Email On FreeBSD Part 1
Email On FreeBSD Part 1
1 (part 1)
Introduction
This article will cover the steps involved in setting up a highly secure email server using FreeBSD, Postfix,
Cyrus-imap (SSL), Squirrelmail (webmail), ClamAV and Spamassain. The mail host will be able to host
virtual domains, and virtual users backed by a MySQL database.
All required information will be covered from installing and hardening FreeBSD with ipfw, installing
packages from the venerable ports system, understanding the role DNS plays in email to securing Postfix and
configuring ClamAV and Spamassain for anti-virus and spam filtering.
This is the first part of a two part series. This first part will cover the history and origins of FreeBSD,
installation and configuration of the base system, updating and installing packages from ports, and securing
the system with ipfw2. The second part will cover configuring Postfix, MySQL, and Cyrus-imap over SSL,
configuring ClamAV and Spamassain for anti-virus and spam filtering, and Squirrelmail over Apache SSL for
secure web mail when you are away from your computer.
Mail Transfer Agent (MTA): this is the email “server”. Postfix (discussed in the second article) is an MTA,
other (in)famous MTAs are Sendmail and qmail. The MTA works behind the scenes accepting mail for users
it is in charge of, and forwarding mail to other MTAs.
Mail User Agent (MUA): this is the client that users typically interact with. Mozilla-Thunderbird and
Microsoft Outlook are MUAs. Mail User Agents send emails to MTAs which then either deliver them to
Introduction 1
Secure email servers from scratch with FreeBSD 6.1 (part 1)
Mail exchanger (MX): is the terminology used by DNS, the system that resolves IP numbers to human
readable host names. In the DNS configuration there is a special entry for email servers that sets the priority of
the email, which is used when there are multiple email servers and one stops responding, and the name of the
email server itself.
In the early ’90s Novell, which had purchased the IP rights to AT&T’s UNIX System, sued the University of
California for patent infringement. It was around this time that Linus Torvalds released the initial Linux
kernel, and the rest was history. Novell and The University of California eventually settled. It was agreed that
certain parts of the code base, then called 4.4BSD, were encumbered. The University of California removed
the tainted code and released the 4.4BSD-Lite operating system; however large parts of it were removed, and
a bootable, working version for intel processors was not available.
In 1993, development of 386BSD seemed to have stagnated, and there was a growing back log of patches that
Lynne and William Jolitz, the original creators of the project were not merging into the main code base.
Eventually, a group of developers including Jordan Hubbard, decided that the project was worth continuing on
its own, even without the support of Jolitz. In December of 1993 the FreeBSD project released its 1.0 version.
The name “FreeBSD” was coined by David Greenman. This initial release was still based on the encumbered
4.4BSD-Net/2 distribution; it wasn’t until FreeBSD 2.0 that FreeBSD was free of patented intellectual
property. The rest is history.
While Linux took the (free software) world by storm, FreeBSD was still recovering lost mindshare from the
doubt and uncertainty cast by the Novell law suit
FreeBSD sports a new multi-threaded file system that increases performance on systems such as email
and database servers
What’s new
The 6.0 branch represents a mixture of stabilizing features introduced in the 5.x branch and some new
features. The 5.x branch introduced a new scheduler called “ULE” around the same time the linux 2.6 kernel
What’s new 2
Secure email servers from scratch with FreeBSD 6.1 (part 1)
introduced the new anticipatory scheduler. A very new and exciting feature is a multi-threaded SMP safe file
system layer, which offers greatly enhanced performance for I/O bound systems such as database and email
servers. In this release the ULE scheduler has been marked as safe for SMP systems.
The same line should be entered in the /boot/loader.conf file (after the installation) to prevent the
USB peripherals from not working after the install: hint.atkbd.0.flags="0x1".
The 6.1 installer starts off with a new country selection screen (figure 2) which wasn’t present in previous
versions.
The next screen (figure 3) was the first screen in previous versions. From here you should select “Standard” to
begin the normal installation process.
You will then be presented with the partition information; it is advisable to simply hit “a” and have the
installer automatically create the FreeBSD partition for you, and then “q” to quit and move on to the next
screen. If you have already created a partition and want to change its type, FreeBSD’s partition type is “165”.
FreeBSD uses a more traditional UNIX-like partition layout than Linux does. The FreeBSD model favors
many partitions, one each for /, swap, /tmp, /var, /usr, and optionally /usr/local and /home. The
preferred partitioning scheme on GNU/Linux distributions consists of three partitions, one for /, one for
swap and one for /boot. Both have their advantages; the GNU/Linux scheme is more flexible and doesn’t
require prior knowledge of which directory is likely to grow the most and thus need the most space. The
FreeBSD model is inherently more secure and granular, and is the model I prefer.
