Difference between revisions of "SME Server:Documentation:FAQ/fr"

Backup MX

linux all-generic-ide

CentOS - os
CentOS - updates
SME Server - addons
SME Server - extras
SME Server - os
SME Server - updates.

/sbin/e-smith/audittools/repositories

base: enabled
updates: enabled
smeaddons: enabled
smeextras: enabled
smeos: enabled
smeupdates: enabled

yum update dbus dbus-glib smeserver-support smeserver-yum yum yum-plugin-fastest-mirror python-sqlite 
signal-event post-upgrade; signal-event reboot

signal-event post-upgrade; signal-event reboot

Attention : les options de configuration de SSH et de rkhunter doivent être les mêmes :
        SSH configuration option 'PermitRootLogin': yes
        Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no

rpm -e rkhunter

yum install smeserver-rkhunter --enablerepo=smecontribs

config setprop yum check4updates weekly;signal-event yum-modify

config setprop yum check4updates weekly;signal-event yum-modify

config delprop yum check4updates;signal-event yum-modify

yum clean metadata
ou peut-être
yum clean all --enablerepo=*
puis
yum update

http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz: 
[Errno -1] Metadata file does not match checksum Trying other mirror.
Error: failure: repodata/primary.xml.gz from dag: [Errno 256] No more mirrors to try.

wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/filelists.xml.gz
wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz
wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/repomd.xml
yum update

---> Downloading header for php-mysql to pack into transaction set.
php-mysql-4.3.9-3.22.15.i 100% |=========================|  37 kB    00:00
http://sme-mirror.firewall-services.com/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete.
Trying other mirror.

rpm -qa | sort | less 

rpm -e --nodeps rpmname

yum install rpmname
signal-event post-upgrade; signal-event reboot

db yum_repositories delete nom_du_depôt
signal-event yum-modify

db yum_repositories nom_du_depôt setprop status disabled
signal-event yum-modify

yum update --enablerepo=nom_du_depôt  nom_du_paquet

rpm -e nom_du_paquet

RoundUpWriteTimeOnSync
HKLM\Software\Microsoft\Windows\CurrentVersion\NetCache
 yum install mod_perl
 config setprop modPerl status enabled
 signal-event post-upgrade ; signal-event reboot

 db accounts setprop //ibayname// Indexes disabled 
 signal-event ibay-modify //ibayname// 

db accounts setprop ibayname PHPBaseDir /tmp/:/home/e-smith/files/ibays/ibayname/
signal-event ibay-modify ibayname

  single

 passwd root
 passwd admin

db domains setprop test.com Nameservers a.b.c.d
signal-event domain-modify

cat /var/service/dnscache/root/servers/test.com

db domains set <nom_de_domaine> domain-remote Nameservers 4.2.2.1
signal-event domain-modify

db domains set <nom_de_domaine> domain-remote Nameservers localhost
signal-event domain-modify

config setprop clamav FilesystemScanFilesystems /home/e-smith/files

config setprop clamav FilesystemScanFilesystems "/home/e-smith/files /opt"

 config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var

config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var,/home/e-smith/files/ibays

signal-event clamav-update

db domains set proxypassdomaine.com domain 
db domains setprop proxypassdomaine.com Nameservers internet
db domains setprop proxypassdomaine.com ProxyPassTarget http://xxx.xxx.xxx.xxx/
db domains setprop proxypassdomaine.com TemplatePath ProxyPassVirtualHosts 
signal-event domain-create proxypassdomaine.com

db domains delete proxypassdomaine.com
signal-event domain-delete proxypassdomaine.com

db accounts set extra ProxyPass
db accounts setprop extra Target http://192.168.1.35
db accounts setprop extra Description InternalServer
db accounts setprop extra HTTP on
db accounts setprop extra HTTPS on
db accounts setprop extra ValidFrom 80.90.100.0/24,74.125.93.105
expand-template /etc/httpd/conf/httpd.conf
sv t httpd-e-smith

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
cd /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
echo '# ProxyPass Support for Internal Exchange Server
        ProxyPreserveHost On
        #OWA % character in email subject fix
        RewriteEngine On
        RewriteMap percentsubject int:escape
        RewriteCond $1 ^/exchange/.*\%.*$
        RewriteRule (/exchange/.*) ${percentsubject:$1} [P]
        #OWA
        ProxyPass /exchange https://a.b.c.d/exchange
        ProxyPassReverse /exchange https://a.b.c.d/exchange
        ProxyPass /Exchange https://a.b.c.d/exchange
        ProxyPassReverse /Exchange https://a.b.c.d/exchange
        ProxyPass /exchweb https://a.b.c.d/exchweb
        ProxyPassReverse /exchweb https://a.b.c.d/exchweb
        ProxyPass /public https://a.b.c.d/public
        ProxyPassReverse /public https://a.b.c.d/public
        ProxyPass /iisadmpwd https://a.b.c.d/iisadmpwd
        ProxyPassReverse /iisadmpwd https://a.b.c.d/iisadmpwd
        #OMA
        ProxyPass /oma https://a.b.c.d/oma
        ProxyPassReverse /oma https://a.b.c.d/oma
        #ActiveSync (for WM5+ devices)
        ProxyPass /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
        ProxyPassReverse /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
        #Force 'RequestHeader' in order to get IE to work
# End of Exchange settings
' > 91ProxyPassOWA
expand-template /etc/httpd/conf/httpd.conf
sv restart httpd-e-smith

# Trasnfert de remote.domaineA.com vers iis.private.local
 <VirtualHost 0.0.0.0:80>
 ServerName remote.domaineA.com
 ProxyPass / http://iis.private.local/
 ProxyPassReverse / http://iis.private.local/
 </VirtualHost>
 <VirtualHost 0.0.0.0:443>
 ServerName remote.domaineA.com
 ProxyPass / https://iis.private.local/
 ProxyPassReverse / https://iis.private.local/
# Preserve meta info in the http line as a resolvable request
 ProxyPreserveHost On
#OWA % caractère dans la correction de l'objet de courriel
 RewriteEngine On
 RewriteMap percentsubject int:escape
 RewriteCond $1 ^/exchange/.*\%.*$
 RewriteRule (/exchange/.*) ${percentsubject:$1} [P]
#OWA
 ProxyPass /exchange https://iis.private.local/exchange
 ProxyPassReverse /exchange https://iis.private.local/exchange
 ProxyPass /owa https://iis.private.local/owa
 ProxyPassReverse /owa https://iis.private.local/owa
 ProxyPass /Exchange https://iis.private.local/exchange
 ProxyPassReverse /Exchange https://iis.private.local/exchange
 ProxyPass /exchweb https://iis.private.local/exchweb
 ProxyPassReverse /exchweb https://iis.private.local/exchweb
 ProxyPass /public https://iis.private.local/public
 ProxyPassReverse /public https://iis.private.local/public
 ProxyPass /iisadmpwd https://iis.private.local/iisadmpwd
 ProxyPassReverse /iisadmpwd https://iis.private.local/iisadmpwd
#OMA
 ProxyPass /oma https://iis.private.local/oma
 ProxyPassReverse /oma https://iis.private.local/oma
#ActiveSync (pour les périphériques WM5+)
 ProxyPass /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync
 ProxyPassReverse /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync
# Fin des paramétrages d'Exchange
</VirtualHost>

expand-template /etc/httpd/conf/httpd.conf
sv restart httpd-e-smith

   Autres ressources utiles :

 Gestionnaire du serveur -> Sécurité -> Accès à distance

db accounts setprop nom_de_l_utilisateur Shell /bin/bash
chsh -s /bin/bash nom_de_l_utilisateur

/sbin/e-smith/db configuration set maxIbayNameLength xx
/sbin/e-smith/db configuration set maxAcctNameLength xx
/sbin/e-smith/db configuration set maxGroupNameLength xx

/sbin/e-smith/signal-event console-save

signal-event user-delete <nom_utilisateur>
db accounts delete <nom_utilisateur>

signal-event ibay-delete <nom_baie>
db accounts delete <nom_baie>

signal-event group-delete <nom_groupe>
db accounts delete <nom_groupe>

 Solution : se déconnecter après la création du groupe et puis se reconnecter.

