Configuring Postfix to act as a backup MX server

If you’re running your own mailserver for receiving e-mail, you probably want some kind of redundancy when it goes down so you don’t lose any mail. The solution to this is to configure several backup mail exchanger (or MX) servers. it is a popular replacement for the classic *NIX sendmail program that, along with being a primary mail exchanger, can be configured to act as a secondary, backup MX.

Changes to Postfix’s main.cf

Postfix first needs to be allowed to work as a MX backup server, which can be done in addition to being a primary mail server for some other domain. This is done through configuring smtpdrecipientrestrictions in Postfix’s main.cf configuration file (usually located in /etc/postfix/). Add permitmxbackup to the list of restrictions. For example:

Next, the domains to act as a backup. These are added to the relay_domains option. For example:

Now that postfix knows to accept mail destined for these domains, it needs to know what to do with it. Postfix’s transport maps feature can be used to specify to send mail back to the main mailserver. In main.cf, add a transport_maps configuration option, pointing to a database supported by Postfix (such as hashes), like so:

Postfix will then look to this file for any information on delivering the e-mail from domains specified in this file.

Setting up Postfix transports file

Assuming you are using Postfix’s hash database format, create a new file transport (in /etc/postfix/ if following the example above). This file is a space-separated list of domains and how to deliver mail for them. For example:

This tells Postfix to send mail destined for domain1.com, domain2.net, and domain3.org via SMTP to mail.domain1.com, mail.domain2.net, and mail.domain3.org respectively.

After adding the above, a binary database that Postfix will actually use needs to be created. This can be made by running;

in the directory the file transport resides.

After doing all this, you’ll now have a backup MX server for your main mail server. If your main mail server goes down, mail will then get sent to this backup MX server and queued up for eventually delivery back to your main mail server when it comes back online.

Dealing with ISP Port 25 Blocking

Many ISPs these days have resorted to port blocking to curb “undesirable usage” (like running web servers, or spamming). A variant of this to prevent the sending of spam involves blocking connections on port 25 (the port for SMTP) to any server that isn’t the ISP’s SMTP server.

If you’re running a mail server behind and ISP that does this, you probably already know about relayhost which will relay all your e-mail through your ISP’s mail server rather than trying to connect to other mail servers directly.

However, for a server wanting to act as a backup MX, this will not work. Mail will be recieved, but since the backup MX cannot connect to the main MX servers specified in the transports file, mail will get stuck in the backup MXs queue indefinitely.

The easy solution to this is to open up another port on the main mail server, such as 2525. The backup MXs transport file could be changed to deliver mail on this port:

On the main mailserver, the smtp component of Postfix is going to have to be run on both port 25 and 2525 (complicated), or, if using Linux or some other OS with fairly lets… INCOMPLETE

Other considerations

Queue Lifetime

If your primary mail server ever is down for a long time (longer than 5 days), you may need some additional tweaking on your backup mail exchangers. By default, Postfix will expire anything sitting in it’s queue for longer than 5 days. These messages will get bounced back. So much for being a “backup.” You can avert this behavior by adding to main.cf:

Messages will now stay in the queue for 60 days. If your primary mail server is down for longer than this, you probably have other problems. Notice that affects ALL messages in the queue, not just ones stored for being a backup mail exchanger, so it may have other consequences.

==============================================

Please note: This is a work in progress. I do hope that this will eventually expand into a full-blown how-to, but I will probably need some assistance with it. I will also putting notes down here as I work on a complete backup-mail server solution using ISPConfig. Feel free to make comments and questions as I work on it. Thanks.

The situation
I’ve been working on setting up a backup main server for my domains for some amount of time. There are several guides out there that show you how to set one up with postfix, but they have one problem: All of the ones I’ve read will setup a relay server that will simply attempt to forward any mail to the entire domain to the primary server. What then happens in this case is the primary server will reject any email addresses not in its local users table, and the backup mail server will be forced to bounce the message back to the from email address. This can cause a potential problem, though; some unscrupulous person can use the backup server in a “backscatter” attack, where he will send many emails to the backup server to non-existent users that are in its domain and cause the backup email server to bounce messages back tto the forged “from:” addresses, annoying end victims and painting your backup server as a culprit in this “spam” and possibly blacklisted for being in accordance with the RFCs!

The Solution
One possibly solution is to simply go sod with the RFCs and prevent the backup mail server from bouncing emails, but this is a bit of a hack, does not comply with the RFC standard, and is inconsiderate to legitamite users that may have mistyped an email and should know that the message was not successfully delivered.

