Source from David Goodwin

Install Debian

No surprise there… I installed Etch via netboot, and ended up with a fairly minimal setup. You’ll probably do it a different way. I told it to install as a ‘mail server’ and a ‘web server’. The ‘mail server’ option was probably a mistake as it installs uw-imapd and exim, neither of which I wanted/needed.

You probably want to install openssh-server and molly-guard

Postfix

apt-get install postfix postfix-mysql

(Or postfix-mysql if you’re going to use that instead)

I selected the Internet Site configuration when asked to pick a configuration.

/etc/apt/sources.list

In order to have slightly more recent versions of a few packages (PHP5, ClamAV and PostgreSQL mainly), I added the following into my /etc/apt/sources.list file :

deb http://packages.dotdeb.org stable all deb http://www.mirrorservice.org/sites/backports.org/ etch-backports main contrib non-free

Install MySQL

apt-get install mysql-server

(Note: there is no requirement on using v8.2, but I’m under the impression that it’s faster than previous versions). I’d suggest you use at least v8.1 (in Etch) from a maintenance point of view.

Install PHP5

I always install the suhosin extension to PHP in the hope it will provide extra security. APC (Alternative PHP Cache) is also installed in the expectation it will improve performance.

apt-get install php5 libapache2-mod-php5 php5-mysql php5-suhosin php5-apc php-pear

(The above packages nearly all come from dotdeb.org)

Install Postfixadmin

Although I have created .deb for Postfixadmin; at the time of writing, v2.2.0 hadn’t been released; so I installed Postfixadmin from SVN. Hopefully by Jan 2008, version 2.2.0 of Postfixadmin will have been released, and you will want to see this page to download it.

cd /var/www svn co https://postfixadmin.svn.sourceforge.net/svnroot/postfixadmin/trunk postfixadmin

If you now hit http://your.server/postfixadmin you should see a slightly useful ‘welcome’ screen, follow the link through to the ’setup.php’ page. And you should get some sort of instant gratification that at least something works

Setting up PostgreSQL (or MySQL)

As postfixadmin stores all of it’s configuration within a database, we need to setup the database before we can do much further. You may find that phppgadmin or phpmyadmin help with this.

Basically – create a user (e.g. ‘postfix’) and a database (e.g. ‘postfix’). The user should own the database. Ensure there’s a password set on the user.

If security is a concern, you should probably have a user that is ‘read-only’ which is used by postfix (as it only ever queries the DB) while postfixadmin will need a read-write user account.

If you’re using PostgreSQL, the following shows what I typed in from a shell (all lines containing a $ or #)on the server

mail:~# su - postgres postgres@mail:~$ psql template1 Welcome to psql 8.2.4, the PostgreSQL interactive terminal.  Type:  \copyright for distribution terms        \h for help with SQL commands        \? for help with psql commands        \g or terminate with semicolon to execute query        \q to quit  template1=# CREATE USER postfix WITH PASSWORD 'complexpassword'; CREATE ROLE template1=# CREATE DATABASE postfix WITH OWNER postfix ENCODING 'UNICODE'; CREATE DATABASE template1=# \q

If, like me, you are useless at picking passwords, try using pwgen

Load the Postfixadmin Database Schema into your database

Currently this is still a manual step, but it should (eventually) be handled by the setup.php script.

cd /var/www/postfixadmin psql -U postfix -h localhost postfix < DATABASE_MYSQL.TXT

This may spew out a few errors about roles that don’t exist, but it should work

Configuration of Postfixadmin

Edit /var/www/postfixadmin/config.inc.php in your favourite editor (vi[m]).

1. Change

   $CONF['configured'] = false;

   to

   $CONF['configured'] = true;

2. Change

   $CONF['postfix_admin_url'] = '';

   to

   $CONF['postfix_admin_url'] = 'http://your.server/postfixadmin';

3. Change

   $CONF['database_type'] = 'mysql';

4. Change the other database parameters to match what you used above.

You’ll want to change other parameters, but they’re not normally essential

Postfixadmin

Once your config.inc.php file has the right database credentials, and you refresh http://your.server/postfixadmin/setup.php you should a dialog box to Create superadmin account. You should treat these details a bit like the ‘root’ password for a Unix server. This user will be able to add/remove/edit any domains/users/aliases etc.

