Command Center

I've had Postfix/amavisd-new/SpamAssassin/ClamAV/Courier running smoothly on my toaster for a while, thanks to Christoph Haas. Paranoid thoughts have since crept in; what would happen if my toaster were to stop working?

Luckily, I'm the kind of guy who has an old laptop many miles away, quietly humming away under my parents' desk. (No, I don't live in my parents' basement) This would do nicely as a backup MX!

My victim in this case is a Toshiba PIII 700 with a dizzying 64MB RAM, on which I've installed Ubuntu breezy. My parents have a dynamic IP address, which seldom changes in practice. Usually, it's not practical operate a mail server on a dynamic IP because many major ISPs like Yahoo and AOL block any mail from such IP ranges. In this case I'm not concerned, the purpose of a backup MX is to hold on to mail until the primary MX becomes available again, so it is only delivering mail to servers under my control (I will not block my own mail!).

I need to give the backup MX a hostname, I've chosen mail2.toastputer.net - I'm so creative. Fortunately, toastputer.net is hosted by dyndns.org, so I will set the laptop to update it's ip address with ddclient.

# apt-get install ddclient

ddclient works with other services like Hammernode, Zoneedit and EasyDNS. It is very easy to set up.

Lets get on with it and install postfix:

# apt-get install postfix

I chose 'no configuration', because I wanted complete control. Once Postfix is installed, cd to /etc/postfix and sudo vi main.cf

Here's my main.cf with comments to explain what's going on:

#This is the default and will do for me<br /><br />smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)<br /><br />#Notifies users of new mail using comsat.  Since I have no local users or comsat, seems sensible to turn it off<br /><br />biff = no<br /><br /># appending .domain is the MUA's job. - disable rewriting of user@host to user@host.domain<br /><br />append_dot_mydomain = no<br /><br /><br /><br />#Trust no-one except yourself.  IP addresses in mynetworks can relay mail to any address<br /><br />mynetworks = 127.0.0.1/8<br /><br /><br /><br />#Listen on all ip addresses<br /><br />inet_interfaces = all<br /><br /><br /><br />#Who we will accept mail for<br /><br />relay_domains = hash:/etc/postfix/relays<br /><br />#Where it will be sent<br /><br />transport_maps = hash:/etc/postfix/transport<br /><br /><br /><br />smtpd_recipient_restrictions = permit_mynetworks, check_relay_domains<br />

Here is /etc/postfix/transport:

stocksy.co.uk smtp:mail.toastputer.net<br /><br />mattsfoolsgold.co.uk smtp:mail.toastputer.net<br /><br />#...etc<br />

and /etc/postfix/relays

stocksy.co.uk OK<br /><br />mattsfoolsgold.co.uk OK<br /><br />#...etc<br />

It's necessary to run # postmap /etc/postfix/transport and # postmap /etc/postfix/relays so that Postfix can read the files.

Restart Postfix:

/etc/init.d/postfix restart

Check that it actually works (from another host!):

$ telnet mail2.toastputer.net 25<br /><br />Trying 82.21.124.237...<br /><br />Connected to mail2.toastputer.net.<br /><br />Escape character is '^]'.<br /><br />Postfix: 220 mail2.toastputer.net ESMTP Postfix (Ubuntu)<br /><br />You: ehlo www.stocksy.co.uk<br /><br />Postfix: 250-mail2.toastputer.net<br /><br />Postfix: 250-PIPELINING<br /><br />Postfix: 250-SIZE 10240000<br /><br />Postfix: 250-VRFY<br /><br />Postfix: 250-ETRN<br /><br />Postfix: 250 8BITMIME<br /><br />You: mail from:<stocksy@SPAMMERSDIEstocksy.co.uk><br /><br />Postfix: 250 Ok<br /><br />You: rcpt to:<stocksy@NOSPAMMERSDIEstocksy.co.uk><br /><br />Postfix: 250 Ok<br /><br />You: data<br /><br />Postfix: 354 End data with <CR><LF>.<CR><LF%gt;<br /><br />You: Subject: Test message to test backup MX<br /><br />You: This is the message body.<br /><br />You: .<br /><br />Postfix: 250 Ok: queued as 47EDE57B81<br /><br />You: quit<br /><br />Postfix: 221 Bye<br /><br />Connection closed by foreign host.<br />

If you receive the email, good! If not, tail -f /var/log/mail.log should tell you why.

Check that you are not an open relay!