Note: UFS2 was introduced during the 5.x cycle, and is still relatively new. As such it isn’t supported by Grub
yet. If you wish to use Grub as your boot loader, select UFS1 (do this by using the arrows to navigate to the /
partition) and hit “1”. UFS2 is an major upgrade to BSD’s standard “Unix File System”. UFS2 supports,
among other things, 64 bit file pointers allowing the file system to grow past 1 Tera-Byte in size.
Although this article is about configuring an email server, for users interested in dual booting FreeBSD along
with GNU/Linux simply use the following lines in grub.conf (or menu.lst) assuming the /root
partition has been formatted with UFS1:
informing you that the installation is complete; if necessary, you can re-enter the installation utility at any
time by typing /usr/sbin/sysinstall. The installer will then guide you through the final configuration
process to determining whether or not you will be using this system as a network gateway, SSH server, NFS
server or client, and also whether or not you would like to add users and groups to the system.
After all of that, the time zone configuration process begins; this is the last really involved configuration step.
You should say yes to configuring the time zone, and then probably no when the installer asks if the machines
time is based on UTC. Select your region, your country, and finally your time zone.
You will then be asked if the system has PS/2, serial or bus mouse. Answer according to your system, but
chances are no will be fine for your configuration.
Next, the installer will ask you if you want to install any software from the ports system. Select no: the ports
that come with install CD are out of date by the time you have downloaded them. We will update the ports
system to reflect the latest and greatest later. You will then be asked if you want to setup users and groups,
select no, it’s easier to have all the user-friendly shells, such as bash installed first and then use sysinstall to
configure new users. Next, the installer will ask you to enter the root password; this should be secure,
although it is easy enough to change the password later using the passwd utility. You will then be presented
with your last chance to change any of the configuration options. Select no, and then exit the installer.
The system will then automatically reboot. The first time the system boots you will be prompted to enter some
random text on the keyboard. This is to generate the entropy used to generate the systems SSH keys. It is
important that you hit a wide number of keys, with varying cadence so that the entropy is appropriately
random.
That’s it! You have successfully installed the FreeBSD operating system.
FreeBSD was used for Hotmail’s email service before the company was acquired by Microsoft
Packages
FreeBSD packages are binary files recognizable by the extension .tbz. The most common command you
will use when dealing with packages is pkg_add "packagename". Other useful commands are
pkg_info, pkg_version and pkg_deinstall.
pkg_info with no arguments will show you the version of every package installed. pkg_info
zip-2.31 will show the information of the zip program installed on your system. pkg_info
diablo-jdk-freebsd6-1.5.0.06.00.tbz will show you the information for the FreeBSD native
jdk waiting to be installed.
pkg_version will display the relative version of packages installed versus what’s available via ports.
pkg_deinstall takes the short name of the package, and will remove it. Here, the package name to be
used is the one displayed by pkg_info or pkg_version.
Ports
FreeBSD ports are compiled from source into the binary packages mentioned above, and then installed. The
ports tree, or location of ports files is /usr/ports, which contains a number of categorized subdirectories.
Ports are basically make files with a little FreeBSD magic that contain the location of the files to download
and their version. The Makefile in each directory includes a global make file
/usr/ports/Mk/bsd.port.mk that contains the macros for downloading and unpacking files; so,
installing ports is as easy as changing directories to the port and typing make install && make
clean. FreeBSD ports are managed via CVS, but there are a variety of wrapper tools such as cvsupdate
and portupgrade to automate routine tasks like updating ports and upgrade any packages.
When installing software from the ports tree you will often be presented with compile time options that affect
the behavior of the package. One common way to specific options is with the -D option to make; for example
to compile subversion without BDB support you would type make -DWITHOUT_BDB install &&
make clean.
Now that you have some background on FreeBSD’s package management options, it’s time to get started and
install some useful software. The first thing you need to do is make sure our ports are current and update any
outdated packages; the first two packages you will install are cvsupdate and portupgrade (in that
order). cvsupdate is used to update the ports tree with the CVS repository stored on the FreeBSD servers,
and portupgrade is an automated tool that upgrades packages.
• cd /usr/ports/net/cvsup-without-gui
• make install && make clean (this will install cvsup and clean up all the temporary files)
• Create a directory for the cvsup config file: mkdir /root/config/cvsup
• cp /usr/share/examples/cvsup/stable-supfile /root/config/cvsup
• edit /root/config/cvsup/stable-supfile (See text box)
• From /root/config/cvsup type cvsup -g -L 2 stable-supfile
• cd /usr/ports/sysutils/portupgrade
cvsup
cvsup has a simple configuration file that must be passed as a parameter. The example files in
/usr/share/examples are pretty self-explanatory; however, the key points of configuration are the
update server, what to update, and the version to update to.
default host should be set to the nearest cvsup mirror. The FreeBSD handbook (Google: freebsd cvsup
mirrors) has a list of mirrors in different countries.
default release=cvs tag=RELENG_6 this line should remain unchanged; it affects the version of
source code to be synced and downloaded to /usr/src, not the ports that we will be installing.
