krypted.com

Tiny Deathstars of Foulness

Mail is one of the hardest services to manage. Actually, mail is pretty simple in and of itself: there’s protocols people use to access their mail (such as IMAP and POP), protocols used to communicate between mail servers and send mail (SMTP, SMTPS) and then there’s a database of mail and user information. In OS X Server 5 for El Capitan and Yosemite, all of these are represented by a single ON button, so it really couldn’t be easier. But then there’s the ecoysystem and the evil spammers.

As a systems administrator of a large number of mail servers, I firmly believe that there is a special kind of hell where only spam is served at every meal for spammers. Here, the evil spammers must also read every piece of spam ever sent for eternity. By the end (aka Ragnarok), they should have the chemically induced stamina of a 16 year old with the latest Sports Illustrated Swimsuit issue, enough pills of other types to not be able to use that stamina, plenty of African princes looking to donate large sums of money if only they can be helped out of their country (which should cost about 100,000 compared to a 5,000,000 payout, not a bad ROI, right?!?!?), have their conflicting stamina situation at the top of the search engines and of course, have lost all of the money made from their African princes due to getting their credit card hijacked by about 9,000 phishing scams. All in all, a special kind of hell…

But back to the point of the article, setting up mail. The things that mail administrators need to focus on to keep that mail server flowing mail to and from everyone else in the world:

  • Static IP address. The WAN (and LAN probably) address should be static.
  • Port Forwards. Port forwards need to be configured on the gateway for the SMTP port at a minimum and more than likely other ports used to access mail on client devices (25, 143, etc)
  • DNS records. An MX record and some kind of mail.domain.com type of record should definitely be configured for the DNS servers that are authoritative for the domain. There should also be reverse records for the address of the server, usually created by the Internet Services Provider, or ISP, that match that record.
  • Check the RBLs. If you have a new IP address you’ll be putting a DNS server on, check all the major Realtime BlackLists to make sure that some evil spammer hasn’t squatted on the IP before you got to it. This is true whether you’re in a colo, hosted on an IP you own or moving into space formerly occupied by a very standup company. A lot of IP addresses are blocked, as are blocks of IPs, so before moving mail to an IP, check it.
  • Mail filtration (message hygiene). OS X Server has a number of mail filters built in, including clam for viruses, the ability to leverage RBLs, block specific addresses and of course RBL checking. However, this is often not enough. Third party services such as MXLogic help to keep mail from coming into your network. You also end up with an external IP to send mail that can cache mail in the event the server is down and keep mail off your network in the event that it’s spam.
  • Backup. I am firmly of the belief that I’d rather not have data than not have that data backed up…

Once all of that is taken care of (I’ll add more as I think about it) then it’s time to enable the mail service in the Server app running on Yosemite. Actually, first let’s setup our SSL certificates. To do so, open the Server app and click on Certificates in the SERVER section of the sidebar. Here, use the “Secure services using” drop-down list and click on Custom… for each protocol to select the appropriate certificate to be used for the service.

Screen Shot 2015-09-22 at 11.16.20 PM

Click OK when they’re all configure. Now let’s enable the mail service (or outsource mail). To do so, open the Server app and click on Mail in the SERVICES list in the sidebar.

Mail2

At the configuration screen is a sparse number of settings:

  • Domains: Configures all of the domains the mail server will listen for mail for. Each account on the server has a short name and each domain name will be available for each short name. For example, an account with a shortname of charles will be available for email addresses of charles@pretendco.com and charles@krypted.com per the Domain Name listing below.Screen Shot 2015-09-22 at 11.17.27 PM
  • Authentication: Click Edit for a list of sources that accounts can authenticate against (e.g. Active Directory, Open Directory, Custom, Local, etc) and in some cases the specific password algorithms used for mail.Screen Shot 2015-09-22 at 11.18.12 PM
  • Push Notifications: If Push is configured previously there’s no need to use this option. Otherwise, use your institutional APNS account to configure Push Notifications.Screen Shot 2015-09-22 at 11.18.44 PM
  • Relay outgoing mail through ISP: Provide a server that all mail will get routed through from the server. For example, this might be an account with your Internet Services Provider (ISP), an account on an appliance that you own (such as a Barracuda) or with an external filtering service (such as MXLogic).Screen Shot 2015-09-22 at 11.19.42 PM
  • Limit mail to: Configure the total amount of mail a user can have in the mail store, in Megabytes.
  • Edit Filtering Settings: Configure antivirus, spam assassin and junk mail filters. The “Enable virus filtering” checkbox enables clam. The “Enable blacklist filtering” checks the RBL (or RBLs) of your choice to check whether a given server is a “known” spammer and the “Enable junk mail filtering” option enables spam assassin on the host, configuring it to block based on a score as selected using the slider.