 perl -e "use esmith::util;esmith::util::setUserPassword( 'username', 'password');";  /sbin/e-smith/signal-event  password-modify username

 «username»

 «password»

config setprop passwordstrength Admin strengthvalue
config setprop passwordstrength Users strengthvalue
config setprop passwordstrength Ibays strengthvalue

config setprop passwordstrength Users normal

config show passwordstrength

passwordstrength=configuration
 Admin=strong
 Ibays=strong
 Users=strong

config setprop flexbackup TapeBlocksize 512

config setprop flexbackup Blocksize 256
config setprop flexbackup BufferMegs 16

config set PasswordSet no 
signal-event post-upgrade; signal-event reboot 

-MAINTENANT branchez la clé USB (ne pas brancher la clé USB avant d’atteindre ce point).
-choisir OUI ou RESTAURER (ou n'importe quoi d'autre qui est présenté).

ps ax | grep runsv

man sv

signal-event post-upgrade;  signal-event reboot

rm /home/e-smith/ssl.key/*.key
rm /home/e-smith/ssl.pem/*.pem
rm /home/e-smith/ssl.crt/*.crt
signal-event domain-modify; signal-event reboot

ssh -L 443:localhost:443 root@ip-sme-or-hostname-sm

ssh -L 9443:localhost:443 root@votre-ip-distante -p 22

https://localhost:9443/server-manager

db hosts setprop <local.ma societe.local> static no

yum install kernel-smp kmod-ppp-smp kmod-slip-smp kmod-appletalk-smp
signal-event post-upgrade
signal-event reboot

db configuration setprop smb UnixCharSet ISO8859-1
expand-template /etc/smb.conf
/etc/init.d/smb restart

config set SquidParent a.b.c.d
config set SquidParentPort nnn
signal-event post-upgrade
signal-event reboot

mkdir -p /etc/e-smith/templates-custom/etc/yum.conf
cd /etc/e-smith/templates-custom/etc/yum.conf
echo '{
    my $YumProxy = $yum{'Proxy'} || "none";
    $OUT = ($YumProxy eq "none") ? "" : "proxy=$YumProxy";
}' > 10main_proxy
config setprop yum Proxy http://localhost:3128/
expand-template /etc/yum.conf

http://localhost:3128
/etc/e-smith/templates/etc/freshclam.conf/ProxySettings
config setprop clamav HTTPProxyServer localhost
config setprop clamav HTTPProxyPort 3128
config setprop clamav HTTPProxyUsername ""
config setprop clamav HTTPProxyPassword ""
expand-template /etc/freshclam.conf
sv t freshclam

export http_proxy='http://localhost:3128'
export http_proxy=localhost:3128

export http_proxy=localhost:3128
curl http://www.google.com

export http_proxy=localhost:3128
 curl http://www.google.com

/var/log/squid/access.log:
1329759611.923     64 127.0.0.1 TCP_MISS/301 726 GET http://www.google.com - DIRECT/74.125.113.94 text/html

sme

sme raid=[none,0,1,5,6]

sme spares=[0-(disks-2)]

sme drives=[hda,sda,xvda,...]

sme exclude= sdc

sme raid=0

sme nolvm

sme multipart

sme dd

sme ide=nodma

sme dmraid

sme ide=nodmraid

sme acpi=off

sme pci=nommconf acpi=off all-generic-ide 

sme rescue

sme ext4

quotaoff -a

sme noprobe

sme noraid noprobe

sme <options>

sme mem=128M noprobe

sme rescue

mount -n -o remount /

memtest

qmail            - details mail distribution (to mailboxes and to other hosts via SMTP). Traces connections, message numbers, bytes, concurrency, and UID.
imap             - connections to the server IMAP folders (IMAP). Shows connections from local device unless IMAP enabled for internet access. Use in conjunction with other logs to trace email.
imaps            - secure connections to the server IMAP folders (IMAPS). Shows connections from local devices unless IMAPS enabled for internet access. Use in conjunction with other logs to trace email.
pop3             - Details connections via pop3 to the server. 
pop3s            - Details connections via pop3s to the server.
smtp-auth-proxy
maillog          - nothing. Empty.
qpsmtpd          - incoming SMTP connections.
sqpsmtpd         - incoming Secure SMTP connections. Authenticated SMTP Via SSL port 465.
clamav           - antivirus
clamd
freshclam        
spamd            - spam

httpd
httpd-admin
squid
squid.run
qpdmtpd

messages
dnscache
iptables
iptraf
mysqld
nmbd
ntpd
oidentd
ppp
yum
tinydns
wan
vbox
cron
sshd
flexbackup
dhcpd
dhcpcd
dmesg
pppoe
pptpd
spooler
radius
radiusd
proftpd
raidmonitor
rpmpkgs
sa
samba
secure
rkhunter.log
boot.log
audit
anaconda.log
anaconda.syslog
lastlog

yum remove sysstat

cat /var/log/samba/* |grep printing |grep 'rec_read bad magic'

rm /var/cache/samba/printing/<printer>.tdb
/etc/init.d/smbd restart

rules: score undef for rule 'MISSING_SUBJECT' in  'MISSING_SUBJECT' at
/usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 2140.

2008-02-21 23:42:51.106904500 ClamAV update process started at Thu Feb 21 23:42:51 2008
2008-02-21 23:42:51.108696500 WARNING: Your ClamAV installation is OUTDATED!
2008-02-21 23:42:51.108700500 WARNING: Local version: 0.92 Recommended version: 0.92.1
2008-02-21 23:42:51.108704500 DON'T PANIC! Read http://www.clamav.net/support/faq
2008-02-21 23:42:51.108708500 main.inc is up to date (version: 45, sigs: 169676, f-level: 21, builder: sven)
2008-02-21 23:42:51.523757500 ERROR: cdiff_apply: lseek(desc, -350, SEEK_END) failed
2008-02-21 23:42:51.523760500 ERROR: getpatch: Can't apply patch
2008-02-21 23:42:51.523764500 WARNING: Incremental update failed, trying to download daily.cvd
2008-02-21 23:42:52.322303500 WARNING: Mirror 193.1.193.64 is not synchronized.

2008-02-22 00:44:14.874648500 Ignoring mirror 193.1.193.64 (due to previous errors)
2008-02-22 00:44:14.878360500 ERROR: Can't download daily.cvd from database.clamav.net
2008-02-22 00:44:14.879769500 Giving up on database.clamav.net...

cd /var/clamav/
mv mirrors.dat mirrors.dat.old
sv t /service/freshclam

LibClamAV Warning: Detected duplicate databases /var/clamav/main.cvd and /var/clamav/main.cld, 
please manually remove one of them

config setprop sshd Protocol 2
signal-event remoteaccess-update

tracepath google.com

config setprop InternalInterface MTU 1492
signal-event post-upgrade; signal-event reboot

Apr 20 17:29:53 mail [4614]: PHP Fatal error:  Call to a member function on a non-object in /home/httpd/html/horde/imp/lib/Block/tree_folders.php on line 65
Apr 20 17:29:53 mail [4614]: PHP Warning:  Unknown(): Unable to call () - function does not exist in Unknown on line 0

https://servername/webmail

db accounts setprop USERNAME SortSpam disabled
db accounts show USERNAME                                   # only displays settings
signal-event user-modify USERNAME

config setprop spamassassin SortSpam enabled
signal-event email-update

db configuration setprop spamassassin MessageRetentionTime 60  
signal-event email-update 

/usr/bin/yum install --enablerepo=smecontribs smeserver-qpsmtpd-spamassassinlevelstars
signal-event email-update

db configuration setprop spamassassin MaxMessageSize 2000000 

signal-event email-update

mkdir -p /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf
cd /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf
echo "score SARE_ADULT2 20.000" >> 20localscores
signal-event email-update

nano -w /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores
signal-event email-update

rm -f /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
echo sender_permitted_from spf_deny 1 > 30spf
/sbin/e-smith/expand-template /var/service/qpsmtpd/config/peers/0

echo "score SPF_SOFTFAIL 6.000" >> 20localscores 
echo "score SPF_FAIL 14.000" >> 20localscores
signal-event email-update

mkdir -p /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout
cd /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout
nano 50pyzor_timeout

