echo "user@example.com" > /root/.forward

With SELinux, you'll end up getting an AVC denial each time your mail server tries to read the contents of the .forward file:

type=AVC msg=audit(1325543823.787:7416): avc:  denied  { open } for  pid=9850 
  comm="local" name=".forward" dev=md0 ino=17694734 
  scontext=system_u:system_r:postfix_local_t:s0 
  tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

The reason is that your .forward file doesn't have the right SELinux contexts. You can set the correct contest quickly with restorecon:

# ls -Z /root/.forward 
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /root/.forward
# restorecon -v /root/.forward
restorecon reset /root/.forward context unconfined_u:object_r:admin_home_t:s0->system_u:object_r:mail_forward_t:s0
# ls -Z /root/.forward 
-rw-r--r--. root root system_u:object_r:mail_home_t:s0 /root/.forward

Try to send another e-mail to root and you should see the mail server forward the e-mail properly without any additional AVC denials.

SELinux and .forward files is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

First, use mutt to connect to your server remotely (via IMAP over SSL in this example):

mutt -f imaps://mail.yourdomain.com/

Once you've connected and logged in, press SHIFT-D (uppercase d). The status bar of mutt should show:

Delete messages matching:

Type in ~s .* so that the line looks like:

Delete messages matching: ~s .*

When you press enter, mutt will put a D next to all of the messages, which marks them for deletion. Press q to quit, and then y to confirm the deletion. After a brief moment, all of those messages will be deleted and mutt will exit.

Update: If you review Dmitri's comment below, there's an even faster way to remove all of the messages in a mailbox with mutt. Just hold shift while pressing D, ~ (tilde), and A to select everything:

D~A

Deleting all e-mail messages in your inbox with mutt is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

For further details, refer to the Plesk KB article "Mail users cannot get or send mail after upgrade to Plesk 8.4"

Plesk: Upgrade to 8.4 causes "no such user" error in maillog is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

kill -ALRM `pgrep qmail-send`

If for some peculiar reason you don't have pgrep on your server, you can go about it a slightly different way:

kill -ALRM `ps ax | grep qmail-send | grep -v grep | awk '{print $1}'`

Your logs should begin filling up with data about e-mails rolling through the queue.

Forcing qmail to process e-mail in the queue is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

mchk: Unable to initialize quota settings for someuser@somedomain.com

Run this command to fix the issue, but be patient:

find /var/qmail/mailnames -type d -name '.*' ! -name '.spamassassin' -ls -exec touch '{}'/maildirfolder \; -exec chown popuser:popuser '{}'/maildirfolder \;

Thanks to Mike Jackson for this one.

mchk: Unable to initialize quota settings for someuser@somedomain.com is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

If you wanted to limit this to something like 10MB, you can just run the following command:

echo "10485760" > /var/qmail/control/databytes

This will limit the size of messages (including attachments) to 10MB as a maximum.

Setting the maximum mail size in qmail is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

First, toss a line like this into your /etc/fstab:

none    /mailqueue      tmpfs   defaults,size=100m,nr_inodes=999k,mode=775      0       0

This will make a 100MB ramdisk on /mailqueue. Now, just symlink /var/qmail/mqueue to /mailqueue and move your e-mail over:

# mount /mailqueue
# chmod 750 /mailqueue
# chown qmailq:qmail /mailqueue
# mv /var/qmail/mqueue /var/qmail/mqueue-old
# ln -s /mailqueue /var/qmail/mqueue
# rsync -av /var/qmail/mqueue-old /mailqueue

This has significantly cut the iowait on my server during heavy e-mail periods. In addition, tools like qmHandle now fly through my mail queue and give me reports very quickly.

Reduce iowait in Plesk: put qmail's queue on a ramdisk is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Losing q5/qfg9N5EwE3004499: savemail panic
SYSERR(root): savemail: cannot save rejected email anywhere

In this situation, there's some reason why sendmail cannot deliver e-mail to the postmaster address. There's a few issues that can create this problem:

• Missing postmaster alias in /etc/aliases
• Hard disk is full
• The mail spool for the postmaster has the wrong ownership
• The mbox file for the postmaster is over 2GB and procmail can't deliver the e-mail

First, correct the situation that is preventing sendmail from delivering the e-mail to the postmaster user. Then, stop sendmail, clear the e-mail queue, and start sendmail again.