Once you’ve configured the settings for the Mail service, click on the ON slider to enable the service. At this point, you should be able to telnet into port 25 of the host to verify that SMTP is listening, preferably from another mail server:

telnet mail.krypted.com 25

You can also check that the mail services are running using the serveradmin command along with the fullstatus option for the mail service:

sudo serveradmin fullstatus mail

Which returns with some pretty verbose information about the service, including state, connections, running protocols and the rest of the following:

mail:startedTime = ""
mail:setStateVersion = 1
mail:state = "STOPPED"
mail:protocolsArray:_array_index:0:status = "ON"
mail:protocolsArray:_array_index:0:kind = "INCOMING"
mail:protocolsArray:_array_index:0:protocol = "IMAP"
mail:protocolsArray:_array_index:0:state = "STOPPED"
mail:protocolsArray:_array_index:0:service = "MailAccess"
mail:protocolsArray:_array_index:0:error = ""
mail:protocolsArray:_array_index:1:status = "ON"
mail:protocolsArray:_array_index:1:kind = "INCOMING"
mail:protocolsArray:_array_index:1:protocol = "POP3"
mail:protocolsArray:_array_index:1:state = "STOPPED"
mail:protocolsArray:_array_index:1:service = "MailAccess"
mail:protocolsArray:_array_index:1:error = ""
mail:protocolsArray:_array_index:2:status = "ON"
mail:protocolsArray:_array_index:2:kind = "INCOMING"
mail:protocolsArray:_array_index:2:protocol = "SMTP"
mail:protocolsArray:_array_index:2:state = "STOPPED"
mail:protocolsArray:_array_index:2:service = "MailTransferAgent"
mail:protocolsArray:_array_index:2:error = ""
mail:protocolsArray:_array_index:3:status = "ON"
mail:protocolsArray:_array_index:3:kind = "OUTGOING"
mail:protocolsArray:_array_index:3:protocol = "SMTP"
mail:protocolsArray:_array_index:3:state = "STOPPED"
mail:protocolsArray:_array_index:3:service = "MailTransferAgent"
mail:protocolsArray:_array_index:3:error = ""
mail:protocolsArray:_array_index:4:status = "OFF"
mail:protocolsArray:_array_index:4:kind = "INCOMING"
mail:protocolsArray:_array_index:4:protocol = ""
mail:protocolsArray:_array_index:4:state = "STOPPED"
mail:protocolsArray:_array_index:4:service = "ListServer"
mail:protocolsArray:_array_index:4:error = ""
mail:protocolsArray:_array_index:5:status = "ON"
mail:protocolsArray:_array_index:5:kind = "INCOMING"
mail:protocolsArray:_array_index:5:protocol = ""
mail:protocolsArray:_array_index:5:state = "STOPPED"
mail:protocolsArray:_array_index:5:service = "JunkMailFilter"
mail:protocolsArray:_array_index:5:error = ""
mail:protocolsArray:_array_index:6:status = "ON"
mail:protocolsArray:_array_index:6:kind = "INCOMING"
mail:protocolsArray:_array_index:6:protocol = ""
mail:protocolsArray:_array_index:6:state = "STOPPED"
mail:protocolsArray:_array_index:6:service = "VirusScanner"
mail:protocolsArray:_array_index:6:error = ""
mail:protocolsArray:_array_index:7:status = "ON"
mail:protocolsArray:_array_index:7:kind = "INCOMING"
mail:protocolsArray:_array_index:7:protocol = ""
mail:protocolsArray:_array_index:7:state = "STOPPED"
mail:protocolsArray:_array_index:7:service = "VirusDatabaseUpdater"
mail:protocolsArray:_array_index:7:error = ""
mail:logPaths:Server Error Log = "/Library/Logs/Mail/mail-err.log"
mail:logPaths:IMAP Log = "/Library/Logs/Mail/mail-info.log"
mail:logPaths:Server Log = "/Library/Logs/Mail/mail-info.log"
mail:logPaths:POP Log = "/Library/Logs/Mail/mail-info.log"
mail:logPaths:SMTP Log = "/var/log/mail.log"
mail:logPaths:List Server Log = "/Library/Logs/Mail/listserver.log"
mail:logPaths:Migration Log = "/Library/Logs/MailMigration.log"
mail:logPaths:Virus Log = "/Library/Logs/Mail/clamav.log"
mail:logPaths:Amavisd Log = "/Library/Logs/Mail/amavis.log"
mail:logPaths:Virus DB Log = "/Library/Logs/Mail/freshclam.log"
mail:imapStartedTime = ""
mail:postfixStartedTime = ""
mail:servicePortsRestrictionInfo = _empty_array
mail:servicePortsAreRestricted = "NO"
mail:connectionCount = 0
mail:readWriteSettingsVersion = 1
mail:serviceStatus = "DISABLED"