$ telnet relay-test.mail-abuse.org<br />

With this in place, I needed to update the MX records for my domain. This differs from provider to provider, but you must set your primary MX's priority lower than the backup, e.g:

$ dig mx stocksy.co.uk<br /><br /><br /><br />; <<>> DiG 9.2.2 <<>> mx stocksy.co.uk<br /><br />;; global options:  printcmd<br /><br />;; Got answer:<br /><br />;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14586<br /><br />;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2<br /><br /><br /><br />;; QUESTION SECTION:<br /><br />;stocksy.co.uk.                 IN      MX<br /><br /><br /><br />;; ANSWER SECTION:<br /><br />stocksy.co.uk.          7190    IN      MX      5 mail2.toastputer.net.<br /><br />stocksy.co.uk.          7190    IN      MX      0 mail.toastputer.net.<br /><br /><br /><br />;; AUTHORITY SECTION:<br /><br />stocksy.co.uk.          7190    IN      NS      ns17.zoneedit.com.<br /><br />stocksy.co.uk.          7190    IN      NS      ns8.zoneedit.com.<br /><br /><br /><br />;; ADDITIONAL SECTION:<br /><br />ns8.zoneedit.com.       172790  IN      A       206.55.124.4<br /><br />ns17.zoneedit.com.      172790  IN      A       209.126.159.118<br /><br /><br /><br />;; Query time: 3 msec<br /><br />;; SERVER: 172.16.0.81#53(172.16.0.81)<br /><br />;; WHEN: Sun Nov 27 18:43:02 2005<br /><br />;; MSG SIZE  rcvd: 169<br />

Test it. Stop the MTA on your primary MX and send yourself some email from gmail (or something). If you $ tail -f /var/log/mail.log on your backup MX, you'll see the mail queuing up. Start your MTA again and it'll get delivered to you. Use # postqueue -f if you are impatient.

REFERENCE

http://www.stocksy.co.uk/articles/Linux/postfix_as_a_backup_mx_host/

In this tutorial I will show how you can set up a Postfix mailserver as a backup mail exchanger for a domain so that it accepts mails for this domain in case the primary mail exchanger is down or unreachable, and passes the mails on to the primary MX once that one is up again.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

I want to set up a backup MX for the domain example.com. In this example the primary MX for example.com is called mx1.example.com (IP address 1.2.3.4), so I call the backup MX mx2.example.com (IP address 1.2.3.5).

I have created MX records for example.com that look like this:

example.com.               86400   IN      MX      10 mx1.example.com.
example.com.               86400   IN      MX      20 mx2.example.com.

It's important that the primary MX has a lower number (10) and therefore a higher priority than the backup MX (20).

I'm assuming that the Postfix on mx2.example.com is already installed and working.

2 Configuring Postfix On mx2.example.com

To make mx2.example.com a backup MX for the domain example.com, all we have to do is change/add three lines to /etc/postfix/main.cf:

vi /etc/postfix/main.cf

First make sure that smtpd_recipient_restrictions contains permit_mynetworks and reject_unauth_destination, so something like this would be ok:

[...]
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
[...]

Then we must add example.com to the relay_domains paramater; if there's no relay_domains paramater yet in /etc/postfix/main.cf, the following will do:

[...]<br />relay_domains = $mydestination, example.com<br />[...]

And finally we add an empty relay_recipient_maps parameter to /etc/postfix/main.cf:

[...]<br />relay_recipient_maps =<br />[...]

(That way we don't have to specify a list of valid email addresses to back up, which might be a daunting task if you have to manage hundreds of email accounts.)

There's one important thing I have to add: You must not list example.com in the following parameters in /etc/postfix/main.cf:

• mydestination
• virtual_alias_domains
• virtual_mailbox_domains

That's it already. All we have to do now is restart Postfix:

/etc/init.d/postfix restart

3 Testing

To test the new backup MX, we take down the MTA (Postfix, Sendmail, Exim, etc.) on mx1.example.com and send an email from some remote server to an example.com account (e.g. someuser@example.com).

If you have access to the mail log on the remote (sending) server, you should now find something like this in it:

Jun 6 18:29:16 mail postfix/smtp[17746]: AF814144146: to=<someuser@example.com>, relay=mx2.example.com[1.2.3.5], delay=1, status=sent (250 2.0.0 Ok: queued as DCA5A1BF40F)

As you see, the mail has been sent to mx2.example.com instead of mx1.example.com because mx1.example.com is unreachable. Now, let's take a look at the mail log of mx2.example.com:

Jun 6 18:29:16 mx2 postfix/qmgr[3049]: DCA5A1BF40F: from=<falko@blabla.tld>, size=892, nrcpt=1 (queue active)
Jun 6 18:29:16 mx2 postfix/smtpd[3051]: disconnect from mail.blabla.tld[1.2.3.6]
Jun 6 18:29:16 mx2 postfix/smtp[3057]: connect to mx1.test1.de[1.2.3.4]: Connection refused (port 25)
Jun 6 18:29:16 mx2 postfix/smtp[3057]: DCA5A1BF40F: to=<someuser@example.com>, relay=none, delay=0.07, delays=0.03/0.02/0.01/0, dsn=4.4.1, status=deferred (connect to mx1.test1.de[1.2.3.4]: Connection refused)

mx2.example.com has accepted the mail and tried to connect to mx1.example.com to deliver it to the primary MX. Because the primary MX is down, mx2.example.com cannot deliver the mail and keeps it in the mailqueue until mx1.example.com is available again.