Anyway, choose an admin account, this could be (for example) it@your.domain

Submitting this form, successfully, should result in the page giving you a message like ‘Admin has been added!‘

Delete setup.php

Configuring Postfix

This always seems to be the bit that causes others trouble….

New configuration files

In my world, the following go in /etc/postfix/mysql

relay-domains.cf

(Who we relay mail for (as a backup mx))

user            = postfix password        = xxxxxxx dbname          = postfix hosts           = localhost query = SELECT domain FROM domain WHERE domain = '%s' AND backupmx = true

virtual-alias-maps.cf

(Think: /etc/aliases or similar)

user             = postfix password         = xxxxxxxx dbname           = postfix hosts            = localhost query = SELECT goto FROM alias WHERE address='%s' AND active = true

virtual-domains.cf

(Domains we accept mail for…)

user        = postfix password    = xxxxxxxx dbname      = postfix hosts       = localhost query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = false AND active = true

virtual-mailbox-limit-maps.cf

(Only used if you’re checking quota etc)

user = postfix password = xxxxxxx hosts = localhost dbname = postfix query = SELECT quota FROM mailbox WHERE username = '%s'

virtual-mailbox-maps.cf

(What mailboxes exist that we can deliver to)

user      = postfix password  = xxxxxxxx dbname    = postfix hosts     = localhost query = SELECT maildir FROM mailbox WHERE username='%s' AND active = true

main.cf changes

Add in the following :

# All virtual mailboxes live somewhere in here .. virtual_mailbox_base = /var/mail/vmail  # The (virtual) domains we accept mail for virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual-domains.cf  # Lookup mailbox location, uid and gid based on email address received. virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual-mailbox-maps.cf virtual_uid_maps = static:101 virtual_gid_maps = static:101  virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual-alias-maps.cf  relay_domains = proxy:mysql:/etc/postfix/mysql/relay-domains.cf local_transport = virtual local_recipient_maps = $virtual_mailbox_maps

#adduser -m vmail -g mail 
#id vmail ;result 101
#chown vmail:mail /var/mail/vmail

Postfix SMTP Auth Support

If your users are likely to be trying to send mail through your mail server when they are not on a trusted network, you’ll need to add this to /etc/postfix/main.cf

smtpd_sasl_authenticated_header = yes smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes

And in /etc/postfix/sasl/smtpd.conf put the following :

pwcheck_method: saslauthd  saslauthd_path: /var/run/saslauthd/mux log_level: 3 mech_list: PLAIN LOGIN

(As you can see, we’ll be using SASL as a backend for authentication)

SASL

Thankfully the SASL package works a bit better under Etch than it did under Sarge/etc.

apt-get install sasl2-bin

Edit /etc/default/saslauthd so it has :

MECHANISMS="rimap" THREADS=5 OPTIONS="-r -c -O localhost -m /var/spool/postfix/var/run/saslauthd"

You’ll need to mkdir -p /var/spool/postfix/var/run/saslauthd before SASL will start

(One day, I might change to use the pam_sql module; as this would remove unnecessary IMAP logins… )

Courier

apt-get install courier-authdaemon courier-imap courier-imap-ssl courier-pop courier-pop-ssl courier-authlib-postgresql

Configuring Courier’s authdaemon

You’ll need to edit /etc/courier/authmyqlrc

MYSQL_SERVER            localhost
MYSQL_USERNAME          postfix
MYSQL_PASSWORD          knopix2006
MYSQL_PORT              3306
MYSQL_DATABASE          postfix
MYSQL_USER_TABLE        mailbox
MYSQL_CLEAR_PWFIELD     password
MYSQL_UID_FIELD         '101' #vmail id
MYSQL_GID_FIELD         '8' #mail id
MYSQL_LOGIN_FIELD       username
MYSQL_HOME_FIELD        '/home/vmail'
MYSQL_NAME_FIELD        name
MYSQL_MAILDIR_FIELD     maildir
MYSQL_QUOTA_FIELD       quota

And also edit /etc/courier/authdaemonrc, and set authmodulelist=”authmysql”

If you now create a user in a test domain on postfixadmin, you should be able to connect to your mail server successfully, and receive mail

Basic Testing (pop3)