To stop the service:

sudo serveradmin stop mail

And to start it back up:

sudo serveradmin start mail

To configure some of the settings no longer in the GUI from previous versions, let’s look at the full list of options:

sudo serveradmin settings mail

One that is commonly changed is the subject line added to messages that are marked as spam by spam assassin. This is stored in mail:postfix:spam_subject_tag, so changing would be:

sudo serveradmin settings mail:postfix:spam_subject_tag = "***DIEEVILSPAMMERSDIE*** "

A number of admins also choose to disable greylisting, done using the mail:postfix:greylist_disable option:

sudo serveradmin settings mail:postfix:greylist_disable = no

To configure an email address for quarantined mail to go, use mail:postfix:virus_quarantine:

sudo serveradmin settings mail:postfix:virus_quarantine = "diespammersdie@krypted.com"

The administrator, by default, doesn’t get an email when an email containing a file infected with a virus is sent through the server. To enable this option:

sudo serveradmin settings mail:postfix:virus_notify_admin = yes

I also find a lot of Mac environments want to accept email of pretty much any size. By default, message size limits are enabled. To disable:

sudo serveradmin settings mail:postfix:message_size_limit_enabled = yes

Or even better, just set new limit:

sudo serveradmin settings mail:postfix:message_size_limit = 10485760

And to configure the percentage of someone’s quota that kicks an alert (soft quota):

sudo serveradmin settings mail:imap:quotawarn = 75

Additionally, the following arrays are pretty helpful, which used to have GUI options:

  • mail:postfix:mynetworks:_array_index:0 = “127.0.0.0/8″ – Add entries to this one to add “local” clients
  • mail:postfix:host_whitelist = _empty_array – Add whitelisted hosts
  • mail:postfix:blacklist_from = _empty_array – Add blacklisted hosts
  • mail:postfix:black_hole_domains:_array_index:0 = “zen.spamhaus.org” – Add additional RBL Servers

The client side of the mail service is straight forward enough. If you are wondering where in this article we discuss using webmail, er, that’s not installed by default any longer. But the open source project previously used, roundcube, is still available for download and easily installed (the pre-reqs are all there, already). Check out the roundcube wiki installation page here for more info on that. Also, mail groups. I hope to have a post about that soon enough. Unless, of course, I get sidetracked with having a life. Which is arguably not very likely…

September 24th, 2015

Posted In: Mac OS X Server

Tags: , , , , , , , , , , , , ,

  • russwittmann

    How are the commands used?

    mail:postfix:host_whitelist = _empty_array – Add whitelisted hosts
    mail:postfix:blacklist_from = _empty_array – Add blacklisted hosts

    I can’t seem to get a domain blacklist going and my server is being pummeled with emails from a goliathtech.com address.

    Thanks

  • I would like to split my mail server (Server 5) onto a separate mac-mini and take the load off of my web server (also a Mac mini Server 5). Suggestions?

  • Ard

    Krypted, thanks a lot for these helpful pages. One of the sort of UI options that are gone in Server5, but you did not mention, is a catchall e-mail address. We used to be able to accomplish a catch-all through an “@example.com” line in the e-mail address list of the user that would receive all e-mails addressed to non-existent users. Although Apple apparently thinks we don’t want to be bothered by spam delivered to our domains, I’d beg to differ and sift through junk mail to discover gems I have missed.
    Any hints on how to bring back the catch all e-mail solution?

  • Ard

    never mind, Charles beat you to it 😉 : http://charlesgutjahr.com/tech/2015/11/22/os-x-server-mail-catchall.html It’s actually very simple once you know it, but that’s often the case.

  • jesus aladobe

    I’d like to use Mail services only for Calendar invitations etc. Any best practices to enable it just for that purpose?

  • joshua

    I am desperately trying to find a simple way to set up a server side rule that says “when x user sends email, automatically add z user as a BCC” so that every single time this user sends an email from their account, it copies another user

    There has got to be a simple or transparent way to issue a command that does this, right?

    • joshua

      True that OS X uses postfix, and you’ll find plenty of documentation on the topic.

      But……. Most
      tutorials will have you running the wrong binaries (not those compiled
      for OS X Server app) and editing config files OS X Server doesn’t use.

      Best to use directions specific to OS X Server.