Now we start the MTA on mx1.example.com again. The backup MX will not immediately deliver the queued mail, but after some minutes you should see something like this in the mail log of mx2.example.com:

Jun 6 18:56:44 mx2 postfix/qmgr[3080]: DCA5A1BF40F: from=<falko@blabla.tld>, size=892, nrcpt=1 (queue active)
Jun 6 18:56:45 mx2 postfix/smtp[3083]: DCA5A1BF40F: to=<someuser@example.com>, relay=mx1.example.com[1.2.3.4]:25, delay=1648, delays=1648/0.09/0.4/0.12, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 167995B0109)

The mail has been delivered to the primary MX where you can see this in the mail log:

Jun 6 18:56:45 mx1 postfix/local[4963]: 167995B0109: to=<someuser@server1.example.com>, orig_to=<someuser@example.com>, relay=local, delay=0.54, delays=0.08/0.02/0/0.43, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail -f-)

So no mails were lost while mx1.example.com was down, and users can continue to retrieve their mails from mx1.example.com.

REFERENCE

http://www.howtoforge.com/postfix_backup_mx

Overview

The backup MX host must accept and queue mails, if the primary mailhost is down for a certain domain. To have a high degree of availability the backup MX host must be located outside the backed up domain. You can setup the backup MX host as a primary or secondary mx for a remote site.

The primary mailhost is down ...

Email is delivered to the backup MX host and queued there ....

After the primary mailhost is up and running again, email is delivered from the backup MX host to the primary mailhost and stored in the local mailboxes.

Setup of a primary mx host for a remote site

• DNS entry on the remote site:

IN MX 10 mail1.backup1.com.
IN MX 20 mail2.backup2.com.

All email for the remote site is delivered to the primary mx host: mail1.backup1.com.

• Postfix Configuration on backup1.com:

/etc/postfix/main.cf:

relay_domains = $mydestination the.backed-up.domain.name
smtpd_recipient_restrictions = permit_mynetworks
                               check_relay_domains

/etc/postfix/main.cf:

transport_maps = hash:/etc/postfix/transport

/etc/postfix/transport:

the.backed-up.domain.name smtp:[their.mail.host.name]

Setup of a secondary mx host for a remote site

• DNS entry on the remote site:

IN MX 10 mail1.backup1.com.
IN MX 20 mail2.backup2.com.

All email for the remote site is delivered to the secondary mx host: mail2.backup2.com.

• Postfix Configuration on backup2.com:

/etc/postfix/main.cf:

relay_domains = $mydestination the.backed-up.domain.name
smtpd_recipient_restrictions = permit_mynetworks
                               check_relay_domains

www.postfix.org/ADDRESS_...E.html#recipient

www.postfix.org/ADDRESS_...DME.html#caching

Configuring Postfix as primary or backup MX host for a remote site

This section presents additional configuration. You need to combine this with basic configuration information as discussed the first half of this document.

When your system is SECONDARY MX host for a remote site this is all you need:

 1 DNS:
 2     the.backed-up.domain.tld        IN      MX 100 your.machine.tld.
 3 
 4 /etc/postfix/<a href="http://www.postfix.org/postconf.5.html">main.cf</a>:
 5     <a href="http://www.postfix.org/postconf.5.html#relay_domains">relay_domains</a> = . . . the.backed-up.domain.tld
 6     <a href="http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = 
 7         <a href="http://www.postfix.org/postconf.5.html#permit_mynetworks">permit_mynetworks</a> <a href="http://www.postfix.org/postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
 8 
 9     # You must specify your NAT/proxy external address.
10     #<a href="http://www.postfix.org/postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
11 
12     <a href="http://www.postfix.org/postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = hash:/etc/postfix/relay_recipients
13 
14 /etc/postfix/relay_recipients:
15     user1@the.backed-up.domain.tld   x
16     user2@the.backed-up.domain.tld   x
17      . . .