The better way is to maintain a list of relayable recipent addresses on the backup mail server that will be syncronized with the primary mail backup server’s, virtual users list.

The How-To This applies to the current version of ISPConfig (version 2.2.6). This section is incomplete, but I will include an example to help with fleshing out this idea
An example setup
Let’s say we have two servers with ISPConfig setup on both running with postfix as the MTA. Let’s call them server1.maindomain.tld and server2.maindomain.tld. Let’s say we have a domain hosted on server1,:called www.hosteddomain.tld, with server users with the addresses user1@hosteddomain.tld and user2@hosteddomain.tld.

We want to setup server2.maindomain.tld as a backup mail server for hosteddomain.tld, so our DNS records will have the following information for this domain:

Priority: 10, Host: @, Goes to: server1.maindomain.tld
Priority: 20, Host: @, Goes to: server2.maindomain.tld

On server2.maindomain.tld, we need to modify /etc/postfix/main.cf by adding the following two lines:

relay_domains = hash:/etc/postfix/relay_domains
relay_recipient_maps = hash:/etc/postfix/relay_recipients

Then create /etc/postfix/relay_domains with the following text:

hosteddomain.tld relay

Then run the following commands:

postmap /etc/postfix/relay_domains

Next, create /etc/postfix/relay_recipients with the following text:

user1@hosteddomain.tld relay
user2@hosteddomain.tld relay

Then run:

postmap /etc/postfix/relay_recipients

The “relay” column can actually be anything, like “x” or something. It’s just that postmap requires there be two actual columns (it seems).

server2.maindomain.tld should now be acting as a backup mail server for the hosteddomain.tld domain (according to most such guides on the net and my own testing). Now, whenever a new user is added in the primary server, a new entry in “relay_recipents” will have to be added and postmap /etc/postfix/relay_recipients run to add the new user in the backup server’s relay list.

My observations to flesh out an auto-syncronizing system between Primary mail server and the Backup mail server(s)
On the primary mail server, I’ve observed a file that would make this much simpler. This is /etc/postfix/virtualusertable. It seems simply copying this file to the backup mail server as /etc/postfix/relay_recipents with the domains setup in relay_domains might be sufficient to syncronize the list and make the backup server reject any invalid “to:” addresses without having to have itself bounce a message. The nice thing is virtualusertable also includes any aliases of users on the primary system.

What I plan on doing is creating a script that will do the following on the primary server:

1) Make a copy of the virtualusertable file in a location where the backup mail server can retrieve it, preferably http locked with a user and password login, everytime this file is modified or running as a cron job.

On the backup server, I’m looking into a script that will do the following in a cronjob:

1) Retrieve the file from the primary server (probably using wget). If the retrieve failed, cancel the rest of the script. If it retrieves it, save it temporarily as “retrievedvirtualusertable”.
2) Detect any changes.
3) Parse through retrievedvirtualusertable and create a file called retrieveddomains, where it would only have all of the domains list only once.
4) Match retrieveddomains with the backup server’s local-host-names, save anything in retrieveddomains but not in local-host-names in /etc/postfix/relay_domains.
5) Run “postmap /etc/postfix/relay_domains”
6) Match retrievedvirtualusertable with the backup server’s virtualusertable, save anything in retrievedvirtualusertable but not in virtualusertable in /etc/postfix/relay_recipient.
6) Run “postmap /etc/postfix/relay_recipient”.

Well, this is where I’m at so far. Hopefully, I’ll have time in the next week to create these scripts to do that.

====================================================================

Configuring procmail for spamassassin

The /etc/procmailrc file is used by procmail to determine the procmail helper programs that should be used to filter mail. This file isn’t created by default.

spamassassin has a template you can use called /etc/mail/spamassassin/spamassassin-spamc.rc. Copy the template to the /etc directory:

     [root@bigboy tmp]# cp /etc/mail/spamassassin/spamassassin-spamc.rc
     /etc/procmailrc

This file forces all mail arriving for your mail server’s users through Spamassasin.

