{"id":6185,"date":"2013-04-22T07:00:00","date_gmt":"2013-04-22T05:00:00","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=6185"},"modified":"2020-03-15T17:32:44","modified_gmt":"2020-03-15T16:32:44","slug":"setup-postfix-antispam-as-mx-backup","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/setup-postfix-antispam-as-mx-backup\/","title":{"rendered":"Setup Postfix + Antispam as MX backup"},"content":{"rendered":"

\"mxbackup01\"<\/p>\n

In mail-server architecture, MX backup is a solution that should be always implemented for redundancy and to avoid emails being returned with errors<\/strong> due to mail-server unavailability.<\/p>\n

The working concept is pretty easy: when the mail-server is offline<\/strong> (failure or maintenance), incoming emails are collected and stored in the MX backup<\/strong> and released once the primary mail-server is back online again.<\/p>\n

\"mxbackup02\"<\/p>\n

 <\/p>\n

DNS configuration<\/span><\/h2>\n

To work properly, system requires a second MX record in the DNS<\/strong> entry with a lower priority to properly deliver incoming email to MX backup while mail-server is offline.<\/p>\n

mail.domain.com  MX  10\r\nmail2.domain.com MX  20<\/pre>\n
Mail-server and MX backup public IPs<\/strong> have to be also set to reflect the designed architecture.<\/p>\n
\"mxbackup03\"<\/p>\n
 <\/p>\n
Required packages installation<\/span><\/h2>\n
In order to use yum<\/em> command to install all required packages, we need to add the RPMforge repository<\/strong> to our system.<\/p>\n
# wget http:\/\/pkgs.repoforge.org\/rpmforge-release\/rpmforge-release-0.5.2-1.el6.rf.x86_64.rpm
\n# rpm -Uvh rpmforge-release-0.5.2-1.el6.rf.x86_64.rpm<\/span><\/p>\n
\"mxbackup04\"<\/p>\n
In addition to Postfix, the installation process includes additional packages to protect the server from spamming<\/strong>: ClamAV, Spamassassin and Amavisd-new.<\/p>\n
# yum install postfix spamassassin clamd clamav-db amavisd-new<\/span><\/p>\n
\"mxbackup05\"<\/p>\n
Because in this system we want to use only Postfix, if other packages are installed (Sendmail for instance) we need to set the correct MTA<\/strong> through the command alternatives<\/em> selecting the right option.<\/p>\n
# alternatives --config mta<\/span><\/p>\n
\"mxbackup06\"<\/p>\n
Because in this example only the package Postfix is installed, the number option to type is 1<\/strong><\/span>.<\/p>\n
If Sendmail is installed in the system, remove it<\/strong> using the yum<\/em> command.<\/p>\n
# yum remove sendmail<\/span><\/p>\n
 <\/p>\n
ClamAV configuration<\/span><\/h2>\n
Edit the file \/etc\/clamd.conf<\/em> and check that communication between Amavisd-new -> ClamAV is made through the local UNIX socket<\/strong> instead of TCP socket.<\/p>\n
LocalSocket \/var\/run\/clamav\/clamd.sock\r\n#TCPSocket  3310<\/pre>\n
# vi \/etc\/clamd.conf <\/span><\/p>\n
\"mxbackup07\"<\/p>\n
Enable ClamAV option removing the #<\/strong>.<\/p>\n
['ClamAV-clamd',\r\n   \\&ask_daemon, ["CONTSCAN {}\\n", "\/var\/run\/clamav\/clamd.sock"],\r\n   qr\/\\bOK$\/m, qr\/\\bFOUND$\/m,\r\n   qr\/^.*?: (?!Infected Archive)(.*) FOUND$\/m ],<\/pre>\n
\"mxbackup08\"<\/p>\n
 <\/p>\n
Amavisd-new configuration<\/span><\/h2>\n
Edit configuiration file \/etc\/amavisd.conf <\/em>and set the parameters<\/strong> with values that reflect your network environment.<\/p>\n