When your system is PRIMARY MX host for a remote site you need the above, plus:

18 /etc/postfix/<a href="http://www.postfix.org/postconf.5.html">main.cf</a>:<br />19     <a href="http://www.postfix.org/postconf.5.html#transport_maps">transport_maps</a> = hash:/etc/postfix/transport<br />20 <br />21 /etc/postfix/transport:<br />22     the.backed-up.domain.tld       relay:[their.mail.host.tld]<br />

Important notes:

• Do not list the.backed-up.domain.tld in mydestination.

• Do not list the.backed-up.domain.tld in virtual_alias_domains.

• Do not list the.backed-up.domain.tld in virtual_mailbox_domains.

• Lines 1-7: Forward mail from the Internet for "the.backed-up.domain.tld" to the primary MX host for that domain.

• Line 10: This is a must if Postfix receives mail via a NAT relay or proxy that presents a different IP address to the world than the local machine.

• Lines 12-16: Define the list of valid addresses in the "the.backed-up.domain.tld" domain. This prevents your mail queue from filling up with undeliverable MAILER-DAEMON messages. If you can't maintain a list of valid recipients then you must specify "relay_recipient_maps =" (that is, an empty value), or you must specify an "@the.backed-up.domain.tld x" wild-card in the relay_recipients table.

• Line 22: The [] forces Postfix to do no MX lookup.

Specify dbm instead of hash if your system uses dbm files instead of db files. To find out what lookup tables Postfix supports, use the command "postconf -m".

Execute the command "postmap /etc/postfix/transport" whenever you change the transport table.

NOTE for Postfix < 2.2: Do not use the fallback_relay feature when relaying mail for a backup or primary MX domain. Mail would loop between the Postfix MX host and the fallback_relay host when the final destination is unavailable.

• In main.cf specify "relay_transport = relay",
• In master.cf specify "-o fallback_relay =" at the end of the relay entry.
• In transport maps, specify "relay:nexthop..." as the right-hand side for backup or primary MX domain entries.

These are default settings in Postfix version 2.2 and later.

According to RFC2821 the lowest-numbered records are the most preferred MX for domain. So I've a target Postfix backup server to keep the messages in a queue waiting for the primary server to become available. This ensures that if my primary MX goes down I do not loss any emails. However, spammers are connecting to my backup MX to avoid anti spam filters that are running on the primary MX server. This also hides their real IP from my primary MX. How do I configure anti-spam for my backup RHEL / CentOS 5.3 based Postfix mx server?

This is well known issue. Make sure your backup MX runs the same config in terms of spam rejection as your primary server. Try the following to improve backup eMail server anti spam configuration.

If the backup MX acts as a store-and-forward mail server

Consider the following example:

nixcraft.com.	86400	IN	MX 	10 mx01.nixcraft.net.in.
nixcraft.com.	86400	IN 	MX 	20 mx02.nixcraft.net.in.

nixcraft.com email handled by two email servers. mx02.nixcraft.net.in is your backup server. Open main.cf and append the following restrictions on mx02.nixcraft.net.in.

Only allow your own domain to accept email

Use relay_domains to relay email for two domain called nixcraft.com and cyberciti.com. Also, set lookup tables with all valid addresses in the domains that match $relay_domains i.e. only accept email for valid email address.
# vi /etc/postfix/main.cf
Modify settings as follows:

relay_domains = nixcraft.com, cyberciti.com, $mydestination<br />relay_recipient_maps = hash:/etc/postfix/relay_recipients

Create /etc/postfix/relay_recipients to accept email for vivek@nixcraft.com, vivek@cyberciti.com, user3@nixcraft.com and so on..

vivek@nixcraft.com   OK<br />vivek@cyberciti.com   OK<br />user3@nixcraft.com    OK

Save and close the file. Finally, update your db:
# postmap hash:/etc/postfix/relay_recipients

Anti spam via RBL

Now, add following lines main.cf to check spammer IP address using RBLs. Reject all email if they do not have a valid hostname or proper email address:

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks,<br />  reject_non_fqdn_hostname,<br />  reject_non_fqdn_sender,<br />  reject_non_fqdn_recipient,<br />  reject_unauth_destination,<br />  reject_unauth_pipelining,<br />  reject_invalid_hostname,<br />  reject_rbl_client zen.spamhaus.org<br /># helo required<br />smtpd_helo_required = yes<br /># disable vrfy command<br />disable_vrfy_command = yes<br /><br />smtpd_data_restrictions =<br />            reject_unauth_pipelining,<br />            permit<br />

Save and close the file. Restart / reload postfix:
# service postfix reload
There are other anti UCE settings, see Postfix anti UCE cheat sheet for more information.

