= Email Servers = You may not be aware of it as an user, but email is a very <u>complex</u> system to administer. In fact, the more modern e-mail systems (eg. web-based mail applications, etc) are more technically involved than the other archaic, hard-to-configure, and sometimes inter-operable mail systems. We are going to spread the remaining email labs over a few weeks, so that by the end of this topic, you will have a sufficient understanding of what services are involved in sending, filtering, and reading email. You will also have the skills to configure a basic mail setup using the default services provided for your Centos7 Linux distribution.[[Category:OPS335]][[Category:OPS335 Labs]]

==LAB RESOURCESOVERVIEW=={{Admon/important|Warning|Your lab 4a must be complete before you can start this lab.}}

That setup has some major drawbacks::* [http://wiki.dovecot.org/MailServerOverview Here's It required an overview] SMTP server (common mail server terms'''MTA''')to be configured on each machine.:* [https://inside.senecacollege.ca/its/services/email/email_clients/imap.html Seneca Client Settings] The Message Store (Seneca Server settings for mail client '''MS''') would also be unique to each machine - Thunderbird) what a user received on one server would not exist on any other.

In factFinally, the above diagram does not include reading mail messagesyou will set up an '''IMAP''' server called '''Dovecot''' on your '''vm3''' machine, but this acts so you can read your email from an MUA such as ''Thunderbird'' or a starting point in order to run a basic email server''Webmail'' application. Although You will be learning to administer the mail services set up a webmail application called '''Roundcube''' in the diagram above, we will not required you to go into tremendous depth (just the minimum requirementsa later lab). For example, we will not go over every aspect of the Postfix MTA service, but you should know what it represents and what is its main purpose, as opposed to the following: [https://en.wikipedia.org/wiki/Postfix_%28software%29#Architecture complex diagram 1] , [https://www.credativ.de/blog/postfix-architecture-overview complex diagram 2].

=== Learning About the Services involved Involved in email delivery an Email Delivery ===

In reality, the terms '''MTA''', '''MDA''', '''MUA''', '''LDA''' can actually be considered misleading since some of those services can be combined together to form a single entity (application), while other applications may operate as separate entities. There may be overlap, so if you don't find those acronyms helpful, don't worry too much about them. On the other hand, when referred to in diagrams, they can help to visualize those processes when try trying to understand how an e-mail system works.

[http://wiki.dovecot.org/MailServerOverview Here's is an overview] of those terms (from the Dovecot wiki). It is worth viewing this link.

* A '''userUser Account'''. That's the person The individual who wants to send an emailor receive mail messages.* An '''MUA''' (email client). This is the application that the user individual uses to send an emailor receive mail messages. It can be a '''native application ''' or a '''web application'''. We'll set up You will learn how to setup and use both typesof these applications throughout the remainder of this course.* Two '''MTAsMTA'''servers. These are the servers responsible for getting your emails to the <u>destination</u> server.

* The '''LDA/MDA''' Server. This server will receive the email from the MTA, and will store it on disk in some format. '''MailDir''' and '''MBOX''' are the most popular mailbox formats.* '''IMAP/POP3''' server(s). When sending an email, you send it to the destination using your MTA, but you also want to save it in your '''"Sent"''' folder for yourself. This is accomplished by a separate connection to either your '''IMAP''' or '''POP3''' server.

* Note that a '''DNS''' Server. A DNS server is also involved - it is needed to retrieve the address of the email server responsible for an email for a particular domain. This is done with the '''MX ''' records we looked at in the DNS labs. ===Online References=== * [https://help.ubuntu.com/community/Dovecot Dovecot Community Documentation]* [http://wiki.dovecot.org/LDA Dovecot-lda]* [http://wiki.dovecot.org/LDA/Postfix Configuring dovecot-lda with postfix] == INVESTIGATION 1: INSTALL THUNDERBIRD (MUA) and SETUP A REFERENCE CLIENT==

=== Install Unlike the '''mailx''' (MUA) application you installed and used in Lab 4a, this lab will be using the '''Thunderbird Application ''' (MUA) application instead which is a graphical application that uses a '''centralized Message Store''' (MS) to retrieve and Setup a Reference Client ===read mail messages.

Eventually Although wewill be eventually setting up the Thunderbird application to perform all the mail operations discussed above, you need to learn to '''"walk before you can run"''re '. Eventually, you are going to set up all those mail services, but to begin with, we you will set up an email client to connect to a (hopefully) an already working server - which is the '''Seneca email server'''. This will be a good exercise with an Once we learn how to do this for our Seneca email clientaccount, then we can use it for our mail servers for our VM2 and VM3.