{
  my $pyzor_timeout = ($spamassassin{PyzorTimeout} || 0);
  if ($pyzor_timeout ne '0')
  {
     return "pyzor_timeout " . ($pyzor_timeout);
  }
}

config setprop spamassassin PyzorTimeout 15
signal-event email-update

db spamassassin setprop wbl.global *@vonage.com White
db spamassassin setprop wbl.global *domain2.com White
db spamassassin setprop wbl.global user@domain3.com White
db spamassassin setprop wbl.global spammer@spamdomain.com Black

db spamassassin setprop wbl.global *@*.xyz Black
db spamassassin setprop wbl.global *@*.link Black

signal-event email-update

db spamassassin show

sa-learn --dump magic

tail -50 /var/log/spamd/current | tai64nlocal

spamassassin -D --lint

warn: bayes: cannot open bayes databases /etc/mail/spamassassin/bayes_* R/W: tie failed: Permission denied

chown :spamd /var/spool/spamd/.spamassassin/*
chmod g+rw /var/spool/spamd/.spamassassin/*

config setprop qpsmtpd DNSBL enabled RHSBL enabled
signal-event email-update

config show qpsmtpd

config setprop qpsmtpd RBLList <rbl-list-name>
signal-event email-update

config setprop qpsmtpd RBLList zen.spamhaus.org
signal-event email-update

config setprop qpsmtpd SBLList dbl.spamhaus.org
signal-event email-update

config setprop qpsmtpd SBLList multi.surbl.org:rhsbl.sorbs.net:dbl.spamhaus.org
signal-event email-update

      combined.njabl.org
      list.dsbl.org
      multihop.dsbl.org
      dnsbl.ahbl.org

      blackhole.securitysage.com
      bulk.rhs.mailpolice.com
      fraud.rhs.mailpolice.com
      porn.rhs.mailpolice.com
      adult.rhs.mailpolice.com
      bogusmx.rfc-ignorant.org
      ex.dnsbl.org

config setprop spamassassin UseBayes 1
config setprop spamassassin BayesAutoLearnThresholdSpam 6.00
config setprop spamassassin BayesAutoLearnThresholdNonspam 0.10
config setprop spamassassin UseBayesAutoLearn 1
expand-template /etc/mail/spamassassin/local.cf
sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_*
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex
chmod 640 /var/spool/spamd/.spamassassin/bayes_* 
config setprop spamassassin status enabled
config setprop spamassassin RejectLevel 12
config setprop spamassassin TagLevel 4
config setprop spamassassin Sensitivity custom
config setprop spamd SpamLearning enabled
signal-event email-update

Note: SpamAssassin requires at least 3 points from the header, and 3 points from the body
to auto-learn as spam.
Therefore, the minimum working value for this option is 6, to be changed in increments of 3,
12 considered to be a good working value..

sa-learn --dump magic

#!/bin/bash
#  ContaLearn.sh

#for compatibility with older versions without rpm, testing
[  `/sbin/e-smith/db configuration getprop LearnAsSpam dir` ] &&
LearnAsSpam=`/sbin/e-smith/db configuration getprop LearnAsSpam dir` || LearnAsSpam='LearnAsSpam';
[  `/sbin/e-smith/db configuration getprop LearnAsHam dir` ] &&
LearnAsHam=`/sbin/e-smith/db configuration getprop LearnAsHam dir` || LearnAsHam='LearnAsSpam';
JunkMail='junkmail';

echo
date
declare -i tspam
declare -i tham
declare -i tleft
declare -i tnseen

printf "%-25s %-11s %-11s %-11s %-11s \n" "User" "LearnAsSpam" "LearnAsHam" "JunkMail" "NotSeen"
pushd /home/e-smith/files/users/ >>/dev/nul
for u in `ls ` #| grep -v admin`
do
[ "$u" = "admin" ] && mailpath="/home/e-smith/" ||  mailpath="/home/e-smith/files/users/$u" ;
  spam=`ls -1 $mailpath/Maildir/.$LearnAsSpam/cur |wc -l`
  ham=`ls -1 $mailpath/Maildir/.$LearnAsHam/cur |wc -l`
  left=`ls -1 $mailpath/Maildir/.$JunkMail/cur |wc -l`
  nseen=`ls -1 $mailpath/Maildir/.$JunkMail/new |wc -l`
  if  [[ $spam > 0 ]] || [[ $ham > 0 ]] || [[ $left > 0 ]] || [[ $nseen > 0 ]];   then
     printf "%-25s %-11d %-11d %-11d %-11d \n" $u $spam $ham $left $nseen
  fi
  tspam=$tspam+$spam
  tham=$tham+$ham
  tleft=$tleft+$left
  tnseen=$tnseen+$nseen
done
echo "----------------------------------------------------------------------"
printf "%-25s %-11d %-11d %-11d %-11d \n" "Total:" $tspam $tham $tleft $tnseen
echo
popd >>/dev/nul

config setprop spamassassin UseBayes 0
signal-event email-update
'rm' /var/spool/spamd/.spamassassin/bayes* 

config setprop spamassassin UseBayes 1
expand-template /etc/mail/spamassassin/local.cf
sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_*
chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex
chmod 640 /var/spool/spamd/.spamassassin/bayes_* 
signal-event email-update

config setprop clamav HeuristicScanPrecedence yes
expand-template /etc/clamd.conf
sv t clamd

db configuration getprop imap ConcurrencyLimit || echo 400
db configuration getprop imap ConcurrencyLimitPerIP || echo 12

config setprop imap ConcurrencyLimitPerIP 20
config setprop imaps ConcurrencyLimitPerIP 20
signal-event post-upgrade; signal-event reboot

config show imap

tail -f /var/log/dovecot/current | tai64nlocal  #out of date

tcpsvd: info: pid 30693 from 10.1.0.104
tcpsvd: info: concurrency 30693 10.1.0.104 21/20
tcpsvd: info: deny 30693 0:10.1.0.21 ::10.1.0.104:49332 ./peers/10.1.0

-open OUTLOOK
-click TOOLS > ACCOUNTS
-click CHANGE (on the right-hand side)
-find INCOMING MAIL SERVER & OUTGOING MAIL SERVER (on right-hand side)
-type: mail.yourdomain.tld (in both places)
-click MORE SETTINGS (on bottom-right)
-click OUTGOING SERVER tab (at the top)
-checkmark "MY OUTGOING SERVER REQUIRES AUTHENTICATION"
-bullet "USE SAME SETTINGS AS INCOMING MAIL SERVER"
-click ADVANCED tab (at the top)
-find OUTGOING SERVER
-checkmark "THIS SERVER REQUIRES A SECURE CONNECTION" (under outgoing server)
-change 25 to 465
-[possibly required, secure IMAP is 993]
-click OK > NEXT > FINISHED
-you're finished, your email should work now

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb] 
"ProtectionPolicy"=dword:00000001

 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.2\Client]
 "DisabledByDefault"=dword:00000001
 "Enabled"=dword:00000000

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
echo "# 17check_basicheaders disabled by custom template" > \
17check_basicheaders
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
echo "# 17check_basicheaders disabled by custom template" > \
17check_basicheaders
signal-event email-update

1. Login to your Mac as a user with administrative privileges

2. Open Safari and browse to https://smeserver/server-manager.  
   When you receive the warning about your certificate:
   - click on "Show Certificate"
   - click and drag the gold-rimmed image of a certificate to your desktop.  
   You will now have myserver.mydomain.tld.cer on your desktop.