Nolisting mx A entry

Spammers email software does not retry higher-priority MX records. So all you have to do is create a non-existent primary mail server and a working secondary mail server, attempts to contact the primary mail server will always fail. This technique uses a non-existent primary mail server, which is compatible with all correctly configured mail servers such as Sendmail, MS-Exchange, Postfix, Qmail, Exim etc. Create BIND dns configuration as follows:

nixcraft.com.	86400	IN	MX 	10 mx01.nixcraft.net.in.<br />nixcraft.com.	86400	IN 	MX 	20 mx02.nixcraft.net.in.<br />nixcraft.com.	86400	IN 	MX 	30 mx03.nixcraft.net.in.<br />nixcraft.com.	86400	IN 	MX 	40 mx04.nixcraft.net.in.

Where,

• mx02.nixcraft.net.in - Runs your actual primary MX with anti spam and anti virus configurations.
• mx03.nixcraft.net.in - Your backup mx server with anti spam / virus and act as store and forward server for mx02.nixcraft.net.in.
• mx01.nixcraft.net.in and mx04.nixcraft.net.in are nolist MX servers. They can either be dead (or point to non existing IP) or you can run SMTP on port 25 that always returns 4xx error so that legitimate MTA to retry on a lower numbered MX server. nolist MX servers can also used to get more information about spammers to blacklist them. Google for "spam filtering services that offer free nolist servers" specifically for botnet data harvesting.

Greylisting Backup MX

Postfix can be configured to temporarily reject any email from a sender it does not recognize. If the mail is legitimate, the originating server will try again and the email is accepted. If the mail is from a spammer it will probably not be retried since a spammer goes through thousands of email addresses and cannot afford the time delay to retry. See how to configure postfix greylist policy server.

Spamassassin+Amavis+Clamd For Backup MX Server

Spamassassin is open source mail filter, to identify spam using a wide range of heuristic tests on mail headers and body text. You can install Spamassassin spam checking on your backup server. Emails found to be Spam (with higher spam score) will be drop out before reaching your primary email server. You can also use Clamav / Amavis to scan email and drop or forward infected emails. Install spamassassin, clamd and amavisd-new using yum or apt-get commands (turn on EPEL repo under RHEL / CentOS to install the following packages):
# yum install clamav-server amavisd-new spamassassin

• clamav-server : Clam Antivirus scanner server
• amavisd-new : amavisd-new is a high-performance and reliable interface between Postfix and virus scanners, and/or
  Mail::SpamAssassin Perl module.
• spamassassin : Spam filter for email which can be invoked from mail delivery agents or in our case via amavisd-new

Once done, add as the following to your /etc/postfix/main.cf:

content_filter=smtp-amavis:[127.0.0.1]:10024

Save and close the file. Open /etc/postfix/master.cf and add the following settings:

smtp-amavis unix - - n - 2 smtp<br />  -o smtp_data_done_timeout=2400<br />  -o smtp_send_xforward_command=yes<br />  -o disable_dns_lookups=yes<br />  -o max_use=20<br />127.0.0.1:10025 inet n - n - - smtpd<br />  -o content_filter=<br />  -o local_recipient_maps=<br />  -o relay_recipient_maps=<br />  -o smtpd_restriction_classes=<br />  -o smtpd_delay_reject=no<br />  -o smtpd_client_restrictions=permit_mynetworks,reject<br />  -o smtpd_helo_restrictions=<br />  -o smtpd_sender_restrictions=<br />  -o smtpd_recipient_restrictions=permit_mynetworks,reject<br />  -o mynetworks_style=host<br />  -o mynetworks=127.0.0.0/8<br />  -o strict_rfc821_envelopes=yes<br />  -o smtpd_error_sleep_time=0<br />  -o smtpd_soft_error_limit=1001<br />  -o smtpd_hard_error_limit=1000<br />  -o smtpd_client_connection_count_limit=0<br />  -o smtpd_client_connection_rate_limit=0<br />  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings

Save and close the file. Also, update /etc/amavisd/amavisd.conf with required settings.