#When you see first launch the Thunderbird application, a configuration dialog box, configure it in a similar way (''using your own information'') should appear as shown in the diagram below: <br>::[[Image:Seneca-student-thunderbird-email-setup.png|600px]]<br><ol><li value="3">Use the data in the table below to configure the Thunderbird settings dialog box for YOUR Seneca e-mail account:</li></ol>

{| class="wikitable" border="1" style="margin-left:40px;"! Setting !! '''Incoming: IMAP''' !! '''Outgoing: SMTP'''|-| '''Username'''|| yoursenecauserid@myseneca.ca || yoursenecauserid@myseneca.ca|-| '''servername''' || outlook.office365.com || outlook.office365.com|-| '''port''' || 993 || 587|-| '''security''' || SSL/TLS || STARTTLS|-| '''References''' | colspan="2" | [1] [Imagehttps:Seneca//employees.senecacollege.ca/spaces/77/it-studentservices/wiki/view/2394/other-thunderbirdemail-emailclients ITS -setup.pngConfiguring other Email Clients]|600px]]}

::Notice Note that there are your username is your full email address(<uem>unencryptedyourid@myseneca.ca</uem> options available to connect to your SMTP/IMAP servers but those are rarely used these days - the potential for abuse is too great. On a free wifi network, the operator would be able to ) and not only read your email, but also obtain your password without any passwordjust <em>yourid</encryption cracking tools. In fact, even on a private wired network, it is not uncommon for an employer to use a packet sniffer utility to monitor all the traffic going over their network (Packet Sniffing applications were actually found to be legally acceptable practices if used by the management of organizations)em>.

{{Admon/important |Unencrypted Options|Notice that there are <u>unencrypted</u> options available to connect to your SMTP/IMAP servers but those are rarely used these days - the potential for abuse is too great. On a free wifi network, the operator would be able to not only read your email, but also obtain your password without any password/encryption cracking tools. In fact, even on a private wired network, it is not uncommon for an employer to use a packet sniffer utility to monitor all the traffic going over their network (Packet Sniffing applications were actually found to be legally acceptable practice if used by the management of organizations)}}<br><ol><li value="3">After you create your '''Thunderbird''' account, you should be able to read your existing email and send new email within the Thunderbird application.</li><li>Take time to view your ''Account Settings'' and ''Preferences'' to get a feel for what settings exist. For example:<ul><li>How often will Thunderbird check for new messages?</li><li>Will the messages you write be in HTML or plain text?</li></ul></li></ol>* How do you change your SMTP server settings? Why are they in a different section?</li></ul></li><li>The main objective of this section was to learn how to setup your Thunderbird application to read your Seneca email, so in the next section you can use the exact type of setup for your own email server.</li></ol>

The main objective of this section was to learn how to setup '''Record steps, commands, and your Thunderbird application to read your Seneca email, so observations in INVESTIGATION 1 in the next section you can use the exact type of setup for your own email server.OPS335 lab log-book'''

== INVESTIGATION 12: SETUP MAIL TRANSFER AGENT (MTA) FOR SENDING (NO ENCRYPTION) A CENTRALIZED MESSAGE STORE ==

We be using the '''Postfix''' application as the '''=== Setup Your MTA''', and we will be setting it up on your '''vm2''' machine. This will act as the email server for your internal network. You will be able to send email out of your network, and receive email from within your network, but you will '''<u>not</u>''' receive email from outside of your network due to the following reasons:* Individuals outside of your domain will never find the MX records because there are no '''.org''' servers pointing to your DNS server (i.e. you haven't paid for it).* Even if they the individuals could read your MX records, your local network is using IP addresses on a '''private subnet''', which is not routeable on the Internet, so it cannot be reached from outside of your system.Use Correct Domain===

=== Verify In Lab 4a, both of your email servers were sending mail messages addressed from users of the Postfix Service Status ===actual machines themselves. This would be confusing for the receiver who might get emails from the same user @vm1, vm2, and vm3. Which would they respond to? To avoid this problem from occurring, we can make all servers make the sent mail appear to come from a central location (usually the '''domain'''), and make incoming email sent to that address to be accessible from machines within our network.

