Lowe D. Networking For Dummies

Подождите немного. Документ загружается.

Book IX

Chapter 7

Running Sendmail

747

Modifying sendmail.mc

Enabling masquerading

Masquerading allows all the mail being sent from your domain to appear as

if it came from the domain (for example, wally@cleaver.net) rather than

from the individual hosts (like wally@wally.cleaver.net). To enable

masquerading, add lines similar to these:

MASQUERADE_AS(`cleaver.net’)dnl

FEATURE(masquerade_envelope)dnl

FEATURE(masquerade_entire_domain)dnl

MASQUERADE_DOMAIN(`cleaver.net’)dnl

Setting up aliases

An alias — also known as a virtual user — is an incoming e-mail address that

is automatically routed to local users. For example, you may want to create

a generic account such as sales@mydomain.com and have all mail sent to

that account delivered to a user named willie. To do that, you edit the file /

etc/mail/virtusers. This file starts out empty. To create a virtual user,

just list the incoming e-mail address followed by the actual recipient.

For example, here’s a virtusers file that defines several aliases:

sales@mydomain.com willie

bob@mydomain.com robert

marketing@mydomain.com robert

After you make your changes, you should restart the Sendmail service.

Don’t be an open relay!

An open relay is a mail server that’s configured

to allow anyone to use it as a relay for sending

mail. In short, an open relay sends mail when

neither the sender nor the recipient is a local

user. Spammers love open relays because they

can use them to obscure the true origin of their

junk e-mail. As a result, open relays are a major

contributor to the Internet spam problem.

Fortunately, the default configuration for the

current version of Sendmail (8.14) is to not

allow open relaying. As a result, you have to

go out of your way to become an open relay

with Sendmail. In fact, you’ll have to look up the

lines you’d need to add to sendmail.mc to

enable open relaying. I’m certainly not going to

list them here.

If you do need to allow relaying for specific

hosts, create a file named relay-domains

in /etc/mail. Then, add a line for each

domain you want to allow relaying for. This line

should contain nothing but the domain name.

Then restart Sendmail.

69_625873-bk09ch07.indd 74769_625873-bk09ch07.indd 747 9/21/10 10:47 PM9/21/10 10:47 PM

748

Using SpamAssassin

SpamAssassin is a spam-blocking tool that uses a variety of techniques to

weed the spam out of your users’ mailboxes. SpamAssassin uses a combina-

tion of rule filters that scan for suspicious message content and other telltale

signs of spam, as well as blacklists from known spammers. The following

sections explain how to install and use it.

Installing SpamAssassin

To configure SpamAssassin for basic spam filtering, follow these steps:

1. Ensure that Procmail is installed as your MDA.

In Fedora, Procmail is installed by default. To make sure it’s enabled,

open the file /etc/mail/sendmail.mc and make sure it includes the

following line:

FEATURE(local_procmail,`’,`procmail -t -Y -a $h -d $u’)

dnl

If this line is missing, add it and then restart Sendmail.

2. Ensure that the spamassassin daemon is running.

You can do that by choosing Applications➪System Settings➪Server

Settings➪Services and looking for spamassassin in the services list.

Or, at a console prompt, enter this command:

service spamassassin status

If SpamAssassin isn’t running, enter this command:

chkconfig -–level 35 spamassassin on

Whenever you make a configuration change, you should stop and restart

the service with this command:

service spamassassin restart

3. Create a file named procmailrc in the /etc directory.

Use gedit or your favorite text editor. The file should contain these two

lines:

:0fw

| /usr/bin/spamc

These lines cause Procmail to run all incoming mail through the

SpamAssassin client program.

69_625873-bk09ch07.indd 74869_625873-bk09ch07.indd 748 9/21/10 10:47 PM9/21/10 10:47 PM

Book IX

Chapter 7

Running Sendmail

749

Using SpamAssassin

4. Restart Sendmail and SpamAssassin.

You can do this from Applications➪System Settings➪Server

Settings➪Services, or you can enter these commands at a console

prompt:

service sendmail restart

service spamassassin restart

SpamAssassin should now be checking for spam. To make sure it’s working,

send some e-mail to one of the mailboxes on your system and then open the

mailbox file for that user in \var\mail and examine the message that was

sent. If the message headers include several lines that begin with X-Spam,

SpamAssassin is doing its job.

Customizing SpamAssassin

You can configure SpamAssassin by editing the configuration file /etc/

mail/spamassassin/local.cf. This file contains SpamAssassin rules

that are applied system wide, though you can override these rules for indi-

vidual users by creating a user_prefs file in each user’s $HOME/.spam

assassin directory.