$daemon_user  = 'amavis';     # (no default;  customary: vscan or amavis), -u<br />$daemon_group = 'amavis';     # (no default;  customary: vscan or amavis), -g<br />$mydomain = 'nixcraft.net.in';   # a convenient default for other settings<br />$log_level = 1;              # verbosity 0..5, -d<br />$DO_SYSLOG = 1;              # log via syslogd (preferred<br />$inet_socket_port = 10024;   # listen on this local TCP port(s) (see $protocol)<br />$sa_tag_level_deflt  = -999;  # add spam info headers if at, or above that level<br />$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level<br />$sa_kill_level_deflt = 6.31; # triggers spam evasive actions<br />$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent<br />$virus_admin               = 'postmaster\@nixcraft.net.in';                    # notifications recip.<br />$mailfrom_notify_admin     = 'postmaster\@nixcraft.net.in';                    # notifications sender<br />$mailfrom_notify_recip     = 'postmaster\@nixcraft.net.in';                    # notifications sender<br />$mailfrom_notify_spamadmin = 'postmaster\@nixcraft.net.in';                    # notifications sender<br />$mailfrom_to_quarantine = 'postmaster\@nixcraft.net.in'; # null return path; uses original sender if undef<br />$sa_spam_subject_tag = '***SPAM*** ';<br />$myhostname = 'mx02.nixcraft.net.in';  # must be a fully-qualified domain name!<br />$notify_method  = 'smtp:[127.0.0.1]:10025';<br />$forward_method = 'smtp:[127.0.0.1]:10025';  # set to undef with milter!<br /># add your server public ip, private ip,<br />@inet_acl = qw( 203.1.2.3 127/8  10.10.29.11);<br />

Save and close the file. Update spamassassin settings in /var/spool/amavisd/:
# usermod -s /bin/bash amavis
# passwd amavis
# su - amavis
$ razor-admin -discover
$ razor-admin -create
$ razor-admin -register -l -user=vivek@nixcraft.co.in -pass=somePassword
$ cd .spamassassin
$ cp /usr/share/spamassassin/user_prefs.template user_prefs
$ exit
# usermod -s /sbin/nologin amavis
Update /etc/clamd.d/amavisd.conf as follows:

# Use system logger.<br />LogSyslog yes<br /><br /># Specify the type of syslog messages - please refer to 'man syslog'<br /># for facility names.<br />LogFacility LOG_MAIL<br /><br /># This option allows you to save a process identifier of the listening<br /># daemon (main thread).<br />PidFile /var/run/amavisd/clamd.pid<br /><br /># Remove stale socket after unclean shutdown.<br /># Default: disabled<br />FixStaleSocket yes<br /><br /># Run as a selected user (clamd must be started by root).<br />User amavis<br /><br /># Path to a local socket file the daemon will listen on.<br />LocalSocket /var/spool/amavisd/clamd.sock

Update /etc/mail/spamassassin/local.cf as follows:

required_hits 6.31<br />report_safe 1<br />rewrite_subject         0<br /># Enable the Bayes system<br />use_bayes               1<br /># Enable Bayes auto-learning<br />auto_learn              1<br />

Save and close the file. Finally, restart postfix and other services:
# service clamd.amavisd start
# service amavisd start
# service postfix restart
Turn services on boot:
# chkconfig clamd.amavisd on
# chkconfig amavisd on
# chkconfig postfix on
Now, check your /var/log/maillog for any errors or details:
# netstat -tulpn -A inet| egrep ':25|:1002?'
# tail -f /var/log/maillog
Above configuration will open the following ports on server:

1. 10024 - Amavisd
2. 10025 - Amavisd will communicate back the results to Postfix
3. 25 - SMTP Port

A note about same priority mx servers

You can point the mail servers, all with the same priority. It offers the following benfits:

• Load balancing
• Centralized user mail managment via LDAP or MySQL / PGSQL
• Centralized virus scanning
• Centralized Spam scanning

Sample dns records:

nixcraft.com.	86400	IN	MX 	10 mx01.nixcraft.net.in.<br />nixcraft.com.	86400	IN 	MX 	10 mx02.nixcraft.net.in.<br />nixcraft.com.	86400	IN 	MX 	10 mx03.nixcraft.net.in.<br />; imap server<br />imap		86400	IN 	A 	202.54.1.2<br />; pop3 server - can be CNAME too<br />pop3		86400	IN 	A 	202.54.1.2<br />

You may need additional servers inside your lan:

• MySQL/OpenLDAP (10.24.116.2) - Store user name, email, mailbox and other information.
• Central anti virus server (10.24.116.3) - Used by all your mx servers for scanning using TCP/IP. You can also do the same for spam scanning using TCP/IP.

Each mx server can use centralized anti spam and anti-virus server. Once scanned Postfix can deliver final mail which can be retrieved using POP3 / IMAP server.

Further Readings / References :

This FAQ assumed that you have working Postfix primary and backup server. It only covered anti spam related topics. For further details refer the following urls and respective man pages:

REFERENCE

http://www.cyberciti.biz/faq/postfix-backup-mx-server-anti-spam/

Step # 1 : Stop mysql service

Stopping MySQL database server: mysqld.