#The Issue the '''mail''' command to view the email messages you sent between your '''vm2''' and '''postfixvm3''' application should be installed by defaultin your lab 4a. If it isn't, install Notice that each is addressed from root on whichever machine sent it.#Install also On both machines (vm2 and vm3), edit the '''netstat/etc/postfix/main.cf''' application (tip: use yum search file to find the package name) and also install change the '''telnetmyorigin''' parameter from '''$myhostname''' to '''$mydomain''' command.#Postfix will work with the default configuration, so start and enable this service, and verify that Restart the '''postfix ''' service is running.#Look for Now, send emails messages (via the running postfix service in the list '''mail''' command) between both of listening ports by issuing the following command:<br><source lang="bash">netstat -atnp</source>#Which service is postfix running? Locate the port used by SMTPyour vm2 and vm3 machines, and look for connctions with view the state LISTEN (imail messages by issuing '''mail''' in each vm.e The sender address should now read that the received mail messages came from '''root@yourdomain. currently listening)ops'''.#Write your observations in your lab logbook.

=== Testing ::The next step is to configure what addresses that the connection server will receive email for. This is done using postfix by setting the '''mydestination''' parameter (configuration variable) to the Postfix Service ===include '''$mydomain''' (this is assuming you've set up '''mydomain''', '''myorigin''' , and '''inet_interfaces''' properly).

We <ol><li value="4">Edit the '''/etc/postfix/main.cf''' file for '''vm3 ONLY''', scroll down to the line containing: '''mydestination''' and change line to the text shown below:<br><source>mydestination = $mydomain, $myhostname, localhost.$mydomain, localhost</source>'''Note:''' Even though your machine's name is ''vm3.yoursenecaid.ops'', your postfix MTA will also receive emails addressed to the domain called: yoursenecaid.ops</li></ol><br>::In order for this to work, we need to add a DNS record that will be demonstrating point mail sent to the use domain towards one of the telnet application SMTP servers configured to test accept it. <ol><li value="5">Add an '''MX''' record to the forward lookup zone on '''host''' so that all incoming mail addressed to the domain is sent to your vm3.</li><li>Restart the postfix service and use the '''dig''' command to confirm that it works.</li><li>Send an email from your '''vm2''' to '''root@yourdomain.ops'''</li><li>Confirm that it arrives on your '''vm3''' machine</li></ol> === Relay Email Through Another Server=== When email is runningsent from either vm, it is addressed from the domain, but receiving MTAs might query why mail sent from vm2 doesn't match the address of the MX record for the domain. This would be a red-flag for potential spam. To avoid this, we can relay all mail sent from vm2 (or any other machine in our network) through vm3 so that it properly appears to come from the mail server that matches the MX record for the domain.

# Connect from Move to your server vm2 machine.# Direct your '''vm2''' MTA to your server using telnet relay mail through vm3, by issuing making the following commandediting change for the '''/etc/postfix/main.cf''' file:<br><source lang>relayhost ="bash"vm3.<yourdomain>telnet localhost 25.ops</source># Note that it should indicated that you are connected by displaying Restart the the text:'''Escape character is postfix''' service.# Next, you must instruct your '''^]vm3''', which indicates that in order machine to allow your vm2 machine to end pass email through it by making the telnet session, you can hold control and press following editing change to the square bracket key'''/etc/postfix/main.cf''' file:<br><source>mynetworks = 192.168. Perform that key-combination to end the telnet sessionX.0/24</source>NOTE: Substitute in your '''own network''' for X<br><br>#Enter Restart the command '''exitpostfix''' to close the telnet applicationservice.

::'''NOTE:''' If it workedAll mail is now being delivered to a centralized location (and also appears to be coming from that same location), this indicates but a user would still have to access that the postfix service is running and listening and responding server to connectionsretrieve it.

<ol><li value="4">Let's see if it works from other machines. Telnet to vm2 from == Install and Configure the host Local Delivery Agent (connect to the SMTP port) and see if it works. If your firewall is set up properly, the telnet command should not permit a connection.<LDA/li><li>Issue an iptables rule to allow incoming connections to '''TCP port 25'''.</li><li>Once you open the port in the firewall, retry the '''telnet''' command. You should get a different error this time. This time the problem is that your service isn't listening on the outside interface, it's currently configured to listen only on the loopback (loMDA) interface.</li></ol>===

