Installation on "Debian Sarge"

Here you have 2 of these important settings: the top of the path, in which the homepage of each users will reside, and the directory of the logfiles. In the logdirectory all logfiles generated by apache will be stored. For each website there is at least one webXY-access.log and one webXY-error.log where informations and errors are recorded.

Be sure to fill in this two fields correctly. These IDs inform you which system account the mails will belong to after delivering. Normally this will be the user vmail. Should this user already exist on your system, the userid (UID) and groupid (GID) needs to be adjusted in order to match the correct user, otherwise you can freely use 2000.

Here the directory for mail-deliverance will be set. Please note that this directory must be owned by the user vmail and the group vmail. The user vmail appears with the same UID and GID like the above mentioned informations about mailuser.

Honestly, the sender-variable is not that important. Nevertheless it should be checked and changed according to your needs. It won't look quite professional if a welcome-mail from SysCP carries an address like <info@example.org>. Although SysCP will suggest a name, most users might use their special address.

Edit the file /etc/proftpd/proftpd.conf according to the sample on the SysCP webfrontend and make it identical. In the following listing are a few personal options, added to the SysCP template by the author.

/etc/proftpd/proftpd.conf

[...]
<Global>
# chroot all users
DefaultRoot ~
# Reject rootlogin (just for security)
RootLogin off
# No need to require valid shell, because user is virtual
RequireValidShell off
</Global>
<IfModule mod_delay.c> 
   DelayEngine off
</IfModule>
[...]

To ensure that ProFTPd is working with the MySQL-database, please verify that "LoadModule mod_sql_postgres.c" is commented out ("#LoadModule mod_sql_postgres.c") in the file /etc/proftpd/modules.conf. Otherwise ProFTPd will refuse logins.

Restart your ProFTP-Server as follows:

syscp ~ # /etc/init.d/proftpd restart

The configuration of your FTP-Server is finished. From now on ProFTPD will verify the logins with the MySQL-database.

To enable TLS-Mode on your FTP-Server two things need to be done. First you need a certificate, which is needed to establish a crypted connection. It can be created easily using this command:

syscp ~ # openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/proftpd.cert.pem -keyout /etc/ssl/certs/proftpd.key.pem

For more Information regarding SSL and TLS please visit: http://www.chimera.ch/download.php?view.4. After creating the certificate we must adjust the configuration of ProFTPd.

/etc/proftpd/proftpd.conf

# Uncomment this if you would use TLS module:
TLSEngine                       on
TLSLog                          /var/log/ftp_tls.log
TLSProtocol                     SSLv23
TLSOptions                      NoCertRequest
TLSRSACertificateFile           /etc/ssl/certs/proftpd.cert.pem
TLSRSACertificateKeyFile        /etc/ssl/certs/proftpd.key.pem
TLSVerifyClient                 off
# Uncomment the following line to force tls-login
#TLSRequired                    on

Meanwhile it should be understandable for you, to restart a service after changing its configuration to let the changes become effective. Lets do this now, you will be able to establish a FTP-connection via TLS:

syscp ~ # /etc/init.d/proftpd restart

First let us perform some commands in a shell to create a base for postfix and SASL. If not yet existing create the following directories:

syscp ~ # mkdir -p /etc/postfix/sasl

syscp ~ # mkdir -p /var/spool/postfix/etc/pam.d

syscp ~ # mkdir -p /var/spool/postfix/var/run/mysqld

Attention: Make sure that there is NO whitespace at the end of the configuration files. Otherwise it will be added to the path or the value of the setting and you get disastrous results. The same warning applies, when it comes to edit these files using file editors on Windows Systems (e.g. notepad.exe). This editors related to the DOS-world write <CR><LF> instead of <LF> on each end of a line, which is sometimes (and this is the bad news) unable to understand by a Unix-related System like Linux. The configuration files of postfix are one of those where you strictly need a Unix-conform editor editing them. To let postfix gain access to the MySQL database and its content we need the following configuration-files:

Authors Note: the two files below will not be created by the official SysCP installation. However, the author likes to suggest to make usage of these files, since they are present in the database and won't harm anything. Therefore the postfix-configuration discussed here is slightly different from the one SysCP uses. Should you prefer the original SysCP version, go ahead! Just skip these 2 files, but in this case keep in mind to set virtual_uid_maps and virtual_gid_maps in main.cf on static.