I found this issue on a Red Hat Enterprise Linux 4 server and then found the solution on Brandon's site.

sendmail: savemail panic is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

I decided to do something about it, and here are the steps:

First, you will need two RPMs:
Latest SpamAssassin RPM from Dag
The psa-spamassassin RPM from SWSoft/Parallels.

Once you have them both on the server, install the new SpamAssassin package from Dag:

# rpm -Uvh spamassassin-(version).el4.rf.(arch).rpm

At this point, Plesk's spamassassin scripts will be non-functional, but the next step will fix it:

# rpm -Uvh --force psa-spamassassin-(version).(arch).rpm

NOTE: DO NOT REMOVE the psa-spamassassin RPM. This will begin stripping your system of all SpamAssassin configurations and it cannot be reversed!

Plesk's SpamAssassin scripts have been restored at this point in the process. Now, we need to do the part that really makes SpamAssassin work efficiently:

# sa-update; sa-compile;

This will update the SpamAssassin rules, and it will compile the rules with re2c (you may also need to get this RPM from Dag). This compilation means less disk access, and less CPU time being used to process e-mails.

To activate the compiled rules within SpamAssassin, uncomment the plugin line in /etc/mail/spamassassin/v320.pre:

# Rule2XSBody - speedup by compilation of ruleset to native code
#
loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody

Please bear in mind that this process is done at your own risk. This may cause issues getting support from SWSoft or your hosting company. This has been tested on Red Hat Enterprise Linux 4 64-bit with Plesk 8.1.1, 8.2.0, and 8.2.1 with SpamAssassin 3.2.3 and 3.2.4.

High iowait on RHEL 4 with Plesk and SpamAssassin is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Switch on spam protection based on DNS blackhole lists

Just install the following RPM from Plesk:

psa-qmail-rblsmtpd

Can't enable DNSBL/RBL in Plesk because it's greyed out is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Hi. This is the qmail-send program at yourmailserver.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

Return-Path:
Received: (qmail 14418 invoked by uid 110); 9 Jan 2008 13:04:33 -0600
Delivered-To: 54-user2@domain.com
Received: (qmail 14411 invoked by uid 110); 9 Jan 2008 13:04:33 -0600
Delivered-To: 53-user1@domain.com
Received: (qmail 14404 invoked from network); 9 Jan 2008 13:04:33 -0600
Received: from otherdomain.com (HELO otherdomain.com) (11.22.33.44)
by yourmailserver.com with SMTP; 9 Jan 2008 13:04:33 -0600

Basically, this is qmail's way of letting you know that your e-mails are stuck in a mail loop. One e-mail user is redirecting to another e-mail user, and that e-mail user is redirecting back to the first one. If q-mail already has a delivered to line which matches one that it already added, it bounces the e-mail and halts delivery.

qmail: This message is looping: it already has my Delivered-To line is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

dovecot: imap-login: imap-login: error while loading shared libraries: libsepol.so.1: failed to map segment from shared object: Cannot allocate memory
dovecot: pop3-login: pop3-login: error while loading shared libraries: libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

If you start dovecot, the main dovecot daemon will run with one auth child process, but there will be no POP/IMAP processes started. To fix the issue, open the /etc/dovecot.conf and adjust the following directive:

login_process_size = 64

Restart dovecot after making the change:

# /etc/init.d/dovecot restart

This was tested on RHEL 5.1 x86_64.

Dovecot: libsepol.so.1: failed to map segment from shared object: Cannot allocate memory is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Luckily, you can remove the news feeds pretty easily. Open the following file in your favorite text editor:

/usr/share/psa-horde/templates/portal/sidebar.inc

Once the file is open, drop down to line 102 and comment out the entire if() statement (lines 102-117).

NOTE: If you upgrade Plesk, this change will most likely be reversed.

Removing news feeds in Horde is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

After checking the usual suspects, like MX records, mail account configuration, and firewalls, I was unable to find out why it was occurring. Even after a run of mchk, the emails would not be delivered.