Our first editing change to '''Perform the Postfix configuration will be following steps:''' #Move to make your '''vm3''' machine.#Dovecot is not installed when you installed your Virtual machines in previous labs.<br>Install the service "listen" for incoming connections on Dovecot application by issuing the external interface following command:<br><source>yum install dovecot</source>#Edit your '''/etc/postfix/main.cf''' file and scroll down to (i.e or search for) '''eth0mailbox_command''' from . Add the VMs point of view).following line:<br><source>mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"</source>

::NOTE: Do <u>'''not'''Perform </u> replace any variables, those are set automatically by Postfix when it runs the following stepsLDA. If you are interested in learning more about the Dovecot application, you can read about dovecot-lda [http://wiki.dovecot.org/LDA/Postfix here] and [http://wiki.dovecot.org/LDA here].<br><ol><li value="4">Finally, edit the '''/etc/dovecot/conf.d/10-mail.conf''' file and indicate where you want your mail delivered by including the following line:<source>mail_location = maildir:~/Maildir</source></li><li>Restart your postfix service.</li><li>While the emails are still stored only on VM3, they will now be easier for other machines/services to access.</li><li>Due to permissions on the directories where mail will now be stored, root will no longer receive mail. Check the logs for an indication as to why.</li></ol>

# Launch in editing session for the postfix configuration file called: '''/etc/postfix/main.cfRecord steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book'''# Change the value of the following parameter to what is displayed below: inet_interfaces = all

<ol><li value="=INVESTIGATION 3">We should also set the string that will end up in the '''From:''' header in messages sent by this server. Change '''mydomain''' to your domain name and '''myorigin''' to '''$mydomain'''.</li><li>Restart the postfix service and confirm USING THUNDERBIRD (using netstatMUA) that the service is now listening on <u>all</u> interfaces (not just loopback)</li><li>Test by connecting to it (using telnet) from your '''host''' machine.</li></ol>FOR VM2 and VM3 MACHINES ==

=== DNS Server used by the host Accessing Received Mail Messages on VM3 VIA IMAP ===

So farFirst, you are not using vm1 as we will set up the DNS IMAP server so we can read email. The current way we have configured our mail server on our VM3 machine should allow all the email for your anyaccount@yoursenecaid.ops should be delivered to our '''hostvm3''' machine. We will need set up Dovecot with IMAP to change the DNS configuration in order for the email server get easy access to operate correctly. Normally you don't need an entire DNS server for running an that email server, you can simply add an '''MX''' record in your registrar's web interface, but we haven't paid for our domains; therefore, we don't have a registrar with a web interface.

#Modify your The configuration file for the Dovecot service (which is not the same thing as dovecot-lda) is: '''/etc/resolvdovecot/dovecot.conf'''. Modify the '''protocols''' option so that Dovecot will work with IMAP connections, no POP3 or LMTP.# Start the dovecot service, and ensure it will always start automatically when the machine boots.# Use the '''ss''' command to confirm the service is listening, and use '''nc''' on your the '''host''' machine to use confirm you can connect to it.# You'll probably fail, so using the information gathered from '''ss''', modify the firewall on vm3 to allow IMAP connections from your local network and try '''vm1nc''' machine as the name serveragain. This will Once it works, do not be a permanent forget to save this change, since so it will only still be required for there the next time you reboot.#If you can connect - it's now time to do something wrong, that is allow connections to our email labsIMAP server over an unencrypted connection.# Edit the '''/etc/dovecot/conf.d/10-auth.conf''' file and set '''disable_plaintext_auth''' to '''no'''.# We Then edit the '''/etc/dovecot/conf.d/10-ssl.conf''' file and set '''ssl''' to '''yes'''.<br><br>'''Note:''' This combination of parameters will have allow your username and password to remember be sent over the internet in plain text, for anyone interested to do look at. In a later lab we'll set up secure SMTP and IMAP connections, for now this every is all we have time you reboot your hostfor.<br><br># Restart dovecot so the changes take effect.