3. Locate and open the Microsoft Cert Manager
   - "Import" the certificate you downloaded in step 2.

4. Highlight the imported certificate and "Export" it. 
   - Select the "PEM..." format
   - add "pem." to the beginning of the filename
   - export it to your Desktop

5. Double-click on the new pem.myserver.mydomain.tld.cer  
   - Apple's Keychain Access application will open.
   - Select the X509Anchors Keychain and click "OK"

6. While still in Apple's Keychain Access, select the "Certificates" category
   - Drag pem.myserver.mydomain.tld.cer into the certificates window.

config setprop qmail ConcurrencyLocal 6
signal-event email-update

config setprop qmail ConcurrencyRemote 10
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/qmail/control
echo 172800 > /etc/e-smith/templates-custom/var/qmail/control/queuelifetime
expand-template /var/qmail/control/queuelifetime
sv t qmail

config setprop qmail DoubleBounceTo someoneuser
signal-event email-update

config setprop qmail DoubleBounceTo devnull
signal-event email-update

config setprop qpsmtpd Bcc enabled
signal-event email-update

config setprop qpsmtpd BccMode bcc

config setprop qpsmtpd BccUser someuser

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/13bcc /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/
nano -w 13bcc

{
     return "# bcc disabled" unless ($qpsmtpd{Bcc} eq "enabled");
     return "bcc mode " . $qpsmtpd{BccMode} . " outgoing " . $qpsmtpd{BccUser};
}

signal-event email-update

perldoc /usr/share/qpsmtpd/plugins/bcc

config setprop smtpd HeloHost mydomainname
signal-event email-update

config set DomainName mydomainname
signal-event domain-modify
signal-event email-update

signal-event email-update

 db configuration setprop spamassassin MaxMessageSize 2000000 

signal-event email-update

config setprop horde Name "MyDomain Mail"
signal-event email-update

config setprop horde Administration enabled 
signal-event email-update

Mar 13 00:00:12 box1 httpd: PHP Fatal error:  Allowed memory size of 33554432 bytes exhausted (tried to allocate 154 bytes) in /home/httpd/html/horde/imp/lib/MIME/Contents.php on line 173

Allowed memory size of 33554432 bytes exhausted (tried to allocate 0 bytes)

db configuration setprop php MemoryLimit XXM
expand-template /etc/php.ini
sv t httpd-e-smith

db accounts setprop groupname/username/pseudonym Visible internal
signal-event email-update

db accounts delprop groupname/username/pseudonym Visible
signal-event email-update

db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts setprop $USER Visible internal; done
signal-event email-update

db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts delprop $USER Visible; done
signal-event email-update

-login to SERVER-MANAGER
-click DOMAINS (on the left)
-click ADD
-type: mail.domain.tld

config set qpsmtpd UnauthenticatedRelayClients IP1,IP2,IP3
signal-event email-update

db networks setprop {$network} RelayRequiresAuth disabled
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients
# a subnetwork by only using a prefix of full ip
echo "10.10.0.">>  /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
# an external ip
echo "99.10.1.23" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
# an external network you control
echo "164.163.12.1/30" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
signal-event email-update

config setprop qpsmtpd RelayRequiresAuth disabled
signal-event email-update

config setprop qpsmtpd TlsBeforeAuth 0
signal-event email-update

config setprop qpsmtpd TlsBeforeAuth 1
signal-event email-update

<internet providers mail server name or ip-address>:<alternative port>

config setprop smtpd disclaimer enabled
nano -w /service/qpsmtpd/config/disclaimer

Ctrl o
Ctrl x

signal-event email-update

rm  /service/qpsmtpd/config/disclaimer
config setprop smtpd disclaimer enabled
nano -w /service/qpsmtpd/config/disclaimer_domain1.com.au
nano -w /service/qpsmtpd/config/disclaimer_domain2.com
nano -w /service/qpsmtpd/config/disclaimer_domain3.org

Ctrl o
Ctrl x

signal-event email-update

config setprop smtpd disclaimer disabled
signal-event email-update

 DNSBL status      - DNSBL is an abbreviation for "DNS blacklist". 
                     It is a list of IP addresses known to be spammers.
 RHSBL status      - RHSBL is an abbreviation for "Right Hand Side Blacklist". 
                     It is a list of domain names known to be spammers.
 qpsmtpd badhelo   - Check a HELO message delivered from a connecting host. 
                     Reject any that appear in badhelo during the 'helo' stage.
 qmail badmailfrom - Check envelope sender addresses. 
                     Reject any that appear (@host or user@host) in badmailfrom during the 'mail'           
                     stage.
 spamassassin blacklist_from - Any envelope sender of a mail (*@host or user@host) matching an 
                               entry in blacklist_from will be rejected by spamassassin.

 Whitelists status           - White Lists: ACCEPT
 qpsmtpd whitelisthosts      - Any IP address listed in whitelisthosts will be exempted 
                               from any further validation during the 'connect' stage.
 qpsmtpd whitelisthelo       - Any host that issues a HELO matching an entry in whitelisthelo 
                               will be exempted from further validation during the 'helo' stage.
 qpsmtpd whitelistsenders    - Any envelope sender of a mail (host or user@host) matching an 
                               entry in whitelistsenders will be exempted from further validation
                               during the 'mail' stage.
 spamassassin whitelist_from - Any envelope sender of a mail (*@host or user@host) matching an 
                               entry in whitelist_from will be exempted from spamassassin rejection.

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
echo "check_badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
signal-event email-update

rm /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto \
/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto \
/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
echo "badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31badmailfromto
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31badmailfromto
signal-event email-update

mkdir -p /etc/e-smith/templates-custom/var/qmail/control/badmailfromto
nano -w /etc/e-smith/templates-custom/var/qmail/control/badmailfromto/template-begin

user@bad-domain.com tab user@yourdomain.com enter
user@bad-domain2 tab user2@yourdomain enter

john@aol.com      mary@yourdomain
bill@yahoo.com      paul@yourdomain.com

Ctrl o
Ctrl x

expand-template /var/qmail/control/badmailfromto

signal-event email-update

db domains setprop mail.dom.ain TemplatePath ProxyPassVirtualHosts ProxyPassTarget http://sme.dom.ain/webmail
signal-event remoteaccess-update

fetchmail: warning: multidrop for pop3.mypopserver.com requires envelope option!
fetchmail: warning: Do not ask for support if all mail goes to postmaster!

fetchmail: warning: multidrop for my.isp.domain requires envelope option! 
fetchmail: warning: Do not ask for support if all mail goes to postmaster! 

db accounts setprop username EveryoneEmail no
signal-event user-modify username

db accounts setprop group1 EmailExcludeUsers tom,jack 
signal-event group-modify group1

db accounts setprop group1  EmailExcludeGroups group2
signal-event group-modify group1

config show qpsmtpd

db configuration setprop qpsmtpd KeepLogFiles 15

sv t /service/qpsmtpd/log

ps aux | grep qpsmtpd | grep multi

mkdir /var/service/qpsmtpd/config/dkimkeys/

cd /var/service/qpsmtpd/config/dkimkeys/
openssl genrsa -out dkim.private 1024
openssl rsa -in dkim.private -pubout -out dkim.public
chown qpsmtpd:qpsmtpd -R /var/service/qpsmtpd/config/dkimkeys/
chmod 0700 dkim.private

cp -a dkim.private <fully qualified domain name>.private (less the <> brackets)

mkdir --parent /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
echo "dkim_sign keys dkim">/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign
signal-event email-update

db configuration setprop qpsmtpd DKIMSigning enabled
signal-event email-update

qpsmtpd-print-dns <domain name>

cd /home/e-smith/dkim_keys/default
mv private private.long
mv public public.long
openssl genrsa -out private 1024
openssl rsa -in private -pubout -out public
chown qpsmtpd:qpsmtpd private
chown root:qpsmtpd public
chmod 0400 private
signal-event email-update
qpsmtpd-print-dns

db configuration setprop qpsmtpd DKIMSigning enabled 
signal-event email-update

db domains setprop domain.com DKIMSigning disabled 
signal-event email-update

cd /home/e-smith/dkim_keys 
mkdir domain.net 
cd domain.net 
echo default > selector 
openssl genrsa -out private 2048 
openssl rsa -in private -out public -pubout 
chown qpsmtpd:qpsmtpd private 
chmod 400 private 
signal-event email-update

deferral: Temporary_error_on_maildir_delivery._(#4.3.0)/

config setprop imap access public
signal-event email-update

config setprop pop3 access public
signal-event email-update

config setprop pop3 access public
signal-event email-update
svc -t /service/pop3s  

www
  contribs
        org

# config show dovecot
 dovecot=service
   Quotas=enabled
   status=enabled

# config setprop dovecot Idle_Notify 20
# config show dovecot
 dovecot=service
   Idle_Notify=20
   Quotas=enabled
   status=enabled