Step # 2: Start to MySQL server w/o password:

[1] 5988
Starting mysqld daemon with databases from /var/lib/mysql
mysqld_safe[6025]: started

Step # 3: Connect to mysql server using mysql client:

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1 to server version: 4.1.15-Debian_1-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

Step # 4: Setup new MySQL root user password

Step # 5: Stop MySQL Server:

Stopping MySQL database server: mysqld
STOPPING server from pid file /var/run/mysqld/mysqld.pid
mysqld_safe[6186]: ended

[1]+  Done                    mysqld_safe --skip-grant-tables

Step # 6: Start MySQL server and test it

Here is a simple command to auto repair, check and optimize all the tables in all databases running on a MySQL server:

#mysqlcheck -u root -p --auto-repair --check --optimize --all-databases

mysqlcheck is available in MySQL 3.23.38 and later.

mysqlcheck uses the SQL statements CHECK TABLE, REPAIR TABLE, ANALYZE TABLE, and OPTIMIZE TABLE in a convenient way for the user. It determines which statements to use for the operation you want to perform, and then sends the statements to the server to be executed. The exact operations are determined by the underlying storage engine used.

You must execute it on running database. It is recommended that you kill other incoming queries (like from your website) before running this which makes it a lot faster. I simply stop my httpd server before running it. You may want to use a Site Unavailable message instead so that the MySQL server is left alone.

REFERENCE

http://blog.taragana.com/index.php/archive/mysql-tip-how-to-check-repair-optimize-all-tables-in-all-databases/

If you're storing anything in MySQL databases that you do not want to lose, it is very important to make regular backups of your data to protect it from loss. This tutorial will show you two easy ways to backup and restore the data in your MySQL database. You can also use this process to move your data to a new web server.

• Back up From the Command Line (using mysqldump)
• Back up your MySQL Database with Compress
• Restoring your MySQL Database
• Backing Up and Restoring using PHPMyAdmin

Back up From the Command Line (using mysqldump)

Back up your MySQL Database with Compress

Restoring your MySQL Database

Backing Up and Restoring using PHPMyAdmin

It is assumed that you have phpMyAdmin installed since a lot of web service providers use it. To backup your MySQL database using PHPMyAdmin just follow a couple of steps:

• Open phpMyAdmin.
• Select your database by clicking the database name in the list on the left of the screen.
• Click the Export link. This should bring up a new screen that says View dump of database (or something similar).
• In the Export area, click the Select All link to choose all of the tables in your database.
• In the SQL options area, click the right options.
• Click on the Save as file option and the corresponding compression option and then click the 'Go' button. A dialog box should appear prompting you to save the file locally.

Restoring your database is easy as well as backing it up. Make the following:

• Open phpMyAdmin.
• Create an appropriately named database and select it by clicking the database name in the list on the left of the screen. If you would like to rewrite the backup over an existing database then click on the database name, select all the check boxes next to the table names and select Drop to delete all existing tables in the database.
• Click the SQL link. This should bring up a new screen where you can either type in SQL commands, or upload your SQL file.
• Use the browse button to find the database file.
• Click Go button. This will upload the backup, execute the SQL commands and re-create your database.

Dump a single table to a SQL file:

<code>mysqldump -uuser -ppassword dbName tableName > backup.sql</code>

If you want to get or restore a single table from a large MySQL dump file you can use the following methods:
Using AWK
Using Ruby
Using Perl:

</p><pre><code>#!/usr/bin/perl -wn<br />BEGIN {<br />  $table = shift @ARGV;<br />  $printing = 0;<br />}<br />$printing = 1 if /^create table $table\b/io;<br />exit if $printing && /^create table (?!$table)\b/io;<br /></code><code>print if $printing;</code><br /><br /><code>

Invocation:

REFERENCE

undef error - DBD::mysql::db selectrow_array failed: Table 'attach_data' is
marked as crashed and should be repaired [for Statement "SELECT LENGTH(thedata)
FROM attach_data WHERE id = ?"] at Bugzilla/Attachment.pm line 344
Bugzilla::Attachment::datasize('Bugzilla::Attachment=HASH(0x9df119c)') called

1. Identify all corrupted tables using myisamchk

# myisamchk /var/lib/mysql/bugs/*.MYI >> /tmp/myisamchk_log.txt

myisamchk: error: Wrong bytesec: 0-0-0 at linkstart: 18361936
MyISAM-table 'attach_data.MYI' is corrupted
Fix it using switch "-r" or "-o"
myisamchk: warning: 1 client is using or hasn't closed the table properly
MyISAM-table 'groups.MYI' is usable but should be fixed
myisamchk: warning: 1 client is using or hasn't closed the table properly
MyISAM-table 'profiles.MYI' is usable but should be fixed

Checking MyISAM file: user_group_map.MYI
Data records:     182   Deleted blocks:       0
- check file-size
- check record delete-chain
- check key delete-chain
- check index reference
- check data record references index: 1