Configuring spamassassin

The spamassassin configuration file is named /etc/mail/spamassassin/local.cf. You can customize this fully commented sample configuration file to meet your needs:

     ###################################################################
     # See 'perldoc Mail::SpamAssassin::Conf' for
     # details of what can be adjusted.
     ################################################################### 

     #
     # These values can be overridden by editing
     # ~/.spamassassin/user_prefs.cf (see spamassassin(1) for details)
     # 

     # How many hits before a message is considered spam. The lower the
     # number the more sensitive it is. 

     required_hits           5.0 

     # Whether to change the subject of suspected spam (1=Yes, 0=No)
     rewrite_subject         1 

     # Text to prepend to subject if rewrite_subject is used
     subject_tag             *****SPAM***** 

     # Encapsulate spam in an attachment (1=Yes, 0=No)
     report_safe             1 

     # Use terse version of the spam report (1=Yes, 0=No)
     use_terse_report        0 

     # Enable the Bayes system (1=Yes, 0=No)
     use_bayes               1 

     # Enable Bayes auto-learning (1=Yes, 0=No)
     auto_learn              1 

     # Enable or disable network checks (1=Yes, 0=No)
     skip_rbl_checks         0
     use_razor2              1
     use_dcc                 1
     use_pyzor               1 

     # Mail using languages used in these country codes will not be marked
     # as being possibly spam in a foreign language.
     # - english 

     ok_languages            en
     # Mail using locales used in these country codes will not be marked
     # as being possibly spam in a foreign language. 

     ok_locales              en

Be sure to restart spamassassin for your changes to take effect.

Startup spamassassin

The final steps are to configure spamassassin to start on booting and then to start it.

     [root@bigboy tmp]# chkconfig spamassassin on
     [root@bigboy tmp]# service spamassassin start
     Starting spamd: [  OK  ]
     [root@bigboy tmp]#

Spam Scripts

[root@bigboy mailuser]# chmod 700 mail-filter.pl

[root@bigboy mailuser]# cd /etc/smrsh
[root@bigboy smrsh]# ln s /home/mailuser/mail-filter.pl

#!/bin/bash
| ~/mail-filter.pl

The mail-filter.accept File

     address: my-address@mysite.com
     address: cnn
     subject: Alumni Association

The mail-filter.reject File

     address: spammer@spammer.com
     repeataddress: my-isp-provider.net
     subject: porn

The mail-filter Script

     #!/usr/bin/perl
     #
     #
     # Mail-filter - PERL Script
     #
     #
     # Reference pages
     #
     # http://search.cpan.org/author/SIMON/Mail-Audit-2.1/Audit.pm
     # http://simon-cozens.org/writings/mail-audit.html
     #
     # PERL modules needed from
     http://www.cpan.org/modules/01modules.index.html
     #
     # Need to install the following modules:
     #
     #      MailTools, IO-Stringy, MIME-tools & Mail-Audit in this order
     #
     #
     # Need to have:
     #
     #    a logical link to this file in /etc/smrsh
     #    .forward file with the following line in it
     #
     #         #!/bin/bash
     #         | ~/mail-filter
     # 

        use Mail::Audit;
        use MIME::Lite; 

        #
        # Spam filter variables
        # 

        $FILEPATH           = "/home/mailuser/";
        $ITEM               = Mail::Audit->new;
        $FROM               = $ITEM->from();
        $TO                 = $ITEM->to();
        $CC                 = $ITEM->cc();
        $SUBJECT            = $ITEM->subject();
        $BODY               = $ITEM->body();
        $DATE               = "";
        $INBOX_LOG          = $FILEPATH . "mail-filter.log";
        $ACCEPT_FILE        = $FILEPATH . "mail-filter.accept";
        $REJECT_FILE        = $FILEPATH . "mail-filter.reject"; 

     #################### Don't edit below here ################### 

        chomp($DATE = `date '+ %m/%d/%Y %H:%M:%S'`);
        $DATE =~ s/^\s*(.*?)\s*$/$1/;
        chomp($FROM, $TO, $CC, $SUBJECT);
        study $FROM;
        study $SUBJECT;
        study $TO;
        study $CC; 

        &Mail_Filter;
        exit; 

     sub Mail_Filter { 

        my %badsubjects        = ();
        my %badaddresses       = ();
        my %badrepeataddresses = ();
        my %goodsubjects       = ();
        my %goodaddresses      = (); 

        #
        # Read in the configuration files
        # 

        open (REJECT_FILE, "$REJECT_FILE"); 

            while(<REJECT_FILE>){ 

               my $record = $_;
               my ($value, $type) = &Strip_Record($record); 

               #
               # Get the bad subjects
               #
               if ($type =~ /^subject$/i){
                  $badsubjects{$value} = "$type";
               } 

               #
               # Get the bad address
               # 

               if ($type =~ /^address$/i){
                  $badaddresses{$value} = "$type";
               } 