I began testing with a telnet connection to the SMTP port:

$ telnet 11.22.33.44 25
Trying 11.22.33.44...
Connected to 11.22.33.44.
Escape character is '^]'.
220 www.yourserver.com ESMTP
HELO domain.com
250 www.yourserver.com
MAIL FROM: test@test.com
250 ok
RCPT TO: someuser@somedomain.com
421 temporary envelope failure (#4.3.0)
QUIT
221 www.yourserver.com
Connection closed by foreign host.

Temporary envelope failure? I was still confused. After reviewing the logs, I found the following line whenever I tried to telnet to port 25 and send an e-mail:

Dec 2 00:15:49 www relaylock: /var/qmail/bin/relaylock: mail from 44.33.22.11:17249 (yourdesktop.com)

It turns out that the customer was using greylisting in qmail with qmail-envelope-scanner. After a quick check of /tmp/greylist_dbg.txt, I found the entries from me (as well as a lot of other senders), and that ended up being the root of the problem.

Plesk and qmail: 421 temporary envelope failure (#4.3.0) is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Luckily, you can do some fancy work with procmail to have the filtering done server-side.

First, make sure procmail is installed on your server, and change to this directory:

/var/qmail/mailnames/yourdomain.com/yourusername/

Inside that directory, drop in a .procmailrc file which contains the following:

MAILDIR=/var/qmail/mailnames/yourdomain.com/yourusername/Maildir
DEFAULT=${MAILDIR}/
SPAMDIR=${MAILDIR}/.Junk/
:0
* ^X-Spam-Status: Yes.*
${SPAMDIR}

Once that file is in place, move the .qmail file out of the way, and replace it with this:

| /usr/local/psa/bin/psa-spamc accept
|preline /usr/bin/procmail -m -o .procmailrc

Please be aware that these changes will disappear if you make any adjustments to your mail configuration within Plesk. To get around this annoyance, just change the file attributes to immutable:

# chattr +i .qmail .procmailrc

Credit for this trick goes to Russ Wittmann.

Sort e-mail in Plesk with procmail is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

451 qq temporary problem (#4.3.0)

The one thing I love about qmail is its extremely descriptive error messages. Did I say descriptive? I meant cryptic.

Luckily, clamdscan was a bit more chatty in the general system logs:

Nov 12 10:21:17 server X-Antivirus-MYDOMAIN-1.25-st-qms: server.somehost.com119488087677512190] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

Okay, that helps a bit, but this one from /var/log/clamd.log was the big help:

Mon Nov 12 12:20:29 2007 -> ERROR: Socket file /tmp/clamd.socket exists. Either remove it, or configure a different one.

I removed the /tmp/clamd.socket file and clamd began operating properly after a quick restart of the clamd service. This one was pretty easy, but it was not well documented (as I discovered from a little while of Google searching).

clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Here's the steps you will need:

» Log into Plesk
» Click "Server"
» Click "Event Manager"
» Choose "Mail Name Created" next to "Event"
» In the command area, enter /usr/local/psa/bin/mail.sh --update $NEW_MAILNAME -antivirus inout
» Click "OK"

Enabling Dr. Web virus scanning for new accounts is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

If you check your /var/log/maillog, you will generally find errors like these:

Oct 7 09:37:45 mailserver pop3-login: Login: newuser [111.222.333.444]
Oct 7 09:37:45 mailserver pop3(newuser): mbox: Can't create root IMAP folder /home/newuser/mail: Permission denied
Oct 7 09:37:45 mailserver pop3(newuser): Failed to create storage with data: mbox:/var/spool/mail/newuser

Dovecot is telling you that it wants to store some mail-related data in the user's home directory, but it can't get access to the user's home directory. If the home directory doesn't exist, create it and set the permissions properly:

# mkdir /home/newuser
# chown newuser:newuser /home/newuser
# chmod 755 /home/newuser

If the directory is already there, double check the ownership and permissions on the directory. If filesystem acl's or filesystem quotas might be in play, be sure to check those as well.

Dovecot: mbox: Can't create root IMAP folder is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Error opening /var/lib/squirrelmail/prefs/default_pref
Could not create initial preference file!
/var/lib/squirrelmail/prefs/ should be writable by user apache
Please contact your system administrator and report this error.

No matter what you do to the /var/lib/squirrelmail/prefs/default_pref file, even if you chmod 777 the file, you will still get the error. If you check the /etc/php.ini, you will normally find safe_mode set to on.