# expand-template /etc/dovecot/dovecot.conf
# dovecot -a |grep imap_idle_notify_interval
  imap_idle_notify_interval = 20 mins

db configuration setprop qpsmtpd Karma enabled KarmaNegative 3
signal-event email-update

db configuration setprop qpsmtpd URIBL enabled UBLList multi.surbl.org,black.uribl.com
signal-event email-update

db configuration setprop qpsmtpd HeloPolicy rfc
signal-event email-update

db configuration setprop qpsmtpd DMARCReject disabled SPFRejectPolicy 2
signal-event email-update

db configuration setprop qpsmtpd DKIMSigning enabled
signal-event email-update

db domains setprop domain.com DKIMSigning disabled
signal-event email-update

cd /home/e-smith/dkim_keys
mkdir domain.net
cd domain.net
echo default > selector
openssl genrsa -out private 2048
openssl rsa -in private -out public -pubout
chown qpsmtpd:qpsmtpd private
chmod 400 private
signal-event email-update

qpsmtpd-print-dns <domain name>

Here are sample DNS entries you should add in your public DNS
The DKIM entry can be copied as is, but others will probably need to be adjusted
to your need. For example, you should either change the reporting email adress
for DMARC (or create the needed pseudonym)

default._domainkey IN TXT "v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/Qq3Ntpx2QNdRxGKMeKc2r9ULvyYW633IbLivHznN9JvjJIbS54PGIEk3sSxvZSdpTRAvYlxn/nRi329VmcDK0vJYb2ut2rnZ3VO3r5srm+XEvTNPxij5eU4gqw+5ayySDjqzAMEMc5V7lUMpZ/YiqnscA075XiMF7iEq8Quv1y0LokmgwtxzOXEZap34WXlKyhYzH+D""fabF6SUllmA0ovODNvudzvEOanPlViQ7q7d+Mc3b7X/fzgJfh5P9f5U+iSmzgyGctSb6GX8sqsDMNVEsRZpSE3jd2Z33RDWyW21PGOKB/ZrLiliKfdJbd3Wo7AN7bWsZpQsei2Hsv1niQIDAQAB"
@ IN SPF "v=spf1 mx a -all"
@ IN TXT "v=spf1 mx a -all"
_dmarc IN TXT "v=DMARC1; p=none; adkim=s; aspf=r; rua=mailto:dmarc-feedback@domain.net; pct=100"

yum --enablerepo=epel install libspf2 libspf2-progs

spfquery -ip=11.22.33.44 -sender=user@aol.com -helo=spammer.tld

dig -t TXT +short somedomain.co.uk

db domains setprop test.com MailServer a.b.c.d
signal-event email-update

db domains setprop test.com MailServer aspmx.l.google.com
signal-event email-update

db domains delprop test.com MailServer
signal-event email-update

su <username> -s /bin/bash 
cd ~
for m in <fullpath to maildirectory>/cur/*; do echo $m; procmail < $m && rm $m; done

 config set manta service access public status enabled TCPPort nnn

 config setprop manta AllowHosts 1.2.3.4,10.11.12.0/24 
 config setprop manta DenyHosts 16.17.18.18

 signal-event remoteaccess-update

config setprop httpd-e-smith DenyHosts a.b.c.d,w.x.y.z
signal-event post-upgrade
signal-event reboot

db configuration set <servicename> service

db configuration setprop <servicename> TCPPort <portnumber>
db configuration setprop <servicename> TCPPorts <portnumbers>
db configuration setprop <servicename> UDPPort <portnumber>
db configuration setprop <servicename> UDPPorts <portnumbers>
db configuration setprop <servicename> status enabled|disabled
db configuration setprop <servicename> access public|private
db configuration setprop <servicename> AllowHosts a.b.c.d,x.y.z.0/24
db configuration setprop <servicename> DenyHosts e.f.g.h,l.m.n.0/24

signal-event remoteaccess-update

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
nano -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40DenyRiffRaff

/sbin/iptables -A INPUT -s 69.212.12.76/32 -j DROP
/sbin/iptables -A INPUT -s 88.28.215.11/32 -j DROP

/sbin/e-smith/expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart

 iptables -L INPUT -v -n

config set ipblock configuration status enabled DenyHosts 208.100.26.0/24 logging disabled

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
nano -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40DenyRiffRaff

{
   use esmith::ConfigDB;
   my $db = esmith::ConfigDB->open_ro
       || die 'Could not open configuration database';
   # Completely block any riff raff
   if ( ( my $status = $db->get_prop( 'ipblock', 'status' ) ) eq 'enabled' )
   {
       my $DenyHosts = $db->get_prop( 'ipblock', 'DenyHosts' ) ||  '';
       if ( $DenyHosts ne  '' ) {
           my $logging = $db->get_prop( 'ipblock', 'logging' ) || 'disabled';
           foreach my $host ( split( ',', $DenyHosts ) ) {
               $OUT .= "\n";
               $OUT .= "# Simple ipblock for riff raff\n\n";
               if ( $logging eq 'enabled' ) {
                   $OUT .= "/sbin/iptables -A INPUT -s $host -j denylog\n";
               }
               else {
                   $OUT .= "/sbin/iptables -A INPUT -s $host -j DROP\n";
               }
           }
           $OUT .= "\n";
       }
       else {
           $OUT .= "# ipblock no DenyHosts set\n";
       }
   }
   else {
       $OUT .= "# ipblock disabled\n";
   }
}

config setprop ipblock DenyHosts 208.100.26.0/24,1.2.3.4,5.6.0.0/16

config setprop ipblock status disabled

config setprop ipblock logging enabled

/sbin/e-smith/expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart

man iptables

20blockIP

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
pico -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/20Blockmac

/sbin/iptables -A INPUT -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP

expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart

iptables --list

iptables -L

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq
cd /etc/e-smith/templates-custom/etc/rc.d/init.d/masq
wget -O 91adjustPortBlocks http://bugs.contribs.org/attachment.cgi?id=1395
wget -O 42SetupPortBlocks http://bugs.contribs.org/attachment.cgi?id=1389

config setprop masq TCPBlocks address:port
config setprop masq UDPBlocks address:port

config setprop masq TCPBlocks 0.0.0.0/0:1-65535
config setprop masq UDPBlocks 0.0.0.0/0:1-65535

config setprop masq TCPBlocks 0.0.0.0/0:1-221,0.0.0.0/0:223-1999,0.0.0.0/0:2011-65535

signal-event remoteaccess-update
/etc/init.d/masq restart

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq
cd /etc/e-smith/templates-custom/etc/rc.d/init.d/masq
wget -O 35transproxy http://bugs.contribs.org/attachment.cgi?id=1410
wget -O 90adjustTransProxy http://bugs.contribs.org/attachment.cgi?id=2178

config setprop squid BypassProxyTo   162.23.23.125
config setprop squid BypassProxyFrom a.b.c.d,x.y.z.0/0
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart

signal-event reboot

config setprop squid BypassProxyFrom a.b.c.d,$(config getprop squid BypassProxyFrom)
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart

signal-event reboot

config setprop squid BypassProxyFrom \
$(config getprop squid BypassProxyFrom | \
sed -e 's/entry-to-be-removed//' -e 's/^,//' -e 's/,$//' -e 's/,,//')

config delprop squid BypassProxyFrom
config delprop squid BypassProxyTo
expand-template /etc/rc.d/init.d/masq
service masq restart
signal-event reboot

config setprop masq Stealth yes
config setprop ftp access private
config setprop smtpd access private
config setprop dnscache access private
config setprop httpd-e-smith access private
config setprop oidentd access private
config setprop modSSL access private
config setprop ssmtpd access private
config setprop sshd access private
config setprop imaps access private
config setprop ldap access private
config setprop pop3 access private
config setprop pop3s access private
config setprop nmbd access private
config setprop smbd access private
signal-event post-upgrade
signal-event reboot

[mysqld]
[mysqld_safe]
[mysql-5.7]
[mariadb-10.1]
[mariadb-10.2]
[mariadb-10.3]
[mariadb-10.5]

define( 'DB_HOST', 'localhost:/var/lib/mysql/mysql.sock' );

systemctl stop mariadb
expand-template /root/.my.cnf
expand-template /var/lib/mysql/set.password
/usr/libexec/mysqld --socket=/var/lib/mysql/mysql.sock --bootstrap --user=mysql --skip-grant-tables < /var/lib/mysql/set.password
exit
systemctl start mariadb 

cd /var/service/mysqld
sv d .
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < ./set.password
sv u .

