Systems - Email

Basics

Purpose

The email server receives email for @cacert.org addresses. It also provides users of @cacert.org with IMAPs and POP3s access to their accounts. It hopefully meets these requirements.

The database on this server provided as a cache for the webmail.

Physical Location

This system is located on a Debian Etch vserver on physical machine sun2.

Logical location

IP: 172.16.2.19 (email.intra.cacert.org)

POP3/IMAP: via Tunix port forwarding associated with community.cacert.org

Applicable Documentation

  1. User/organisation requirements

  2. organisation requirements for account use

  3. Communication Policy

  4. User documentation

Administration

Services

Listening services

DNS

Running Services

Connected Systems

Outbound network connections

Security

Privileged Access: Daniel/Philipp Other Access: All @cacert.org users have POP3(S|TLS)/IMAP(S-TLS)/SMTP(TLS/SSL)/Managesieve access

Non-distribution packages

Risk assessments on critical packages

Common Tasks

Adding Users

  1. Create the user in the database cacertusers - table users

  2. manually create the directory mkdir -p /home/user/Maildir

  3. chown -R user:user /home/user

Practical Example

sets up a new user with password 'secret'. Now use https://community.cacert.org/password.php to set the user's password to a better value.

Aliases

There are two types of aliases.

First type is ones that are never sent from. e.g. postmaster@cacert.org. All these aliases are in /etc/aliases. Don't forget to run postalias /etc/aliases after any changes. Aliases for issue tracking are installed here as {issuetrackingaddress} : {issuetrackingaddress}@issue.cacert.org.

For aliases for which email is sent, e.g. pr@cacert.org, the alias is recorded in the aliases table on the cacertusers database. This is so the designated person, and only the designated person can send email under this role.

Critical Configuration items

/etc/dovecot/dovecot.conf

Main dovecot configuration defining the authentication for IMAP/POP3 and SMTPS

Dovecot authentication

/etc/dovecot/dovecot.conf refers to PAM mail.PAM mail is defined /etc/pam.d/mail. System users are defined by NSS which is a combination of /etc/password (for root and non-imap/pop users) and /etc/libnss-mysql*.

There is a special master password so webmail can do the authentication for dovecot using certificates. This is defined in /etc/dovecot/dovecot-sql-masterpassword-webmail.conf. This special password is restricted to the IP of Community.

Manage Sieve

Configuration is stored "/usr/local/etc/pysieve.ini" Started by xinetd - "/etc/xinet.d/pysieved"

/etc/postfix/*

Postfix configuration

/etc/mysql/*cnf

Mysql passwords

/home/{username}/Maildir

Where email is stored.

Changes

Planned

cacert.net/cacert.org

Archiving Email

Problem

The Threat of Legal Discovery is an emerging disaster in USA litigation, and is also spreading to other anglo countries. The basic model is to use the courts to force the delivery of all data on an issue, spread over many different events. Each event costs money (a full legal "act" might cost from $5k to $1m).

Considerations

Normally, most people use their own emails because the use of business and private stuff is hard to separate. Most people keep and store their email on their laptops (which may then become subject of seizure orders for examination by opposition counsel).

Solution

Employing of CAcert email addresses and server for all official businesses allows escrow into a black hole (unreadable store). In the event of a discovery motion, an Arbitrator can compel the opening of the store and the delivery of the documents. See Threats/LegalDiscovery for more.

Policy consideration is that as much business for CAcert as possible should go through CAcert email addresses. This means that all roles (or officers) should use the addressess.

Permission & Tracking

As CAcert is effectively then tracking the email of Members, there will need to be permission and clear information / notification as to what is being done. E.g., check this, the applicable laws, TELECOMMUNICATIONS (INTERCEPTION AND ACCESS) ACT 1979 http://www.austlii.edu.au/au/legis/cth/consol_act/taaa1979410/ cannot intercept email inbound until it has completed http://www.efa.org.au/Issues/Privacy/tia.html. Ok checked - entirely not applicable (Daniel - 02 May 2009 - section 5(5) - telecommmunication system isn't in Australia)

Tech

Need an address to archive archive@cacert.org with bcc there on sending/receiving.

password brute force attempts

Something like fail2ban on the primary host.

Logging

something like mailgraph on logs (or pflog)

X509 Authentication

Daniel may get around to working on dovecot patches.

postfix also needs work - cert authentication there is more server orientated rather than user submission. (unstarted - hope to reuse dovecot work).

Direct internet

Ready system for direct Internet connection inbound without Tunix. It only 1/2 done is due to rushed install without a clear final plan.

DSPAM Imap folder spam setup

User's control spam filtering

Move to Lenny

DKIM

use opendkim as dkim-milter is unmaintained.

LDAP

LDAP will be a more useful database of user stuff than MYSQL. May consider exporting this publicly.

Public fold of mailing lists

Put public mailing lists in public folder

CategorySystems

SystemAdministration/Systems/Email (last edited 2011-03-16 12:50:26 by UlrichSchroeter)