2. Repair the corrupted table using myisamchk

# myisamchk -r profiles.MYI

- recovering (with sort) MyISAM-table 'profiles.MYI'
Data records: 80
- Fixing index 1
- Fixing index 2

3. Perform check and repair together for entire MySQL database

# myisamchk --silent --force --fast --update-state /var/lib/mysql/bugs/*.MYI

myisamchk: MyISAM file /var/lib/mysql/bugs/groups.MYI
myisamchk: warning: 1 client is using or hasn't closed the table properly
myisamchk: MyISAM file /var/lib/mysql/bugs/profiles.MYI
myisamchk: warning: 1 client is using or hasn't closed the table properly

• -s, --silent option: Prints only errors. You can use two -s to make myisamchk very silent.
• -f, --force option: Restart myisamchk automatically with repair option -r, if there are any errors in the table.
• -F, --fast option: Check only tables that haven’t been closed properly.
• -U --update-state option: Marks tables as crashed, when it finds any error.

4. Allocate additional memory for large MySQL database

# myisamchk --silent --force --fast --update-state \
--key_buffer_size=512M --sort_buffer_size=512M \
--read_buffer_size=4M --write_buffer_size=4M \
/var/lib/mysql/bugs/*.MYI

5. Use myisamchk to get information about a table

# myisamchk -dvv profiles.MYI

MyISAM file:         profiles.MYI
Record format:       Packed
Character set:       latin1_swedish_ci (8)
File-version:        1
Creation time:       2007-08-16 18:46:59
Status:              open,changed,analyzed,optimized keys,sorted index pages
Auto increment key:              1  Last value:                    88
Data records:                   88  Deleted blocks:                 0
Datafile parts:                118  Deleted data:                   0
Datafile pointer (bytes):        4  Keyfile pointer (bytes):        4
Datafile length:              6292  Keyfile length:              6144
Max datafile length:    4294967294  Max keyfile length: 4398046510079
Recordlength:                 2124

table description:
Key Start Len Index   Type                     Rec/key         Root  Blocksize
1   2     3   unique  int24                          1         1024       1024
2   5     765 unique  char packed stripped           1         2048       4096

Field Start Length Nullpos Nullbit Type
1     1     1
2     2     3                      no zeros
3     5     765                    no endspace

6. All myisamchk options

# myisamchk --help

• -s, --silent Only print errors. One can use two -s to make myisamchk very silent.
• -v, --verbose Print more information. This can be used with --description and --check. Use many -v for more verbosity.
• -V, --version Print version and exit.
• -w, --wait Wait if table is locked.

• -c, --check Check table for errors.
• -e, --extend-check Check the table VERY throughly. Only use this in extreme cases as myisamchk should normally be able to find out if the table is ok even without this switch.
• -F, --fast Check only tables that haven’t been closed properly.
• -C, --check-only-changed Check only tables that have changed since last check.
• -f, --force Restart with ‘-r’ if there are any errors in the table. States will be updated as with ‘--update-state’.
• -i, --information Print statistics information about table that is checked.
• -m, --medium-check Faster than extend-check, but only finds 99.99% of all errors. Should be good enough for most cases.
• -U --update-state Mark tables as crashed if you find any errors.
• -T, --read-only Don’t mark table as checked.

• -B, --backup Make a backup of the .MYD file as ‘filename-time.BAK’.
• --correct-checksum Correct checksum information for table.
• -e, --extend-check Try to recover every possible row from the data file. Normally this will also find a lot of garbage rows; Don’t use this option if you are not totally desperate.
• -f, --force Overwrite old temporary files.
• -r, --recover Can fix almost anything except unique keys that aren’t unique.
• -n, --sort-recover Forces recovering with sorting even if the temporary file would be very big.
• -p, --parallel-recover Uses the same technique as ‘-r’ and ‘-n’, but creates all the keys in parallel, in different threads.
• -o, --safe-recover Uses old recovery method; Slower than ‘-r’ but can handle a couple of cases where ‘-r’ reports that it can’t fix the data file.
• -q, --quick Faster repair by not modifying the data file. One can give a second ‘-q’ to force myisamchk to modify the original datafile in case of duplicate keys. NOTE: Tables where the data file is currupted can’t be fixed with this option.
• -u, --unpack Unpack file packed with myisampack.

• -a, --analyze Analyze distribution of keys. Will make some joins in MySQL faster. You can check the calculated distribution by using ‘--description --verbose table_name’.
• -d, --description Prints some information about table.

REFERENCE
http://www.thegeekstuff.com/2008/09/how-to-repair-corrupted-mysql-tables-using-myisamchk/