cd /var/service/mysqld
runsvctrl d .
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < ./set.password
runsvctrl u .

mariadb 5.5 and up to 10.5
systemctl stop mariadb 
echo "GRANT ALL PRIVILEGES ON *.* TO 'root'@'`config get DomainName`' WITH GRANT OPTION;">/var/lib/mysql/set.rootuser
echo "GRANT PROXY ON @ TO 'root'@'`config get DomainName`' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser
echo "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser
echo "GRANT PROXY ON @ TO 'root'@'localhost' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser
expand-template /root/.my.cnf
expand-template /var/lib/mysql/set.password
/usr/libexec/mysqld --socket=/var/lib/mysql/mysql.sock --bootstrap --user=mysql --skip-grant-tables <( cat /var/lib/mysql/set.rootuser  /var/lib/mysql/set.password)
exit
systemctl start mariadb 

cd /var/service/mysqld
sv d .
echo 'use mysql;'>set.rootuser
echo "INSERT INTO `user` VALUES ('localhost','root',,'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y',,,,,0,0,0,0);">>set.rootuser
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.rootuser
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.password
sv u .

cd /var/service/mysqld
sv d .
echo 'use mysql;'>set.rootuser
echo -n 'INSERT INTO user VALUES("localhost","root","",'>>set.rootuser
echo '"Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","","","","",0,0,0);'>>set.rootuser
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.rootuser
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.password
sv u .

journalctl -u mariadb

tail -f  /var/log/mariadb/mariadb.log

ERROR: 130  Incorrect file format 'user'

# ll /var/lib/mysql/mysql/user.*
-rw-rw---- 1 mysql mysql 10630  3 jui 21:08 /var/lib/mysql/mysql/user.frm
-rw-rw---- 1 mysql mysql   488  3 jui 21:08 /var/lib/mysql/mysql/user.MYD
-rw-rw---- 1 mysql mysql  2048  3 jui 21:08 /var/lib/mysql/mysql/user.MYI

systemctl stop mariadb
/usr/libexec/mysqld --defaults-file=/etc/my.cnf --basedir=/usr --datadir=/var/lib/mysql  --user=mysql --skip-grant-tables

mysqlcheck mysql

mysqlcheck mysql --repair

--
-- Table structure for table `user`
--

--
-- Dumping data for table `user`
--

mysql mysql < /home/e-smith/db/mysql/mysql.user.dump
expand-template /var/lib/mysql/set.password
mysql mysql < /var/lib/mysql/set.password
mysqladmin shutdown
systemctl start mariadb

config setprop mariadb LocalNetworkingOnly no
expand-template /etc/my.cnf
systemctl restart /service/mysqld

config setprop mysqld LocalNetworkingOnly no
expand-template /etc/my.cnf
sv t /service/mysqld

config set mariadb service access public status enabled TCPPort 3306 
signal-event remoteaccess-update 
signal-event smeserver-mysql-update

config set mysqld service access public status enabled TCPPort 3306 
signal-event remoteaccess-update 
signal-event reboot

## In the command below, \ escapes a linebreak.
   ## Either include them, or place the entire command on one line
   mysql -e "\
   create database MyDB; \
   GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER \
   ON *.* \
   TO 'MyUser'@'192.168.1.%' \
   IDENTIFIED BY 'MyPW'; \
   FLUSH PRIVILEGES;"

db configuration setprop mysqld InnoDB enabled
expand-template /etc/my.cnf
sv t /service/mysqld

db configuration setprop mysqld InnoDB disabled
expand-template /etc/my.cnf
sv t /service/mysqld

mysqladmin create 'dbname' --default-character-set=utf8

mysql

GRANT SELECT ON test.* TO 'user'@'host' IDENTIFIED BY 'password';

show databases;

drop database databasename;

USE mysql;
DELETE FROM user WHERE user = 'username';
FLUSH PRIVILEGES;

config set mariadb  KeyBufferSize 18M MyisamSortBufferSize 8M
expand-template /etc/my.cnf 
systemctl restart mariadb

mkdir -p /etc/e-smith/templates-custom/etc/my.cnf/
vim /etc/e-smith/templates-custom/etc/my.cnf/017myvalues
expand-template /etc/my.cnf 
systemctl restart mariadb

key_buffer_size=18M
myisam_sort_buffer_size=8M

mkdir -p /etc/e-smith/templates-custom/etc/my.cnf/
vim  /etc/e-smith/templates-custom/etc/my.cnf/016mysetup

Ctrl o
Ctrl x

expand-template /etc/my.cnf
sv t /service/mysqld

@@ Line 8: / Line 8: @@
 =Foire aux Questions=
-Cette section répertorie les ''Question Fréquemment Posées'' (FAQ) à propos de SME. Les problèmes auxquels font face les personnes installant SME pour la première fois, ou en mettant à jour une version antérieure peuvent trouver leur réponse ici.
+Cette section répertorie les ''Question Fréquemment Posées'' (QFP/FAQ) à propos de SME. Les problèmes auxquels font face les personnes installant SME pour la première fois, ou en mettant à jour une version antérieure peuvent trouver leur réponse ici.
 Si votre question ne trouve pas de réponse ici, il est probable que vous soyez en face d'une question rarement posée (RAQ), dans ce cas vous devriez chercher dans [http://bugs.contribs.org Bugzilla], cependant vous pourriez aussi faire appel à la communauté francophone. En premier lieu vous pouvez consulter [http://www.smeserver.fr le site de Grand Pa], ensuite [http://smeserver.pialasse.com le wiki francophone]. Enfin vous pouvez demander un peu d'aide sur  [http://forums.contribs.org/index.php?board=6.0 le forum de contribs], sur l'irc chat.freenode.net:6667 canal #sme-fr, ou enfin auprès le newsgroup alt.e-smith.fr.
@@ Line 16: / Line 16: @@
 Voir, s.v.p. [https://wiki.contribs.org/Help:Contents/fr#Comment_obtenir_un_compte_sur_le_wiki.3F '''comment obtenir un compte wiki''']
 |}
+{{Tip box|type=Astuce :| [[SME_Server:Documentation:FAQ:booklet |Manuel de QFP/FAQ d'une page.]] Tous les chapitres sont dans une seule page. C'est une très grande page !}}
+{{Warning box|type=Attention :|de nombreux conseils des QFP/FAQ concernent les versions du serveur Koozali SME antérieures à la version 10 actuelle du serveur Koozali SME. Veuillez vérifier que le paragraphe de la QFP/FAQ correspond à la version avec laquelle vous travaillez avant d'appliquer des modifications. La version actuellement publiée, et la seule prise en charge, est la version 10 du serveur Koozali SME.}}
 ===Problèmes à l'installation===
@@ Line 297: / Line 299: @@
 FAT32 supporte seulement une taille de fichier inférieure à 4GB. Il est recommandé de formater les disques USB externes en ext3.
-==External DNS==
+==DNS externe==
 Pour permettre aux usagers externe de communiquer avec votre serveur, vous devez avoir correctement configuré les enregistrements DNS. Une fois que vous avez acheté un domaine, vous devriez configurer les enregistrements suivants (à adapter si nécessaire) pour permettre la communication web et courriel :
 . Un enregistrement «A», monserveur.mondomaine.com, pointant sur l'adresse IP externe de votre serveur.
-. Un enregistrement «CNAME», *.mondomaine.com, pointant sur l'enregistrement «A» monserveur.mondomaine.com [qui est un attrape-tout qui permet aux alias comme www.mondomaine.com et mail.mondomaine.com d'être réésolu sans avoir à créer de multiples enregistrements «CNAME»].
+. Un enregistrement «CNAME», *.mondomaine.com, pointant sur l'enregistrement «A» monserveur.mondomaine.com [qui est un attrape-tout qui permet aux alias comme www.mondomaine.com et mail.mondomaine.com d'être résolus sans avoir à créer de multiples enregistrements «CNAME»].
 . Un enregistrement «MX», pointant sur monserveur.mondomaine.com, pour permettre la délivrance des courriels.
@@ Line 737: / Line 739: @@
 Cette contribution vous permettra de configurer la force du mot de passe et sa durée de vie à travers un menu du gestionnaire du serveur.
-References:
+Références :
-<ol></li><li>[https://sourceforge.net/tracker/?func=detail&atid=615772&&aid=1228269&group_id=96750 Old Bugtracker on SF.net: Sme7a22 - user passwords]
+<ol></li><li>[[Bugzilla:161]]</li>
-</li><li>[[Bugzilla:161]]</li>
 <li>[[Bugzilla:2686]]</li></ol>
@@ Line 956: / Line 957: @@
-{{:Booting}}
+{{:Booting/fr}}
 {{:Log_Files}}