Assuming you’ve created a domain, and a user within that domain from Postfixadmin, you should be able to do something like the following :

mail:~# tail -f /var/log/mail.log  & mail:~# echo 'test email' | mail crap@burton-mccall.co.uk mail:~#  Dec  6 22:31:56 mail postfix/pickup[11888]: A811A2B10063: uid=0 from= Dec  6 22:31:56 mail postfix/cleanup[11897]: A811A2B10063: message-id= Dec  6 22:31:56 mail postfix/qmgr[11889]: A811A2B10063: from=, size=297, nrcpt=1 (queue active) Dec  6 22:31:56 mail postfix/virtual[11902]: A811A2B10063: to=, relay=virtual, delay=0.11, delays=0.05/0.04/0/0.02, dsn=2.0.0, status=sent (delivered to maildir) Dec  6 22:31:56 mail postfix/qmgr[11889]: A811A2B10063: removed

Additionally, if you now look in /home/vmail, you should see a folder called ‘test@my.domain’. No guesses should be needed to figure out what this contains!

Squirrelmail

Squirrelmail is a mature web based mail client. It’s been around for some time now, and thankfully plugins exist for a number of additional “features”. As your author patched up the squirrelmail postfixadmin plugin, he’s going to take a small amount of time it.

• apt-get install squirrelmail

• wget http://squirrelmail-postfixadmin.palepurple.co.uk/files/squirrelmail-postfixadmin_2.1.0-1_all.deb

• dpkg -i squirrelmail-postfixadmin_2.1.0-1_all.deb

• Edit /etc/squirrelmail/plugins/postfixadmin-config.php – use the same settings from Postfixadmin
• pear install MDB2
• pear install MDB2#pgsql (or MDB2#mysql)
• Run squirrelmail-configure and enable the Postfixadmin plugin

Setting up a wireless network with Windows Server 2003 and PEAP/EAP

(install using qmailrocks)

edit /var/qmail/supervise/qmail-smtpd/run

#!/bin/sh
QMAILQUEUE=”/var/qmail/bin/qmail-scanner-queue.pl” ;export QMAILQUEUE
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
LOCAL=`head -1 /var/qmail/control/me`
if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then
echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
if [ ! -f /var/qmail/control/rcpthosts ]; then
echo “No /var/qmail/control/rcpthosts!”
echo “Refusing to start SMTP listener because it’ll create an open relay”
exit 1
fi
exec /usr/local/bin/softlimit -m 40000000 /usr/local/bin/tcpserver -v -R -l “$LOCAL” -x /etc/tcp.smtp.cdb -c “$MAXSMTPD” -u “$QMAILDUID” -g “$NOFILESGID” 0 smtp /usr/local/bin/rblsmtpd -b -t 5 -r bl.spamcop.net -r sbl.spamhaus.org -r relays.ordb.org -r dnsbl.antispam.or.id -r bl.spamcop.net /var/qmail/bin/qmail-smtpd mail.semestamargaraya.com /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1

• debian:~# apt-get install kernel-package libncurses5-dev

• wget http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

• debian:~# cd /usr/src/
  debian:/usr/src# tar xzf /root/linux-2.4.20.tar.gz
  debian:/usr/src# ls -la
  total 2
  drwxr-xr-x    3 root     root           80 Jun 12 12:00 .
  drwxr-xr-x   14 root     root          360 Jun 12 12:00 ..
  drwxr-xr-x   14 573      573           536 Nov 29  2002 linux-2.4.20