$mydomain = 'nolabnoparty.com';            # domain.com\r\n$MYHOME = '\/var\/amavis';\r\n$helpers_home = "$MYHOME\/var";\r\n$lock_file = "$MYHOME\/var\/amavisd.lock";\r\n$pid_file = "$MYHOME\/var\/amavisd.pid";\r\n$myhostname = 'mail2.nolabnoparty.com';    # hostname.domain.com<\/pre>\n
# vi \/etc\/amavisd.conf<\/span><\/p>\n
\"mxbackup09\"<\/p>\n
 <\/p>\n
Postfix configuration<\/span><\/h2>\n
Edit the file \/etc\/postfix\/master.cf<\/em> and add the following lines:<\/p>\n
# ==========================================================================\r\n# service type  private  unpriv  chroot  wakeup  maxproc  command + args\r\n#               (yes)    (yes)   (yes)   (never) (100)\r\n# ==========================================================================\r\namavisfeed unix    -       -       n       -       2       lmtp\r\n-o lmtp_data_done_timeout=1200\r\n-o lmtp_send_xforward_command=yes\r\n-o disable_dns_lookups=yes\r\n-o max_use=20\r\n\r\n127.0.0.1:10025 inet n    -        n       -       -       smtpd\r\n-o content_filter=\r\n-o smtpd_delay_reject=no\r\n-o smtpd_client_restrictions=permit_mynetworks,reject\r\n-o smtpd_helo_restrictions=\r\n-o smtpd_sender_restrictions=\r\n-o smtpd_recipient_restrictions=permit_mynetworks,reject\r\n-o smtpd_data_restrictions=reject_unauth_pipelining\r\n-o smtpd_end_of_data_restrictions=\r\n-o smtpd_restriction_classes=\r\n-o mynetworks=127.0.0.0\/8\r\n-o smtpd_error_sleep_time=0\r\n-o smtpd_soft_error_limit=1001\r\n-o smtpd_hard_error_limit=1000\r\n-o smtpd_client_connection_count_limit=0\r\n-o smtpd_client_connection_rate_limit=0\r\n-o receive_override_options=no_header_body_checks,\r\nno_unknown_recipient_checks,no_milters,no_address_mappings\r\n-o local_header_rewrite_clients=\r\n-o smtpd_milters=\r\n-o local_recipient_maps=\r\n-o relay_recipient_maps=<\/pre>\n
# vi \/etc\/postfix\/master.cf<\/span><\/p>\n
\"mxbackup10\"<\/p>\n
Edit the file \/etc\/postfix\/main.cf <\/em>.<\/p>\n
# vi \/etc\/postfix\/main.cf<\/span><\/p>\n
Add the following two lines:<\/span><\/p>\n
#AMAVISD-NEW\r\ncontent_filter=amavisfeed:[127.0.0.1]:10024<\/pre>\n
\"mxbackup11\"<\/p>\n
Change the configuration parameters<\/strong> with values that fit with your network environment.<\/p>\n
myhostname = mail2.nolabnoparty.com        # hostname.domain.com\r\nmydomain = nolabnoparty.com                # domain.com\r\nmyorigin = $mydomain\r\nmydestination = $myhostname, localhost.$mydomain\r\nmynetworks = 127.0.0.0\/8, 192.168.20.2     # IP MX backup host\r\nrelay_domains = nolabnoparty.com           # target domain\r\ninet_interfaces = all\r\nsmtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination\r\nrelay_recipient_maps =\r\nmessage_size_limit = 0\r\nmailbox_size_limit = 0\r\nmaximal_queue_lifetime = 5d<\/pre>\n
\"mxbackup12\"<\/p>\n
If the relay_recipient_maps<\/strong> parameter is left blank, all the emails are processed by the MX backup regardless if recipients exist or not in the mail-server with the risk of storing also \u201cjunk\u201d emails<\/strong>. By creating the file \/etc\/postfix\/relay_recipients<\/em> with existing accounts<\/strong>, the problem is solved and only emails addresses to existing recipients are kept. Of course if you have a dynamic environment with thousand mailboxes, this approach is perhaps not the best option.<\/p>\n