Sensitivity	Spam tagging level	Spam rejection level
Custom	TagLevel value (Custom spam tagging level)	RejectLevel value (Custom spam rejection level)
veryhigh	2	No rejection
high	3	No rejection
medium	5	No rejection
low	7	No rejection
verylow	9	No rejection

Subsystem	Function	Default Limit	Command to change size	Notes
qmail	Delivers email to local mailboxes and to remote servers	15000000	config setprop qmail MaxMessageSize xx000000	Value is in BYTES. 15000000 equals approximately 15MB. No value means no limit.
clamav	Used to scan emails and attachments	15M	config setprop clamav MaxFileSize 15M	Value includes human-readable abbreviations. "15M" equals 15 MegaBytes.
clamd	Involved in attachment virus scanning	1400000000	config setprop clamd MemLimit 1400000000	May require increase per this forum topic
qpsmtpd	The clamav plugin to qpsmtpd is called with a specified size limit.	25000000	config setprop qpsmtpd MaxScannerSize xx000000	Value is in BYTES. Question: does this value override the setting of 'MaxFileSize', or will the smaller value prevail?
php	The php maximum file upload size will determine the largest file you can attach to an email message using horde (or any other php email client)	10M	config setprop php UploadMaxFilesize 10M

Plugin	Purpose	Default Status
hosts_allow	Prohibit more than "InstancesPerIP" connections from any single host (change with 'config setprop smtpd InstancesPerIP'). Allow or deny connections according to the contents of /var/service/qpsmtpd/config/hosts_allow. See hosts_allow SVN code for more details.	enabled
peers	Allow different plugin configuration based on the sending computer's IP address. By default SME maintains different configurations for the local networks (in /var/service/qpsmtpd/config/peers/local) and for everyone else (in /var/service/qpsmtpd/config/peers/0)	enabled
logging/logterse	Allow greater logging detail using smaller log files. Optionally supports qplogsumm.pl to compile qpsmtpd statistics.	enabled
auth/auth_cvm_unix_local	Allow authenticated smtp relay	enabled (remote) disabled (local)
check_earlytalker	reject email from servers that talk out of turn	enabled (remote) disabled (local)
count_unrecognized_commands	reject email from servers that issue X invalid commands	enabled (remote) disabled (local)
bcc	bcc all email to a specific address for archiving	disabled
check_relay	Check to see if relaying is allowed (in case the recipient is not listed in one of SME's local domains)	enabled
check_norelay	Check to see if the sending server is specifically forbidden to relay through us.	enabled
require_resolvable_fromhost	Check that the domain listed in the sender's email address is resolvable	enabled (remote) disabled (local)
check_basicheaders	reject email that lacks either a From: or Date: header	enabled
rhsbl	Reject email if the sender's email domain has a reputation for disregarding smtp RFCs.	disabled (always disabled for local connections)
dnsbl	Reject email from hosts listed in your configured dnsbl servers	disabled
check_badmailfrom	Reject email where the sender address is listed in /var/service/qpsmtpd/config/badmailfrom	enabled
check_badrcptto_patterns	Reject email addressed to any address matching an expression listed in /var/service/qpsmtpd/config/badrcptto_patterns	enabled
check_badrcptto	Reject email addressed to any address listed in /var/service/qpsmtpd/config/badrcptto	enabled
check_spamhelo	Reject email from hosts that say 'helo ...' using a value in /var/service/qpsmtpd/config/badhelo	enabled
check_smtp_forward	If config show DelegateMailServer or db domains show <domainname> MailServer is set (telling SME to deliver email for all domains or just <domainname> to another server), check_smtp_forward will connect to the specified server and will reject the message outright if the internal mail server would also reject it.	disabled unless an internal mail server is configured.
check_goodrcptto	Accept email only if the recipient address matches an entry in /var/service/qpsmtpd/config/goodrcptto. For domains that are configured to use an internal mail server, the entire domain name will be added to .../goodrcptto.	enabled
rcpt_ok	Return 'OK' if none of the other host checks has returned 'DENY' (??)	enabled
pattern_filter	Reject email according to content patterns (??)	disabled
tnef2mime	Convert MS TNEF (winmail.dat) and uuencoded attachments to MIME	enabled
disclaimer	Add a configurable disclaimer to email messages	disabled
spamassassin	Check email using spamassassin, and optionally reject it completely if the score exceeds a configurable value.	disabled (always disabled for local connections)
virus/clamav	Scan incoming email with ClamAV	enabled
queue/qmail-queue	Deliver the incoming message to qmail for delivery.	enabled

Plugin	Purpose	Default Status
connection_time	Track the total time for each qpsmtpd connection from 'Accepted connection' through 'click, disconnecting', and output the results to the qpsmtpd log file.	not installed - not clear if this works for SME9.2 (anyone?)
GeoIP	Track the geographic origin of incoming email and optionally reject email from specified countries	not installed - does work for SME 9.2 and later.

	Work in Progress:
	prbird has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

	Astuce :
	Manuel de QFP/FAQ d'une page. Tous les chapitres sont dans une seule page. C'est une très grande page !

	Attention :
	de nombreux conseils des QFP/FAQ concernent les versions du serveur Koozali SME antérieures à la version 10 actuelle du serveur Koozali SME. Veuillez vérifier que le paragraphe de la QFP/FAQ correspond à la version avec laquelle vous travaillez avant d'appliquer des modifications. La version actuellement publiée, et la seule prise en charge, est la version 10 du serveur Koozali SME.

	Note:
	Un système installé avec le CD de SME 7.1 aura les 5 dépôts ci-dessus activés. Un système installé avec le CD de SME 7.0 et mis à jour vers 7.1 aura seulement les 3 dépôts SME activés. Après une msie à jour de 7.0 à 7.1, vous devriez activer les dépôts Centos - os & Centos - updates depuis le server-manager.

	Remarque :
	si vous avez déjà ajouté le nom de domaine du serveur interne ou externe comme un nom de domaine virtuel sur le serveur SME, vous devez d'abord le supprimer avant de saisir ces commandes. Le panneau des domaines du gestionnaire du Serveur vous montrera les entrées de proxypass mais vous ne pourrez pas les modifiez, voir ~~bugzilla:1612~~.

	Remarque :
	dans les commandes de définitions ci-dessus, xxxx ProxyPass, setprop xxxx Target http://<target> et setprop xxxx Description <description> sont nécessaires ; toutes les autres lignes sont optionnelles.

	Remarque :
	HTTP et HTTPS sont définis par défaut sur «yes», il n'est donc pas nécessaire de le définir. En dehors de cela, il est préférable d'utiliser «no» lorsque vous voulez qu'il soit désactivé, plutôt que «on»/«off» ou «enabled»/«disabled».

	Attention :
	il est fortement déconseillé de définir le paramètre de force du mot de passe sur none , car cela réduira significativement la sécurité de votre serveur.

	Remarque :
	le module PAM requiert des mots de passe d'au moins 6 caractères, de sorte que la fixation d'un mot de passe plus court peut causer ultérieurement d'autres problèmes. Le paramètre par défaut du serveur SME impose des mots de passe de 7 caractères.

	Note :
	ssh, ftp and telnet ne fonctionnent pas via un proxy «upstream» http, cependant, ils peuvent fonctionner en conjonction avec tsocks (disponible à partir du dépôt dag.)