               #
               # Get the bad repeat address
               # 

               if ($type =~ /^repeataddress$/i){
                 $badrepeataddresses{$value} = "$type";
               }
            }
        close (REJECT_FILE); 

        open (ACCEPT_FILE, "$ACCEPT_FILE"); 

            while(<ACCEPT_FILE>){ 

               my $record = $_;
               my ($value, $type) = &Strip_Record($record); 

               #
               # Get the good subjects / address
               # 

               if ($type =~ /subject/i){
                  $goodsubjects{$value} = "$type";
               } 

               if ($type =~ /address/i){
                  $goodaddresses{$value} = "$type";
               }
            }
        close (ACCEPT_FILE);
              #
              # Reject by subject
              # 

              foreach my $criteria (keys %badsubjects) {
                  next unless $SUBJECT =~ /$criteria/i;
                  &Reject_Mail("yes"); 

              } 

              #
              # Reject email to/from these addresses
              # 

              foreach my $criteria (keys %badaddresses) {
                  next unless ($TO =~ /$criteria/i) or ($CC =~ /$criteria/i) or
          ($FROM =~ /$criteria/i);
                  &Reject_Mail("yes");
              } 

              #
              # Sometimes SPAM is sent to multiple addresses in the same domain.
          Reject email if
              # the number of addresses in the to: or cc: >= 3
              # 

              foreach my $criteria (keys %badrepeataddresses) { 

             my $to_cc = $TO." ".$CC;
             my @repeat_test_string = split(/$criteria/,$to_cc);
             my $i = -1;
             foreach my $tmp_var (@repeat_test_string){
                 $i++;
             }
             if($i >= 3){ 

                 #
                 # Reject
                 # 

                 &Reject_Mail("yes");
             }
          } 

          #
          # Accept some subject lines
          # 

          for my $criteria (keys %goodsubjects) {
              next unless $SUBJECT =~ /$criteria/i;
              &Reject_Mail("no");
          } 

          #
          # Accept emails to/from these addresses
          # 

          for my $criteria (keys %goodaddresses) {
              next unless ($TO =~ /$criteria/i) or ($CC =~ /$criteria/i) or
      ($FROM =~ /$criteria/i);
             &Reject_Mail("no");
         } 

         #
         # Reject everything else
         # 

         &Reject_Mail("yes");
     } 

     sub Strip_Record{ 

         my $record = shift(@_); 

         #
         # Split out the fields in the record and strip out
     leading/trailing white space
         # 

         chomp $record;
         my @fields = split(/\:/,$record);
         $fields[0] =~ s/^\s*(.*?)\s*$/$1/;
         $fields[1] =~ s/^\s*(.*?)\s*$/$1/; 

         #
         # Return the subjects
         #
         if ($fields[0] =~ /^subject$/i){
            return ($fields[1], "subject");
         } 

         #
         # Return the addresses
         #
         elsif ($fields[0] =~ /^address$/i){
            if ($fields[1] =~ /\@/){
               my ($person, $domain) = split(/\@/, $fields[1]);
               return ($person ."\@" . $domain, "address");
            }
            else{
               return ($fields[1], "address");
            }
         } 

         #
         # Return the repeat addresses
         #
         elsif ($fields[0] =~ /^repeataddress$/i){
            if ($fields[1] =~ /\@/){
                my ($person, $domain) = split(/\@/, $fields[1]);
                return ($person ."\@" . $domain, "repeataddress");
            }
            else{
               return ($fields[1], "repeataddress");
            }
         } 

     } 

     sub Reject_Mail { 

         my $ok = shift(@_); 

         open (LOG, ">> $INBOX_LOG"); 

         #
         # Log message receipt to file
         # 

         if ($ok =~ /yes/i){ 

             print LOG "REJECT $DATE To: $TO From: $FROM Subject:
     $SUBJECT\n";
             $ITEM->reject;
         }
         else{ 

             print LOG "ACCEPT $DATE To: $TO From: $FROM Subject:
     $SUBJECT\n";
             $ITEM->accept;
         } 

         close(LOG);
         exit;
     }

http://www.linux.com/feature/39643

Track those send emails 

Sometimes, it may be necessary to track the email messages
that make their
way across your system. What are those reasons? You may have
noticed an
increase in email abuse, either internal or external, where
forwarding a
copy of each message to an administrator would be desirable. By
using the
always_bcc parameter, a blind carbon copy of each message will
be
delivered to an administrative user of your choice. Since that person
will
be getting a lot of messages, it makes sense to create a temporary
user
account. Tracking and logging messages in this way can be quite a
daunting
task. 