# vi \/etc\/postfix\/ relay_recipients<\/span><\/p>\n
# Accounts configured in mail-server\r\nangus.young@nolabnoparty.com\r\nmalcolm.young@nolabnoparty.com\r\nbon.scott@nolabnoparty.com\r\nbrian.johnson@nolabnoparty.com\r\ncliff.williams@nolabnoparty.com\r\nphil.rudd@nolabnoparty.com<\/pre>\n
Enable installed services to be processed during system startup<\/strong>.<\/p>\n
# chkconfig postfix on
\n# chkconfig amavisd on
\n# chkconfig clamd on
\n# chkconfig spamassassin on<\/span><\/p>\n
\"mxbackup13\"<\/p>\n
Start the services<\/strong> following the correct sequence.<\/p>\n
# service spamd restart
\n# service clamd restart
\n# service amavisd restart
\n# service postfix restart<\/span><\/p>\n
\"mxbackup14\"<\/p>\n
If a warning related to an outdated ClamAV database<\/strong> is shown, you can manually update the signature by using the command:<\/p>\n
# \/usr\/bin\/freshclam<\/span><\/p>\n
\"mxbackup15\"<\/p>\n
Signature is then updated to latest available release<\/strong>.<\/p>\n
\"mxbackup16\"<\/p>\n
 <\/p>\n
System test<\/span><\/h2>\n
Once the configuration is completed, we need to test the system to verify its correct functionality checking if emails are properly processed<\/strong>.<\/p>\n
Using the telnet<\/em> command, we test first if Amavisd<\/strong> service is listening on 127.0.0.1:10024<\/strong>.<\/p>\n
# telnet localhost 10024<\/span><\/p>\n
ehlo localhost\r\nquit<\/pre>\n
\"mxbackup17\"<\/p>\n
Next to test Postfix smtpd<\/strong> service is listening on 127.0.0.1:10025<\/strong>.<\/p>\n
# telnet localhost 10025<\/span><\/p>\n
ehlo localhost\r\nquit<\/pre>\n
\"mxbackup18\"<\/p>\n
Using another computer, connect the MX backup via telnet<\/strong>. In yellow are shown the instructions to enter.<\/p>\n
telnet MX_backup.domain.com 25<\/pre>\n
# telnet mail2.nolabnoparty.com 25<\/span><\/p>\n
ehlo www.nolabnoparty.com\r\nmail from:<bon.scott@nolabnoparty.com>\r\nrcpt to:<bon.scott@nolabnoparty.com>\r\ndata\r\nSubject: test backup mx\r\nsending message to test backup mx\r\n.\r\nquit<\/pre>\n
\"mxbackup19\"<\/p>\n
If the message is delivered<\/strong> to the recipient, then the system is working properly.<\/p>\n
\"mxbackup20\"<\/p>\n
If the message is delivered<\/strong> to the recipient, then the system is working properly.<\/p>\n
\"mxbackup21\"<\/p>\n
Check Postfix logs activity<\/strong> to verify whether MX backup is processing messages or not.<\/p>\n
# tail -f \/var\/log\/maillog<\/span><\/p>\n
\"mxbackup22\"<\/p>\n
To check the MX backup emails queue<\/strong>, the command mailq<\/em> shows the messages received so far.<\/p>\n
# mailq<\/span><\/span><\/p>\n
\"mxbackup23\"<\/p>\n
On regular basis the system perform a flush action<\/strong> of queued messages based on the value specified in the\u00a0 \/etc\/postfix\/master.cf<\/em> file (default 1000 seconds).<\/p>\n
# vi \/etc\/postfix\/mastercf<\/span><\/span><\/p>\n
\"mxbackup24\"<\/p>\n
If you don\u2019t want to wait for next flush schedule, a manual flush<\/strong> can be performed using the command postqueue<\/em> and checking with mailq<\/em> the queue status.<\/p>\n
# postqueue -f
\n# mailq<\/span><\/p>\n
\"mxbackup25\"<\/p>\n
When messages are released from the MX backup, if everything works as expected, emails are delivered<\/strong> to the email client.<\/p>\n
\"mxbackup26\"<\/p>\n
Instead of buying some cloud resources that could be quite expensive, in the market are available some providers that offer the MX backup service<\/strong> with interesting fees.<\/p>\n