	Note :
	pour SME Server 9, l'option sme raid=none a un comportement différent puisque le /boot est toujours fait par un raid 1 logiciel appelé /dev/md0. Toutes les autres partitions (/ et swap) sont sans RAID logiciel. (Voir ~~bugzilla:8369~~.)

	Note:
	as SME8 this functionality seems to be included --Unnilennium (talk) 09:05, 3 February 2014 (MST)

	Note:
	This can be a crude way of blocking spam and potentially also block legitimate users!

	Note :
	pour SME 8 et inférieur, si l'installation se fait sur une machine i586, vous devez remplacer sme par smei586 dans les commandes suivantes ; il n'est pas possible d'installer SME 9 sur une machine i586.

	Note :
	pour SME Server 9, raid=0 signifie que le type de RAID demandé est 0 (par ex. Raid0). Si vous ne voulez pas de RAID logiciel, vous devez configurer raid=none.

	Note :
	pour SME Server 9, il n'est plus nécessaire de configurer sme ext4 pour avoir un système de fichiers ext4 depuis que c'est le système de fichier par défaut.

	Warning:
	Please note that these instructions do not apply to SME9.2 where the version of qpsmtpd (0.96) does all this out of the box. Indeed if the custom template below is applied (or left in?) to an SME9.2 system, then you may find that emails are denied when they ought to be accepted!

	Warning:
	SME server 7.# users be aware of an issue that can appear in the /var/log/spamd/current logs " pyzor: [5281] error: TERMINATED, signal 15 (000f)".

	Note:
	for sme9, only the key imap has properties ConcurrencyLimitPerIP,checkConcurrencyLimit,ProcessMemoryLimit. If you set these properties to the key imaps, a migrate fragment will remove them automatically.

	Tip:
	Some email clients use a separate connection per imap folder, so the concurrency limits may occur for users that have many imap folders.

	Note:
	You can set the MemoryLimit any value you like but be sure to add the capital M as a suffix for Megabytes.

	Note:
	Please note that admin and other system accounts can not be hidden from external network this way. Also note that Pseudonyms can be set to internal only using the server-manager.

	Work in Progress:
	trex1512 has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

Difference between revisions of "SME Server:Documentation:FAQ/fr"

Latest revision as of 15:24, 5 October 2021

Aider le Projet SME Server

Faire un don via votre compte du forum de contribs.org

Faire un don directement par PayPal

Foire aux Questions

Problèmes à l'installation

Problème avec l’installateur pour indiquer où sont les fichiers d'installation

Mises à jours Yum

Quels dépôts (repositories) devraient être actifs (enabled)

Reconfiguration (post-upgrade) et redémarrage

Mise à niveau de SME 7.x à SME 7.2

Avertissement dans le rapport de courriel de rkhunter

Fréquence

Généralités

Ajout, retrait ou désactivation des dépôts

Autres dépôts populaires

Comment faire une mise à jour complète et propre des contributions ?

Supprimer un paquet logiciel

Liste de compatibilité matérielle

Postes client

Applications Web

Réinitialiser le mot de passe root et admin

Limitations de taille de fichier

DNS externe

Domaines

DNS délégué

Transfert de DNS

Recherche de virus

Proxy Pass

ProxyPass un domaine

ProxyPass un alias/répertoire/emplacement

ProxyPass pour Outlook Exchange Web Access

Accès au shell

Mise à niveau du serveur

Changer la longueur maximale du nom d'une baie d'information, d'un compte ou d'un groupe

Suppression d'utilisateurs, de baies d'information, de groupes - Junkmail

Accès refusé à la baie d'information avec le groupe créé récemment

Changer le mot de passe utilisateur en ligne de commande

Vérification de la force du mot de passe

Disques durs, RAID, disques durs USB

Sauvegardes & restaurations

Les services supervisés

Gestionnaire du serveur

Booting with SMP kernel after upgrade to version 7.2 from CD

Caractères speciaux

Configuration du serveur proxy en amont

Accès du navigateur à partir des stations de travail LAN

Yum (mises à jour du système)

ClamAv / freshclam

Spamassassin

curl, wget

ssh, ftp, telnet

Essai et vérification

Utilisation de la mémoire et limites

Installation

Options de démarrage

Installation normale

Configurer le type de RAID

Définir le nombre de disques de rechange

Définir le type de lecteur à utiliser

Définir les lecteurs à exclure

Pour installer SME sans RAID logiciel

Pour installer SME sans LVM

Pour avoir /, /tmp, /var, /home/e-smith/files et swap sur des partitions séparées

Si vous avez un disque de pilotes

L'installation se bloque

dmraid (SME 8.1 désactivé par défaut)

Erreur d'installation lorsque les disques utilisés l'ont été précédemment en «fake RAID»

Erreur d'installation de pilote SATA

Cartes-mère Intel DG965 (G33xx)

Pour activer le mode sauvetage, saisir

Pour utiliser un système de fichiers ext4 (pour SME 8 et antérieurs)

Notes

Aide générale au démarrage

Kernel Parameter Help

Rescue Mode Help

More

Access

Logfile Names

	Tip:
	You can verify that your settings are correct by sending an email to check-auth@verifier.port25.com, a free service the purpose of which is to verify if your domain does not contradict mail policies. Please check the answer carefully. See ~~bugzilla:4558#c6~~

	Warning:
	There is a plugin for signing with DomainKeys but it is not installed by default. It has not been tested on Koozali SME Server: http://wiki.qpsmtpd.org/doku.php?id=plugins:spam:domainkeys_sign

	Warning:
	Keep in mind that your passwords, your data won't be protected and will be in clear text over Internet

	Warning:
	Please note that the version of qpsmtpd has been upgraded for SME version 9.2 and later to qpsptpd version 0.96. This change has resulted in a lot of changes to the way it works, the plugins (and their names!) and the corresponding database entries, so this section ONLY applies to SME Version 9.1 and earlier, except where the plugin has been retained, See the next section for the new details.

Variable	Target	Default	Expected values
TCPPort	--proto tcp --dport <Ports>	Pre-configured for default services; no default for custom services	empty or a numerical or coma separated numbers
TCPPorts	--proto tcp --dports <Ports>	No default for custom services; Ranges of ports are defined with a : not a -	empty or a numerical or coma separated numbers
UDPPort	--proto udp --dport <Ports>	Pre-configured for default services; no default for custom services	empty or a numerical or coma separated numbers
UDPPorts	--proto udp --dports <Ports>	No default for custom services; Ranges of ports are defined with a : not a -	empty or a numerical or coma separated numbers
status	disabled	AllowHosts is set to "" (an empty string) unless the status is 'enabled'	'enabled' or 'disabled'
access	private	AllowHosts is set to "" (an empty string) unless access is 'public'	'private' for localhost and local network only (Server and gateway mode), 'public' for everywhere, 'localhost' for localhost only
AllowHosts	--src ..... --jump ACCEPT	Pre-configured for default services; no default for custom services. Default is '0.0.0.0/0' if service is enabled and public.	IP and netmask with this format 0.0.0.0/0, or coma separated list of these elements
DenyHosts	--src ..... --jump denylog	Pre-configured for default services; no default for custom services. If 'DenyHosts' is empty or does not exist then there are no '... --jump denylog' entries created in /etc/init.d/masq.	IP and netmask with this format 0.0.0.0/0, or coma separated list of these elements

	Warning:
	Koozali SME Server Version 10: MySQL is provided by MariaDB. You can check the version in the usual way, e.g. at the time of writing version 5.5.

	Warning:
	be careful that mariadb will be running without any user auth, if it is open to outside of your server, then you might want to close this access first, and keep this session as short as possible

	Warning:
	the line dumping the table mysql.user to the mariadb server will delete any existing entries in the table if you are using the default SME dump as it has a DROP TABLE IF EXISTS line. So do this only if you know what you are doing.

	Warning:
	Keep in mind that by default MariaDB/MySQL is not using any kind of encryption unless you did work on that yourself, so any access to the port from the LAN will be as clear text and anyone on the LAN will be able to access to the password and all the data transferred between your server and the client. Refers to the manual of your database version.

	Tip:
	The suggestion here is to assign privileges based on IP number (using a wild card if desired), the same can also be done for hostnames. In some cases, like dynamicaly assgned IP addresses, this might be a more suitable and robust solution.