      OS X Server: How to setup sender_bcc_maps

      1. Create the text file which stores the sender bcc maps.

      Use whatever method you prefer to create this file. Here is an example using pico in Terminal

      sudo pico /Library/Server/Mail/Config/postfix/sender_bcc

      The file may contain one more more maps with one or more spaces in between the sender and bcc_map.

      It should like this:

      sender@example.com bcc@example.com

      anothersender@example.com bcc@example.com

      When done, use ctrl-x to exit and hit y to save

      2. Run postmap anytime you edit the sender_bcc file

      sudo /Applications/Server.app/Contents/ServerRoot/usr/sbin/postmap /Library/Server/Mail/Config/postfix/sender_bcc

      3. Tell postfix where to find your new sender_bcc file

      sudo /Applications/Server.app/Contents/ServerRoot/usr/sbin/postconf -e sender_bcc_maps=hash:/Library/Server/Mail/Config/postfix/sender_bcc

      4. Reload postfix

      sudo /Applications/Server.app/Contents/ServerRoot/usr/sbin/postfix reload

      That should do it.

  • tknospdr

    How to I tell Server I want to use a different host name when sending? Right now my server’s host name is server.company.com, and that’s what it’s using to send in mail headers. I have DNS set up correctly internally and externally for mail.company.com. I want server to use that to identify itself.

    I don’t see a way to configure it in the GUI and Google has been tight lipped with responses.

  • Christopher Tawes

    My school uses Google Apps/GAFE for email service. However, I’ve found that I need to configure an smtp server for our new phone system–I need to provide the ability for Voicemail to be emailed as a .wav file. I’ve got a Mac Mini server setup and I’m trying to configure the mail server now. I can successfully send mail from the one admin user to itself, but if I try to send to an outside recipient (in this case, to myself) I get the dreaded:

    Recipient address rejected: User unknown in local recipient table

    Does anyone have a quick tutorial on how to get my mail server to stop checking for local delivery and just forward that message on?

    I hope I explained that correctly. (in short, I want my mac mini mail server to be able to deliver mail to recipients on the internet at large and not just to those with local accounts in my OD).

    Thanks in advance!

    • Christopher Tawes

      As a followup: I think I understand that I need to change something regarding local recipient maps. I’ve found the postfix config files in /Library/Server/Mail. After that I’m a bit confused. Do I make a change in master.cf or main.cf ? Is it as simple as commenting/uncommenting a line? I feel like I’m so close to solving this.

      • Christopher Tawes

        Ok, I feel like I’m getting closer. By editing the main.cf file I’ve made some progress.
        Gmail hosts our mail for exampleschool.org
        I’m running a local server in-house at foxtrot.exampleschool.org

        I have one account, foxtrotadmin setup on that server.

        I have the domain on the mac mini server setup as foxtrot.exampleschool.org
        I can send email from foxtrotadmin@foxtrot.exampleschool.org to itself (send and receive successful).
        I can send email from foxtrotadmin@foxtrot.exampleschool.org to my personal account (example@icloud.com)
        But when I try to send email from foxtrotadmin@foxtrot.exampleschool.org to my normal domain recipients hosted at Google (exampleschool.org) I receive an error that mail for exampleschool.org loops back for itself.

        So close. Anybody know how to get me the rest of the way home so that foxtrotadmin@foxtrot.exampleschool.org can deliver to anyadress@exampleschool.org?

        Thanks again!

  • Titan Brandwise

    Once upgraded the server to El Capitan Outlook users can’t send mail.
    They get the 504 5.5.2 error.
    Anything i can do?
    Thank you!

  • Don’t forget that OS X Server rejects email with empty subject lines by default. So some admins comment out the ’empty subject’ reject rule from /etc/postfix/custom_header_checks and restart the mail service.

  • PallookaJ

    Hi all, just upgraded from 10.6.8 server and still have the existing mail db on a dedicated HDD. How on earth do I set the mail db location in this new server version? Anyone done this before? Thank you so much!

  • Chris Tong

    Hi, I’m trying to get the Bayesian filtering to work on Server 5.2. Any clue how to do it? I’ve tried installing spamtrainer from osx.topicdesk.com and tried editing /Library/Server/Mail/Config/spamassassin/local.cf (it should be on) and made sure there was no corresponding entry in amavis.conf, but to no avail, no bayes tests against known spam are actually run.

  • gctwnl

    I’m building a new macOS Sierra Server 5.2 to migrate to (from MLS). There seems to be a problem with postfix logging, which is completely absent. Log level has been set to info, to no avail. This is happening to more people, I get from the internet, but whatever is given as a solution doesn’t work for me. Anybody know a solution (or a way to find the problem)?