Dkimproxy and postfix on suse

note, originally by Chris, I'm putting it here to clear out my mailbox:

How to set up SUSE as a mail server:

1. Install SUSE. I downloaded a CD and kept all the defaults. Reboot when prompted.

2. Patch SUSE. This should happen automatically after the reboot, right after you've set up the root password and that kind of stuff. Reboot again.

3. After patches are done, you'll be logged into your desktop. Start yast2, click "community repositories", and make sure that the "Main Repository (OSS) has a checkmark by it. Postfix should be installed by default. (If it's not, download a package.) If anything seems to be missing at any point, try to install an appropriate package through yast2.

Edit the firewall to allow the mail server access to the outside world.

 Start yast2, click "firewall", click "allowed services", select "mail

server" from the service to allow dropdown, and click "add." Then click next, verify that this is what you want.

Confirm that Postfix is running by telnetting from another box:

 # telnet <mailserver> 25
 Trying <IP of mailserver>...
 Connected to mailserver
 Escape character is '^]'
 220 <mailserver.domain.tld> ESMTP Postfix

You'll probably want to edit the /etc/postfix/main.cf file if any of those values look incorrect. In particular, the myhostname, mydomain, and mydestination parameters. If you change the config file, restart postfix:

 # rcpostfix restart

Configure postfix further as desired.

4. Install DKIMproxy

First you'll need some perl modules. Fire up cpan.

 # cpan

Answer the configuration script's questions, then type:

 > install Mail::DKIM

Answer "yes" to everything about missing dependencies. CPAN will download and install the DKIM module and its prerequisites. You will have to build some stuff, so make sure make, gcc, and libopenssl-devel are installed. If the DKIM tests seem to fail erratically, try "force install Mail::DKIM". Also install Net::Server and Error:

 > install Net::Server
 > install Error

Exit CPAN. Next, create a user and group to run the DKIM filter:

 # groupadd dkim
 # useradd -g dkim dkim

5. Set up DKIMproxy

Download the DKIMproxy distribution from http://downloads.sourceforge.net/dkimproxy/dkimproxy-1.0.1.tar.gz . Untar it somewhere convenient, thus:

 # tar xzvf dkimproxy-1.0.1.tar.gz
 # cd dkimproxy-1.0.1

Install dkimproxy to an appropriate location. We're using the default:

 # ./configure --prefix=/usr/local/dkimproxy

Set up the init script so that DKIMproxy will run at boot:

 # cp sample-dkim-init-script.sh /etc/init.d/dkimproxy
 # ln -s ../dkimproxy /etc/init.d/rc5.d/S11dkimproxy
 # ln -s ../dkimproxy /etc/init.d/rc5.d/K11dkimproxy

Substitute the appropriate runlevel directory where it says "rc5.d". For example, a text-only system will likely default to rc3.d

Generate a keypair

 # cd /usr/local/dkimproxy/etc
 # openssl genrsa -out dkim-private.key 1024
 # openssl rsa -in dkim-private.key -out dkim-public.key
 # chown dkim dkim-private.key
 # chmod 400 dkim-private.key

Edit the dkimproxy config files:

 # cd /usr/local/dkimproxy/etc
 # cp dkimproxy_out.conf.example dkimproxy_out.conf
 # cp dkimproxy_in.conf.example dkimproxy_in.conf

Edit /usr/local/dkimproxy/etc/dkimproxy_out.conf.

Make sure that the domain is correct (for example we set prgmr.com) and the keyfile location is correct. If you're following along precisely, the keyfile should be /usr/local/dkimproxy/etc/dkim-private.key If you opt to use a different selector, set that here and in the next step. (The particular selector isn't important. It's just a text identifier.)

6. Configure DNS

The entire point of DomainKeys is to match cryptographic signatures on mail to txt records in DNS. Create an appropriate record on your DNS server, in the appropriate zone file.

 selector1._domainkey IN TXT "k=rsa t=s p=<public key>"

Note the <public key> in this record. This should be the full contents of the dkim-public.key file, minus the two framing lines (the ones that begin with dashes and say BEGIN or END.) All on one long line.

7. Start dkimproxy:

 # /etc/init.d/dkimproxy start

8. Set up Postfix to use DKIMproxy

Edit /etc/postfix/master.cf

Anywhere in the file, add lines that look like the following. (Taken from the howto at dkimproxy.sourceforge.net):

---

BEGIN CONF SNIPPET-----

2. modify the default submission service to specify a content filter
3. and restrict it to local clients and SASL authenticated clients only

submission inet n - n - - smtpd

    -o smtpd_etrn_restrictions=reject
    -o smtpd_sasl_auth_enable=yes
    -o content_filter=dksign:[127.0.0.1]:10027
    -o receive_override_options=no_address_mappings
    -o

smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

2. specify the location of the DKIM signing proxy
3. Note: the smtp_discard_ehlo_keywords option requires a recent version of
4. Postfix. Leave it off if your version does not support it.

dksign unix - - n - 10 smtp

    -o smtp_send_xforward_command=yes
    -o smtp_discard_ehlo_keywords=8bitmime,starttls

2. service for accepting messages FROM the DKIM signing proxy

127.0.0.1:10028 inet n - n - 10 smtpd

    -o content_filter=
    -o

receive_override_options=no_unknown_recipient_checks,no_header_body_checks

    -o smtpd_helo_restrictions=
    -o smtpd_client_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8

---

END CONF SNIPPET-----

Reload postfix so that it notices the change:

 # postfix reload

9. Test the mail server

Note that we've set up postfix to accept outgoing mail using the submission service, which runs on port 587. Configure the mail-sending program to send mail via that port.

Test outgoing mail by sending some mail to test@dkimtest.jason.long.name. This address will send back a message indicating whether the mail wasor was not correctly signed.