In Fedora, the default local.cf file contains the following lines:

required_hits 5

report_safe 0

rewrite_header Subject [SPAM]

These lines cause SpamAssassin to add the word [SPAM] to the start of

the subject line for any message that scores 5 or higher on SpamAssassin’s

spam scoring algorithm.

Although you can configure SpamAssassin to automatically delete messages

that score above a specified value, most antispam experts recommend

against it. Instead, adding a word such as [SPAM] to the header lets each

user decide how he or she wants to handle spam by using a message filter

on his or her e-mail client that either deletes the marked messages or moves

them to a Spam folder.

No matter how you configure SpamAssassin, you will inevitably get some

false positives. For example, a long-lost friend who moved to Nigeria will

e-mail you a joke about Viagra using a Hotmail account. Odds are good that

SpamAssassin will mark this message as spam. That’s why arbitrarily delet-

ing messages marked as spam isn’t such a great idea, especially on a system-

wide basis. Better to simply mark the messages and then let your users

decide how to deal with the spam.

69_625873-bk09ch07.indd 74969_625873-bk09ch07.indd 749 9/21/10 10:47 PM9/21/10 10:47 PM

750

Using the Mail Console Client

Blacklisting and whitelisting e-mail addresses

SpamAssassin lets you blacklist or whitelist a specific e-mail address or an

entire domain. When you blacklist an address, any mail from the address will

automatically be blocked, regardless of the message contents. Conversely,

when you whitelist an address, all mail from the address will be allowed

through, even if the message would otherwise be blocked as spam.

Whitelisting is a powerful tool for making sure that the people you corre-

spond with on a regular basis don’t get their e-mail accidentally blocked by

SpamAssassin. As a result, it’s a good idea to add your friends, relatives, and

especially your customers to a whitelist.

Likewise, blacklisting lets you mark spammers who have managed to get

their spam into your system in spite of SpamAssassin’s best efforts to detect

their true intent.

To whitelist an address, add a line such as the following to /etc/mail/

spamassassin/local.rc:

whitelist_from wally@cleaver.com

This allows all mail from wally@cleaver.com to be delivered, even if the

mail might otherwise look like spam.

To blacklist an address, add a line like this:

blacklist_from auntida@myrelatives.com

This blocks all mail from your Aunt Ida.

Using the Mail Console Client

The most basic client for creating and reading e-mail is the mail command.

Although it doesn’t have many advanced features, it is fast. So some Linux

users like to use it for sending simple messages. (It is also sometimes used in

scripts.)

To read mail, open a command console, log on using the account whose

mail you want to read, and enter the command mail. A list of all messages

in your mailbox will be displayed. You can then use any of the commands

listed in Table 7-1 to work with the messages in the mailbox or compose new

mail messages.

69_625873-bk09ch07.indd 75069_625873-bk09ch07.indd 750 9/21/10 10:47 PM9/21/10 10:47 PM

Book IX

Chapter 7

Running Sendmail

751

Using the Mail Console Client

Table 7-1 Mail Commands

Command Explanation

Display a list of available commands.

Quit.

List the headers for all messages in the mailbox.

Type the next message.

t list Type the specified messages. For example, t 3 types message 3 and

t 4 5 types messages 4 and 5.

d list Deletes one or more messages. For example, d 4 deletes message 4.

R list

Reply to message sender.

r list

Reply to message sender and all recipients.

m user

Compose a new message addressed to the specified user.

To compose a new message from a command prompt, follow these steps:

1. Type mail followed by the e-mail address of the recipient.

For example:

mail wally@cleaver.com

Mail responds by prompting you for the subject.

2. Type the subject line and press Enter.

Mail then waits for you to enter the text of the message.

3. Type the message text. Use the Enter key to start new lines.

You can enter as many lines as you wish for the message.

4. Press Ctrl+D to finish the message.

The following prompt will appear:

Cc:

5. Enter one or more carbon copy addresses if you want others to

receive a copy. Otherwise, press Enter.

You’re done! The message is on its way.

69_625873-bk09ch07.indd 75169_625873-bk09ch07.indd 751 9/21/10 10:47 PM9/21/10 10:47 PM

752

Using Evolution

Evolution is a graphical e-mail client that’s similar in many ways to Microsoft

Outlook, as Figure 7-1 shows. It includes not only e-mail features, but also a

contact list, a calendar, a task manager, and other Outlook-like features.

Figure 7-1:

Evolution

looks a lot

like Outlook.

To start Evolution, click the E-Mail icon that’s located in the panel at the

top of the GNOME screen. The first time you run Evolution, a configura-

tion wizard will guide you through the necessary configuration. You need

to supply basic information about your e-mail account, such as your e-mail

address and the name of your mail server.