• debian:/usr/src# mv linux-2.4.20 linux-2.4.20-mh9
  debian:/usr/src# cd linux-2.4.20-mh9
  debian:/usr/src/linux-2.4.20-mh9# zcat /root/patch-2.4.20-mh9.gz | patch -p1
  patching file Documentation/Configure.help
  patching file Makefile
  patching file arch/sparc64/kernel/ioctl32.c
  patching file drivers/bluetooth/Config.in
  patching file drivers/bluetooth/Makefile
  patching file drivers/bluetooth/btuart_cs.c
  patching file drivers/bluetooth/hci_bcsp.c
  patching file drivers/bluetooth/hci_bcsp.h
  patching file drivers/bluetooth/hci_h4.c
  patching file drivers/bluetooth/hci_h4.h
  patching file drivers/bluetooth/hci_ldisc.c
  patching file drivers/bluetooth/hci_uart.h
  patching file drivers/bluetooth/hci_usb.c
  patching file drivers/bluetooth/hci_usb.h
  patching file drivers/char/pcmcia/serial_cs.c
  patching file drivers/char/serial.c
  patching file drivers/usb/Config.in
  patching file include/net/bluetooth/bluetooth.h
  patching file include/net/bluetooth/hci.h
  patching file include/net/bluetooth/hci_core.h
  patching file include/net/bluetooth/l2cap.h
  patching file include/net/bluetooth/rfcomm.h
  patching file include/pcmcia/ciscode.h
  patching file net/bluetooth/Config.in
  patching file net/bluetooth/Makefile
  patching file net/bluetooth/af_bluetooth.c
  patching file net/bluetooth/bnep/Config.in
  patching file net/bluetooth/bnep/Makefile
  patching file net/bluetooth/bnep/bnep.h
  patching file net/bluetooth/bnep/core.c
  patching file net/bluetooth/bnep/netdev.c
  patching file net/bluetooth/bnep/sock.c
  patching file net/bluetooth/hci_conn.c
  patching file net/bluetooth/hci_core.c
  patching file net/bluetooth/hci_sock.c
  patching file net/bluetooth/l2cap.c
  patching file net/bluetooth/rfcomm/Config.in
  patching file net/bluetooth/rfcomm/Makefile
  patching file net/bluetooth/rfcomm/core.c
  patching file net/bluetooth/rfcomm/crc.c
  patching file net/bluetooth/rfcomm/sock.c
  patching file net/bluetooth/rfcomm/tty.c
  patching file net/bluetooth/sco.c
  patching file net/bluetooth/syms.c

• debian:/usr/src/linux-2.4.20-mh9# cp /root/config-2.4.20 .config
  debian:/usr/src/linux-2.4.20-mh9# make oldconfig
  rm -f include/asm
  ( cd include ; ln -sf asm-i386 asm)
  /bin/sh scripts/Configure -d arch/i386/config.in
  #
  # Using defaults found in .config
  #
  .
  .
  .
  
  *** End of Linux kernel configuration.
  *** Check the top-level Makefile for additional configuration.
  *** Next, you must run "make dep".
  
  debian:/usr/src/linux-2.4.20-mh9# make-kpkg kernel-image
  .
  .
  .

• debian:/usr/src/linux-2.4.20-mh9# cd ..
  debian:/usr/src# ls -la
  total 3534
  drwxr-xr-x    3 root     root          144 Jun 13 12:00 .
  drwxr-xr-x   14 root     root          360 Jun 12 12:00 ..
  -rw-r--r--    1 root     root      3612714 Jun 11 12:42 kernel-image-2.4.20-mh9_10.00.Custom_i386.deb
  drwxr-xr-x   15 573      573           856 Jun 11 12:42 linux-2.4.20-mh9
  debian:/usr/src# dpkg -i kernel-image-2.4.20-mh9_10.00.Custom_i386.deb
  Selecting previously deselected package kernel-image-2.4.20-mh9.
  (Reading database ... 80275 files and directories currently installed.)
  Unpacking kernel-image-2.4.20-mh9 (from kernel-image-2.4.20-mh9_10.00.Custom_i386.deb) ...
  Setting up kernel-image-2.4.20-mh9 (10.00.Custom) ...
  A new kernel image has been installed, and usually that means
  that some action has to be taken to make sure that the new
  kernel image is used next time the machine boots. Usually,
  this entails running a "bootloader" like SILO, loadlin, LILO,
  ELILO, QUIK, VMELILO, ZIPL, or booting from a floppy.   (Some
  boot loader, like grub, for example, do not need to be run on
  each new image install, so please ignore this if you are using
  such a boot loader).
  
  A new kernel image has been installed. at /boot/vmlinuz-2.4.20-mh9
   (Size: 761kB)
  
  Symbolic links, unless otherwise specified, can be found in /
  
  LILO sets up your system to boot Linux directly from your hard
  disk, without the need for booting from a boot floppy.
  
  WARNING
  If you are keeping another operating system or another version
  of Linux on a separate disk partition, you should not have LILO
  install a boot block now. Wait until you read the LILO documentation.
  That is because installing a boot block now might make the other
  system un-bootable. If you only want to run this version of Linux,
  go ahead and install the boot block here. If it does not work, you
  can still boot this system from a boot floppy.
  