The default file has a line that reads src-all: it instructs cvsup to synchronize all the source code packages;
however, you also want to update the ports and documentation packages; so, you must add the following two
lines:
ports-all tag=.
doc-all tag=.
Sysinstall
Now that you have a fully updated system, it would be a good time to add a new user. FreeBSD’s
configuration utility, which is also used during the install process, is called sysinstall. To use it simply type
/usr/sbin/sysinstall. You will then be presented with the text based interface: simply select
configure and user management for guided user management.
You should now have a fully up to date system, with the tools to repeat the process at a later date. It’s now
time to install some more software that will lay the ground work for configuring your email server
FAMP—FreeBSD-Apache-MySQL-PHP
The best aspect of installing via ports is that it resolves dependencies much like Debian’s apt. Installing the
latest version of Apache is a breeze: simply change directories (cd) to /usr/local/www/apache22 and
type make install && make clean.
Next install the php5 package from /usr/ports/lang/php5. After typing make install you will
be prompted with an text based menu: you must select one of the options Apache Module and enable it by
hitting the space bar
Ports 10
Secure email servers from scratch with FreeBSD 6.1 (part 1)
The name of the kernel config file is not enough to distinguish it from other kernel configuration files; instead
the IDENT line must be changed to reflect the name you choose for your configuration, MYKERNEL in this
particular case (for this article).
To build and install the kernel with your custom config, simply change directories to /usr/src and invoke
make buildkernel KERNCONF=MYKERNEL. The command to install the newly built kernel is similar:
make installkernel KERNCONF=MYKERNEL.
# Scheduler Options
#options SCHED_ULE # ULE scheduler
options SCHED_4BSD # 4BSD scheduler (This is the classic scheduler)
cd /usr/src
make buildkernel KERNCONF="KERN_LABEL"
make installkernel KERNCONF="KERN_LABEL"
FreeBSD services
Now that you have some of the key software packages in place, let’s take a look at how FreeBSD manages
daemons. FreeBSD uses a simple, single run-level system controlled by a handful of text files, with
/etc/rc.conf at the center of it all. Unlike most GNU/Linux, which rely on the AT&T SysV startup
system (which is a series of symlinks to various directories that relate to various runlevels), a single one line
entry in /etc/rc.conf will determine if a daemon is started when the system boots up.
FreeBSD services 11
Secure email servers from scratch with FreeBSD 6.1 (part 1)
For example: apache22_enable="YES" will obviously enable Apache 2.2.x at system start-up.
FreeBSD’s default firewall ipfw2 is also started via the /etc/rc.conf file. Here’s what your rc.conf
file should look like:
cron_enable="YES"
firewall_enable="YES"
firewall_logging="YES"
apache22_enable="YES"
apache22_flags=""
mysql_enable="YES"
mysql_dbdir="/var/db/mysql"
mysql_args="--user=mysql"
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
amavisd_enable="YES"
ipfw2 has a rich feature set and a full discussion on its configuration is beyond the scope of this article. This is
the quick and dirty, annotated configuration that is applicable to your setup in the context of an email/webmail
server.
ipfw2 rule files always follow a very simple syntax: directive order type from HOST to HOST
port_number via interface optional_state_setting.
Conclusion
FreeBSD is an incredibly powerful and robust operating system worth giving serious consideration for
projects that require a rock solid OS. So legendary is FreeBSD’s robustness that it was used by Hotmail in the
early days before it was acquired by Microsoft. You should now have a fresh and updated FreeBSD install to
continue your journey with. This article was all about taking the first steps with FreeBSD, and learning a little
bit of the history along the way. The following article will focus on configuring the email, and web servers
such as Postfix, Apache and Squirrelmail to handle multiple domains, users, giving users access to their email
via the web and protecting ourselves against spam and viruses. Hope to see you soon!
Biography
Yousef Ourabi (/user/43" title="View user profile.): Yousef Ourabi (http://yousefourabi.com) is a developer in
the San Francisco bay area. He is currently working at the startup he recently founded, Zero-Analog
Copyright information
Verbatim copying and distribution of this entire article is permitted in any medium without royalty provided
this notice is preserved.
Source URL:
http://www.freesoftwaremagazine.com/articles/secure_email_server_bsd_part_1
Biography 14