69_625873-bk09ch07.indd 75269_625873-bk09ch07.indd 752 9/21/10 10:47 PM9/21/10 10:47 PM

Chapter 8: Running FTP

In This Chapter

✓ Installing and starting the vsftpd server

✓ Configuring vsftpd

TP is one of the oldest and still most common methods for sending files

over the Internet. This chapter shows you how to install and configure

the basic FTP server that comes with most Linux distributions, Very Secure

FTP Daemon (vsftpd). For complete information about this server, visit the

official Web site at www.vsftpd.beasts.org.

If you need to access files from someone’s FTP site or need instructions on

setting up an FTP server on a Windows machine, please refer to Book IV,

Chapter 5.

Installing vsftpd

You can quickly find out whether vsftpd is installed on your system by

entering the following command from a shell prompt:

rpm -q vsftpd

If vsftpd has been installed, the package version is displayed. If not, the

message package vsftpd is not installed is displayed.

If vsftpd isn’t installed, you can install it by following these steps:

1. Choose System➪Administration➪Add/Remove Software.

This summons the Add/Remove Software program.

2. Type vsftpd in the search box and click Find.

This locates the vsftp package.

3. Select the package named Very Secure Ftp Daemon and click Apply.

The Add/Remove Software program installs the vsftp package.

4. Close the Add/Remove Software program.

The vsftp package is now installed.

70_625873-bk09ch08.indd 75370_625873-bk09ch08.indd 753 9/21/10 10:48 PM9/21/10 10:48 PM

754

Starting the vsftpd Service

After you’ve installed the vsftpd package, you can start the FTP service by

following these steps:

1. Choose System➪Administration➪Services.

This brings up the Service Configuration tool.

2. Select the vsftpd service.

You have to scroll through the list of services to find it.

3. Click the Start button.

4. Wait for the service to start.

It should take only a few seconds to start up. A dialog box confirming

that the service has started will appear.

Whenever you make a change to any of the vsftpd configuration files, you

should use the Service Configuration tool to restart the vsftpd service.

You can also start the vsftpd service from a terminal window by typing this

command:

/etc/init.d/vsftpd start

To restart the service, use this command:

/etc/init.d/vsftpd restart

Configuring FTP

You configure vsftpd though a configuration file named vsftpd.conf,

located in /etc. The default vsftpd.conf file is shown in Listing 8-1. You

can learn a lot about how vsftpd works simply by reading through this con-

figuration file.

Listing 8-1: The vsftpd.conf File

# Example config file /etc/vsftpd.conf

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

70_625873-bk09ch08.indd 75470_625873-bk09ch08.indd 754 9/21/10 10:48 PM9/21/10 10:48 PM

Book IX

Chapter 8

Running FTP

755

Configuring FTP

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd’s

# capabilities.

# Allow anonymous FTP? (Beware - allowed by default if you comment this out.)

anonymous_enable=YES

# Uncomment this to allow local users to log in.

#local_enable=YES

# Uncomment this to enable any form of FTP write command.

#write_enable=YES

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that. (022 is used by most other ftpd’s.)

#local_umask=022

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

# Activate logging of uploads/downloads.

xferlog_enable=YES

# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using “root” for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

# You may override where the log file goes if you like. The default is shown

# below.

#xferlog_file=/var/log/vsftpd.log

# If you want, you can have your log file in standard ftpd xferlog format.

#xferlog_std_format=YES

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

(continued)

70_625873-bk09ch08.indd 75570_625873-bk09ch08.indd 755 9/21/10 10:48 PM9/21/10 10:48 PM

756

Configuring FTP

Listing 8-1

(continued)

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

#async_abor_enable=YES

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command ”SIZE /big/file” in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

#ascii_upload_enable=YES

#ascii_download_enable=YES

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd.banned_emails

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd.chroot_list

# You may activate the ”-R” option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as ”ncftp” and ”mirror” assume

# the presence of the ”-R” option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

You can edit this file via the text editor. (Choose Applications➪Accessories➪

Text Editor.) After you save your changes, you’ll need to restart the vsftpd

service for the changes to take effect, as described in the previous section.

The following paragraphs describe some of the more common modifications

to the vsftpd.conf file:

✦ Anonymous access: By default, anonymous access is allowed. To pre-

vent users from accessing the FTP site anonymously, change the anon-

ymous_enable line to:

anonymous_enable=NO

70_625873-bk09ch08.indd 75670_625873-bk09ch08.indd 756 9/21/10 10:48 PM9/21/10 10:48 PM