If your regular (internet) DNS lookups slow down significantly, you can update the DNS server configuration on '''vm1''' === Connecting to forward requests to the Google nameserver (8.8.8.8) instead of your host machine.IMAP Servers Using Thunderbird===

'''Record Perform the following steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-book:'''

==INVESTIGATION 2[[Image: SETUP THUNDERBIRD MAIL USER AGENT (MUA) FOR YOUR VIRTUAL NETWORK (vm2, vm3) ==ops335-email-step1.png|600px]]

We are far from having a working email <ol><li value="3">Try to connect to your IMAP server but at this point we have enough with Thunderbird by clicking on your '''Inbox'''.</li><li>If nothing happens, then check the Thunderbird Activity Manager for any errors. If the connection is successful, you should see the '''Trash''' box <u>appear</u> below Inbox.</li><li>Use the Thunderbird application to be able send an email to test your myseneca address. If you've done everything right, it with Thunderbirdwill send the message successfully</li><li>Verify that your message has been sent. Check your myseneca email and look at '''/var/log/maillog''' on vm2 (your email server).</li></ol>

The process is === Sending a little challenging because Thunderbird tries really hard to prevent you Mail Message from connecting to a server that doesn't work VM2 (and ours mostly doesn't work at this point). Set it up to connect to your '''vm2''' for SMTP and '''vm3''' for IMAP. Use no encryption, and normal password authentication for IMAP (we don't have an IMAP server running yet, but that's okUsing Thunderbird).===

[[Image'''Perform the following steps:ops335-email-step1.png|600px]]'''

Thunderbird won#Use the '''ss''' and '''nc'''t let commands (like you proceed with did in lab 4a) to confirm your service is listening on the "Done" button because you correct ports/interfaces. You will fail probably have to connect open the appropriate firewall port on '''vm3''' to IMAPallow incoming '''SMTP''' connections. Use <br><br>'''Note:''' You should be able to send email to any regular user <u>on</u> '''vm3''' using the email address '''yourusername@yoursenecaid.ops''' using the "Advanced config" button Thunderbird application on your host machine (which is configured to bypass that checkuse the account on your vm2).<br><br>

Now use Thunderbird to send an email to <ol><li value="2">Create a new account on your '''vm3''' machine using only your myseneca address<u>first</u> name. If you've done everything right We will use this account as a one- it will send time "test" if the mail message successfully but it will fail to save it in the Sent folder, because has been received on your VM3 machine (from your VM2 machine).<br><br>'''Note:''' It is <u>'''important'''</u> thatyou '''s done with IMAP and you <u>don't have an IMAP server yet</u>''' create this same account name on your vm2 machine, since you want to easily identify the difference between the sending and receiving SMTP servers.<br /><br /></li></ol>

Still - verify that <ol><li value="3">Use the new account in Thunderbird to send an email to '''firstname@yoursenecaid.ops''' and then check the contents of '''/home/firstname/Maildir/new/''' on your message has been sent'''vm3''' machine. Check There should be a file there with the contents of your myseneca email and look at .</li><li>If there is no file, then check the log file '''/var/log/maillog''' to see what went wrong.</li><li>If you can see a file in the '''/home/firstname/Maildir/new/''' directory, then review the procedures on vm2 (your how you got the email serverworking (since you have performed many steps and set up many services).</li><li>Refer to the diagram at the top of this lab. Which services have you currently set up? Record your findings in your lab Logbook.</li></ol>

{{Admon/important |Backup your VMs!|You MUST perform a '''full backup'''Record steps, commands, and of ALL of your VMs whenever you complete your observations in INVESTIGATION 2 in '''OPS335 labs''' or when working on your '''OPS335 lab log-bookassignments'''. You should be using the dump or rsync command, and you should use the Bash shell script that you were adviced to create in order to backup all of your VMs.}}

Students should be prepared with ===Online Submission===Follow the instructions for lab 4b on blackboard.<!--===Andrew's sections=== You may choose to:* Submit screenshots of your work on Blackboard, in which case you don''all required commands (system information) displayed in a terminal (or multiple terminals) prior t need to come to the lab.* Or come to calling the instructor for signoff''lab, show me your work, and talk to me about it. I want to hear what you've learned and answer any questions you have.

You'''Arrange evidence (command output) for each ll get the same grade regardless of these items on how you choose to submit your screen, then ask your instructor to review them and sign off on the lab's completion:'''work.

#What is the purpose of the Thunderbird application?# List the steps to configure your DNS to allow your Thunderbird application to connect to your mail server.# What is the purpose of the '''Dovecot''' package?# What is the purpose of the '''mydestination''' parameter contained in the '''/etc/postfix/main.cf''' file?# Why are '''IMAP''' and '''POP''' email servers placed on separate machines (vms)?# What is the purpose of the '''mail_location''' parameter contained in the '''/etc/dovecot/conf.d/10-mail.conf''' file?# Why is root not able to receive mail with the changed mail location? What could you change to allow mail to be sent to root again?