  Would you like to create a boot floppy now? [No] No
  You already have a LILO configuration in /etc/lilo.conf
  Install a boot block using the existing /etc/lilo.conf? [Yes] Yes
  Testing lilo.conf ...
  Testing successful.
  Installing the partition boot sector...
  Installation successful.

• SRC : http://www.holtmann.org/linux/kernel/debian.html
  
  debian:/usr/src#
  
  debian:/usr/src/linux-2.4.20-mh9#
  debian:/usr/src/linux-2.4.20-mh9#
  debian:/usr/src#

Keterangan:

$VALID_DAYS : 3650 hari
$PRIVATE_KEY : cert.key
$CERTIFICATE_FILE : cert.crt

• Buka console as root, ketikkan perintah seperti berikut

openssl req -new -days $VALID_DAYS -key $PRIVATE_KEY -x509 -out $CERTIFICATE_FILE

Implementasi bandwidth management biasanya di terapkan pada main-gw (gateway utama) dimana main-gw menghandle beberapa klien yang mempunyai jatah bandwidth yang telah di tetapkan. Disini kita akan menggunakan tool bantu yang bernama HTB-GEN.
Pada distro linux kebanyakan sebenarnya htb/cbq sudah include di kernel default masing-masing distro, tinggal kita saja yang kurang familiar dengan perintah tc yang digunakan sebagai standar tool shaping bandwith. Untuk itulah kita menggunakan HTB-GEN disini.
Yang perlu diingat adalah :
Lisensi GPLv2 or later
Syarat dan kebutuhan untuk menjalankannya:
-bash
-QoS htb kernel support
-iproute2 tc
-iptables
-htb-init script (optional)

Ok kita mulai aja meng-implementasikan HTB-GEN ke mesin main-gw kita, langkah-langkahnya adalah sebagai berikut:
Langkah 1: Download

– htb-gen-0.8.4.tar.gz Source tarball
– htb-gen_0.8.4_all.deb Debian package
– htb-gen-0.8.4–1.noarch.rpm Aliened RPM package

Archive at http://www.praga.org.ar/dev/htb-gen/packages/

sesuaikan dengan distro based yang dipakai, disini saya pake mandriva cooker, otomatis harus download yang versi .rpm

Langkah 2: Install
untuk menginstall htb-gen di mandriva, tinggal menjalankan perintah
#urpmi htb-gen-0.8.4-1.noarch.rpm

Langkah 3: Konfigurasi
setelah langkah instalasi dilalui dengan sukses maka akan terdapat file konfigurasi standar htb-gen di direktori /etc/htb-gen.
Edit file /etc/htb-gen/htb-gen.conf, dengan editor kesayangan anda

#vim /etc/htb-gen/htb-gen.conf

perhatikan baris berikut ini:

iface_down=”eth1″ # Server LAN iface
iface_up=”eth0″ # Server INET iface
total_rate_down=1024 #Total download bw
total_rate_up=512 #Total upload bw

Kemudian di file /etc/htb-gen/htb-gen-rates.conf, perhatikan baris berikut :

# down down up up
# min max min max
#ip (rate) (ceil) (rate) (ceil)
192.168.1.2 0 64 0 32
192.168.1.3 0 128 0 64
192.168.1.4 0 256 0 128
10.0.0.1/30 256 512 128 256
200.80.22.2 256 256 256 256

Seperti yang terlihat

mudah sekali untuk membatasi suatu host atau network

ip beda network juga bisa digunakan

penulisan format ip dan network mengikuti aturan standar

mendukung fixed rate b/w

nilai nol atau “0″ artinya secara otomatis akan menggunakan b/w yang ada atau b/w yang tersisa.

Selanjutnya….

Langkah 4: Menjalakannya

Untuk menjalankan htb-gen sangat mudah, secara umum htb-gen dapat di jalankan dengan opsi sebagai berikut

#htb-gen tc_all

lebih lanjut dengan opsi htb-gen, bisa di cek dengan perintah

#htb-gen –help

Situs terkait dan resmi dari htb-gen bisa di cek di http://www.praga.org.ar/wacko/DevPraga/htbgen/

sumber : http://fsdoei.wordpress.com/2007/10/30/htb-gen-cara-mudah-memanage-bandwidth/