/etc/postfix/mysql-virtual_uid_maps.cf

user = syscp
password = MYSQL_PASSWORD
dbname = syscp
table = mail_users
select_field = uid
where_field = email
hosts = 127.0.0.1

/etc/postfix/mysql-virtual_gid_maps.cf

user = syscp
password = MYSQL_PASSWORD
dbname = syscp
table = mail_users
select_field = gid
where_field = email
hosts = 127.0.0.1

Let us now configure main.cf. You will notice the difference to the original SysCP version. Remark: You should avoid to set $myhostname and $mydomain to the IP of the server or a domain maintained by SysCP. You might experience difficulties upon mail delivery. It is a good idea to use the name of the server given from the provider (e.g. srv-lnx-XY.provider.tld) Whenever available use that name.

/etc/postfix/main.cf

# daemon configuration
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix
[...]
# Virtual Mailbox settings
virtual_mailbox_base = /var/kunden/mail/
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual_mailbox_maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual_mailbox_domains.cf
virtual_alias_domains =
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual_alias_maps.cf
virtual_uid_maps = mysql:/etc/postfix/mysql-virtual_uid_maps.cf
#virtual_uid_maps = static:2000
virtual_gid_maps = mysql:/etc/postfix/mysql-virtual_gid_maps.cf
#virtual_gid_maps = static:2000
# use this for virtual delivery / for usage without Maildrop
virtual_transport = virtual
#use this for maildrop-delivery / for usage with Maildrop
#virtual_transport = maildrop

[...]
# TLS Mode for SMTP-service
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_use_tls = yes
smtpd_tls_key_file = /path/to/smtpd.pem
smtpd_tls_cert_file = /path/to/smtpd.pem
smtpd_tls_CAFile = /path/to/smtpd.pem
smtpd_tls_loglevel = 0
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unknown_client, reject_non_fqdn_hostname

Since we do not have system users but virtual users (stored in the database), the mail system needs a systempartner to "talk to". The mail system needs a system account under which the system itself can be executed. Here we go:

syscp ~ # groupadd -g 2000 vmail

syscp ~ # useradd -u 2000 -g vmail vmail

syscp ~ # mkdir -p /var/kunden/mail/

syscp ~ # chown -R vmail:vmail /var/kunden/mail/

Note: The system user vmail will have it's home directory set to the SysCP mail directory. Following the standard installation we have this directory: /var/kunden/mail.

SASL is easy to handle. It is used by postfix as an interface to MySQL by the time SMPT-Auth is needed. There is just one configuration file to create:

/etc/postfix/sasl/smtpd.conf

pwcheck_method: auxprop
auxprop_plugin: sql
mech_list: plain login cram-md5 digest-md5
sql_engine: mysql
sql_hostnames: localhost
sql_user: syscp
sql_passwd: MYSQL_PASSWORD
sql_database: syscp
sql_select: select password from mail_users where email='%u@%r'

Again, ATTENTION to avoid whitespaces at the end of the file. Also courier is extremely sensitive for this kind of type errors. Below you find the configfiles for courier-pop and courier-imap.

/etc/courier/authdaemonrc

[...]
authmodulelist="authmysql"
[...]

Courier daemons need to be instructed to have permission to start.

/etc/courier/imapd

[...]
##NAME: IMAPDSTART:0
#
# IMAPDSTART is not used directly.  Rather, this is a convenient flag to
# be read by your system startup script in /etc/rc.d, like this:
#
#  . ${sysconfdir}/imapd
#
#  case x$IMAPDSTART in
#  x[yY]*)
#        /usr/lib/courier/imapd.rc start
#        ;;
#  esac
#
# The default setting is going to be NO, so you'll have to manually flip
# it to yes.

IMAPDSTART=YES

/etc/courier/pop3d

[...]
##NAME: POP3DSTART:0
#
# POP3DSTART is not referenced anywhere in the standard Courier programs
# or scripts.  Rather, this is a convenient flag to be read by your system
# startup script in /etc/rc.d, like this:
#
#  . /etc/courier/pop3d
#  case x$POP3DSTART in
#  x[yY]*)
#        /usr/lib/courier/pop3d.rc start
#        ;;
#  esac
#
# The default setting is going to be NO, until Courier is shipped by default
# with enough platforms so that people get annoyed with having to flip it to
# YES every time.

POP3DSTART=YES

/etc/courier/authmysqlrc (Configfiles -> Debian Sarge -> Courier) is used by the authdaemon to get access to the MySQL database.

Are no errors present, you have your mail system and the complete SysCP installation ready to use.