to localhost for the purposes of supporting
# Maildir folders. The IMAPd (courier, dovecot, etc) will retrieve and
# store messages in maildir format since pine only understands mbox.
#
# Thanks to http://www.neverending.org/~ftobin/resources/pine-maildir/
################################################################################

################################################################################
# Settings we need to effect
# if you cahnge the default-fcc then the monthly folder prune will fail
SETTINGS="inbox-path
	folder-collections
	feature-list"
# where are the users' .pinerc's?
PINERCS=/home/*/.pinerc
################################################################################

# look through ~/.pinerc's and find users who have 
# changed these settings rather than the empty defaults
for pinerc in $PINERCS; do
	echo -n "Checking $pinerc..."
	if [ ! -f $pinerc ]; then
		echo " not a file. skipping"
		next;
	fi

	default=1
	for setting in $SETTINGS; do
		current=`grep "^$setting=" $pinerc | cut -d= -f2`
		if [ -n "$current" ]; then
			echo "	$setting is customized to: $current"
			default=0
		fi
		current=''
	done

	if [ "$default" -lt 1 ]; then
		echo "	settings customized"
		skip="$skip $pinerc"
	else
		TMPFILE=`mktemp` || exit 1
		sed     -e 's!^inbox-path=$!inbox-path={localhost/ssl/novalidate-cert}inbox!' \
			-e 's!^folder-collections=$!folder-collections="Local IMAP" {localhost/ssl/novalidate-cert}[]!' \
			-e 's!^feature-list=$!feature-list=enable-lame-list-mode,\n\tcombined-subdirectory-display,\n\tcombined-folder-display,\n\tquell-empty-directories!' \
		< $pinerc > $TMPFILE
		echo mv $TMPFILE $pinerc
	fi

	echo
done

echo "You should check these users by hand:"
for u in $skip; do echo $u; done

Account Creation

You want your new users to hit the ground running, so create Maildir in /etc/skell. You might also put a fixed up .pinerc in there.

mkdir -p /etc/skel/Maildir/new
mkdir -p /etc/skel/Maildir/cur
mkdir -p /etc/skel/Maildir/tmp