Here's how you do it. Edit your main.cf file and add
the following line: 

always_bcc=adminuser@yourdomain.dom 

The
adminuser is the one you created to receive a copy of all this email.
Reload
postfix and that username will start receiving a copy of every
email that
goes across the system. To activate the feature,
reload
postfix. 

postfix reload 

Postfix via Webmin 

Webmin
provides extensive configuration options for Postfix, and you
should
certainly familiarize yourself with it. Webmin provides multiple
modules to
administer everything, including dealing with messages in the
current mail
queue, client and server restrictions, logging, and a whole
lot more. You'll
find Postfix configuration under Servers in Webmin, or
you can just jump to
it by entering the URL in your browser's location bar
like this: 

http://your_server:10000/postfix/index.cgi

===================================================================

You have user1 of your domain domain.tld. But you need to know/backup all
the ails user1@domain.tld  send. 

Postfix has the solution. In /etc/postfix/main.cf
add: 

sender_bcc_maps = hash:/etc/postfix/sender_bcc
Then edit or
create /etc/postfix/sender_bcc in the following format: 

user1@domain.tld copy@domain.tld
and run postmap
/etc/postfix/sender_bcc and posfix reload. 

Postfix version must be at

leas 2.1.

====================================================================

Start with the amavisd-new example:

smtp-amavis unix – – n – 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes

127.0.0.1:10025 inet n – n – – smtpd
-o content_filter=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o smtpd_milters=
-o local_header_rewrite_clients=
-o local_recipient_maps=
-o relay_recipient_maps=
-o
receive_override_options=no_header_body_checks,no_unknown_recipient_checks

Untill you gain more understanding, place this in main.cf:

content_filter = smtp-amavis:[127.0.0.1]:10024

I would also suggest disabling content_filter for the pickup daemon
(so mail from the machine itself is not scanned):

pickup fifo n – – 60 1 pickup
-o content_filter=

Working Mailserver. Postfix, Fetchmail, Procmail, Dovecot

DOWNLOAD
--------
You need to download the following three scripts:

update-mailstats.pl
mailstats.pl
mrtg-mailstats.pl

save them all in /usr/local/bin and make them executable.

if you save them in a different directory then you will have to edit the
following line in mrtg-mailstats.pl:

	$mailstats = "/usr/local/bin/mailstats.pl" ;

HOWTO
-----

1. run the update-mailstats.pl program in the background like so:

	update-mailstats.pl &

(you probably want to write a wrapper script to restart it in case it
ever gets killed.)

this updates a file called /tmp/stats.db (adjust to suit your needs)
with the inbound and outbound mail stats.

the logic of this script is extremely simple (and probably far from
perfect):

if the line contains "status=sent" then figure out the transport from
the "relay=" part of the line. if relay= contains "[" then assume it's
an IP address, and transport is smtp. otherwise, transport is whatever
the "relay=" bit says.

if line contains "smtpd.*client=" then we've received a message via
smtp. if line contains "pickup.*(sender|uid)=" then we've received a
message from a local user.

very simple, mostly works. i'm sure there are cases which it doesn't
catch.  if you can improve it, let me know.

to tell the truth, it doesn't matter if it's 100% accurate or not.
the point is to give a pretty graph of some meaningless numbers to
management types. they love it :)

2. if you want to see the raw data, use the mailstats.pl script:

	$ mailstats.pl
	RECEIVED:local 162
	RECEIVED:smtp 4253
	SENT:local 4101
	SENT:smtp 5118

3. add lines like the following to your mrtg.cfg:

	#---------------------------------------------------------------#
	# MRTG mail cfg:  Postfix mailstats plotting with MRTG          #
	#---------------------------------------------------------------#
	Target[postfix]: `/usr/local/bin/mrtg-mailstats.pl`
	Options[postfix]: gauge, growright
	Title[postfix]: Postfix Statistics
	PageTop[postfix]: <H1>Postfix Statistics</H1>
	WithPeak[postfix]: dwmy
	YLegend[postfix]: No. of messages
	ShortLegend[postfix]: messages
	LegendI[postfix]: &nbsp;Incoming:
	LegendO[postfix]: &nbsp;Outgoing:
	#---------------------------------------------------------------#

this runs the mrtg-mailstats.pl programs which totals the RECEIVED and
SENT lines output by mailstats.pl and then outputs it in a form
suitable for MRTG. it keeps the previous RECEIVED and SENT counts in
/tmp/mailstats.old

Some useful links

http://www.postfix.org/STANDARD_CONFIGURATION_README.html

http://www.howtoforge.com/fedora-8-server-lamp-email-dns-ftp-ispconfig-p6

http://www.akadia.com/services/postfix_mta.html