;
; Safe Mode
;
safe_mode = Off

Simply change safe_mode to off and reload Apache. If you try to log into squirrelmail again, it should complete successfully. I've tested this on Red Hat Enterprise Linux 4:

# rpm -q squirrelmail
squirrelmail-1.4.8-4.0.1.el4

Plesk: Error opening /var/lib/squirrelmail/prefs/default_pref is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Too many filters / Giant whitelists and blacklists
This is the biggest cause that I've seen. Some users will create gigantic white and black lists (upwards of 5,000 is my record that I've seen) and this makes Horde compare each and every message in the inbox against these lists upon login. This also applies to filters as Plesk does not use sieve/procmail for mail delivery. Horde is forced to do all of the filtering upon login (in some versions) and this can cause extreme delays.

Mailbox is gigantic
I've seen Horde logins take quite a while in mailboxes that are over 500MB in size. If the size of your e-mails is large, and you have a large mailbox with fewer e-mails, Horde can normally work quickly. But, if your inbox is full of tiny e-mails, Horde takes a long time to fully index your mail and display the list (even though it only displays 25-30 at a time).

Too many users logged into Horde simultaneously
In my opinion, Horde's CPU and memory requirements are too large for a webmail application. I've seen 30-40 simultaneous Horde sessions bring a dual-core box with 2-4GB of RAM and SCSI disks to its knees. Consider installing squirrelmail or roundcube webmail for some of your users and urge them to use it instead.

IOwait caused by something else
Sometimes the server can simply be bogged down with other requests from other daemons, and this slows Horde down. Make sure that your MySQL installation is tuned properly, and that users are not abusing scripts running through Apache.

Slow Horde login process with Plesk is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

You may see an error message in Horde that looks like this:

Your Internet Address has changed since the beginning of your Mail session. To protect your security, you must login again.

You'll normally have this variable in /etc/psa-horde/horde/conf.php:

# $conf['auth']['checkip'] = true;

You can disable this ip check functionality which breaks sessions for AOL users by setting it to false:

# $conf['auth']['checkip'] = false;

Session problems with Horde in Plesk with AOL is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Postfix Configuration Parameters: bounce_queue_lifetime

Adjusting postfix queue time / lifetime is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

http://spamassassin.apache.org/gtube/gtube.txt

SpamAssassin will always mark e-mails that contain this special line as spam:

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

Testing SpamAssassin with GTUBE is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

This is because UW-IMAP only supports mbox files in RHEL 2.1. This means your e-mail ends up in one big file which has each e-mail listed one after another. This is a simple way to handle mail, but it scales in a horrible fashion.

Daniel Bernstein, the creator of qmail, created maildir, and (as much as I hate anything relating to qmail) it's the best method for storing mail that I've seen so far.

Mbox files are slower because the entire file must be scanned when the POP or IMAP daemon receive a request for an e-mail held within it. That means that the daemon must scan through all of the e-mails until the one that it wants is found. If sendmail wants to drop off e-mail for the user, it has to wait since the mail spool is locked. If it can't deliver the e-mail, it may bounce it after a period of time.

This is especially awful if a user receives a fair amount of e-mail and checks their e-mail from a mobile device. This means that their computer and the mobile device are making the mail daemons scan the mbox file repeatedly when they check in. It causes sendmail to back up, disk I/O skyrockets, and the server performance as a whole can suffer.

The solution is to move to a newer version of RHEL, hopefully RHEL 4 or 5 where Postfix and maildir support are available. The only fix on RHEL 2.1 is to ask the user to clear out their mailbox to reduce the amount of disk I/O required to pick up e-mail.

Slow IMAP and POP3 performance with large mailboxes on RHEL 2.1 is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

I downloaded the new Growl 1.1 tonight and I wanted to install GrowlMail to get mail notifications from Apple Mail. I went through the package installer, started Mail, and nothing happened. The preference pane didn't exist either. After doing a bit of forum digging, I found these two commands to run in the terminal:

defaults write com.apple.mail EnableBundles 1
defaults write com.apple.mail BundleCompatibilityVersion 2

It worked like a charm and I was all set. If you haven't tried it out yet, download the new Growl 1.1 and install it. There's a ton of new features, and it's been worth the wait.

Getting GrowlMail working with Apple Mail in Growl 1.1 is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.