- •Table of Contents
- •Dedication
- •Foreword
- •Introduction
- •What Is FreeBSD?
- •How Did FreeBSD Get Here?
- •The BSD License: BSD Goes Public
- •The Birth of Modern FreeBSD
- •FreeBSD Development
- •Committers
- •Contributors
- •Users
- •Other BSDs
- •NetBSD
- •OpenBSD
- •Other UNIXes
- •Solaris
- •Linux
- •IRIX, HPUX, etc.
- •FreeBSD's Strengths
- •Portability
- •Power
- •Simplified Software Management
- •Optimized Upgrade Process
- •Filesystem
- •Who Should Use FreeBSD
- •FreeBSD as Your Desktop
- •Who Should Run Another BSD
- •Who Should Run a Proprietary Operating System
- •How to Read This Book
- •What Must You Know?
- •How to Think About UNIX
- •Channels of Communication
- •Working with Channels
- •The Command Line
- •Chapter 1: Installation
- •FreeBSD Hardware
- •Processor
- •Memory (RAM)
- •Hard Drives
- •Downloading FreeBSD
- •Installing by FTP
- •Other FTP Install Information
- •Hardware Setup
- •Actually Installing FreeBSD
- •Configuring the Kernel for ISA Cards
- •Sysinstall: The Ugly FreeBSD Installer
- •Disk Usage
- •Partitioning
- •Root
- •Swap Space
- •Swap Splitting
- •/var, /usr, and /home
- •A Second Hard Drive
- •Soft Updates
- •Block Size
- •What to Install
- •Installation Media
- •Committing
- •Root Password
- •Adding Users
- •Time Zone
- •Mouse
- •Configuring Network Cards
- •Xfree86
- •Software
- •Restart
- •A Note on Editors
- •Chapter 2: Getting More Help
- •Why Not Mail First?
- •The FreeBSD Attitude
- •Man Pages
- •The FreeBSD Manual
- •Man Page Headings
- •The FreeBSD Documentation
- •The Mailing List Archives
- •Other Web Sites
- •Checking the Handbook/FAQ
- •Checking the Man Pages
- •Checking the Mailing List Archives
- •Using Your Answer
- •Mailing for Help
- •Chapter 3: Read This Before You Break Something Else! (Backup and Recovery)
- •Overview
- •System Backups
- •Tape Devices
- •How to Read Dmesg.boot
- •Controlling Your Tape Drive
- •Device Nodes
- •Using the TAPE Variable
- •The mt Command
- •Backup Programs
- •Dump/Restore
- •Restoring from an Archive
- •Checking the Contents of an Archive
- •Extracting Data from an Archive
- •Restoring Interactively
- •Recording What Happened
- •Revision Control
- •Getting Older Versions
- •Breaking Locks
- •Viewing Log Messages
- •Reviewing a File's Revision History
- •Ident and ident Strings
- •Going Further
- •The Fixit Disk
- •Chapter 4: Kernel Games
- •Overview
- •What Is the Kernel?
- •Configuring Your Kernel
- •Sysctl
- •Changing Sysctls
- •Setting Sysctls at Boot
- •Kernel Configuration with Loader.conf
- •Manually Configuring the Loader
- •Viewing Loaded Modules
- •Loading and Unloading Modules
- •Customizing the Kernel
- •Preparation
- •Your Backup Kernel
- •Editing Kernel Files
- •Basic Options
- •Multiple Processors
- •Device Entries
- •Building Your Kernel
- •Troubleshooting Kernel Builds
- •Booting an Alternate Kernel
- •Adding to the Kernel
- •LINT
- •Fixing Errors with Options
- •Tweaking Kernel Performance
- •Sharing Kernels
- •Chapter 5: Networking
- •Overview
- •Network Layers
- •The Physical Layer
- •The Physical Protocol Layer
- •The Logical Protocol Layer
- •The Application Layer
- •The Network in Practice
- •Mbufs
- •What Is a Bit?
- •Ethernet
- •Broadcasting
- •Address Resolution
- •Hubs and Switches
- •Netmasks
- •Netmask Tricks
- •Hexadecimal Netmasks
- •Unusable IP Addresses
- •Routing
- •Network Ports
- •Connecting to an Ethernet Network
- •Multiple IP Addresses on One Interface
- •Using Netstat
- •Chapter 6: Upgrading FreeBSD
- •Overview
- •FreeBSD Versions
- •Release
- •Snapshots
- •Security Updates
- •Which Release Should You Use?
- •Upgrade Methods
- •Upgrading via Sysinstall
- •Upgrading via CVSup
- •Simplifying the CVSup Upgrade Process
- •Building a Local CVSup Server
- •Controlling Access
- •Authentication
- •Combining Authentication and Access
- •Chapter 7: Securing Your System
- •Overview
- •Who Is the Enemy?
- •Script Kiddies
- •Disaffected Users
- •Skilled Attackers
- •FreeBSD Security Announcements
- •Subscribing
- •What You'll Get
- •Installation Security Profiles
- •Moderate
- •Extreme
- •Root, Groups, and Permissions
- •The root Password
- •Groups of Users
- •Primary Group
- •Some Interesting Default Groups
- •Group Permissions
- •Changing Permissions
- •Changing File Ownership
- •Assigning Permissions
- •File Flags
- •Viewing a File's Flags
- •Setting Flags
- •Securelevels
- •Setting Securelevels
- •Which Securelevel Do You Need?
- •What Won't Securelevel and File Flags Do?
- •Living with Securelevels
- •Programs That Can Be Hacked
- •Putting It All Together
- •Chapter 8: Advanced Security Features
- •Traffic Control
- •Default Accept vs. Default Deny
- •TCP Wrappers
- •Configuring Wrappers
- •Daemon Name
- •The Client List
- •Putting It All Together
- •Packet Filtering
- •IPFilter
- •IPFW
- •Default Accept and Default Deny in Packet Filtering
- •Basic Concepts of Packet Filtering
- •Implementing IPFilter
- •Configuring Your Server to Use Jail
- •Configuring Your Kernel to Use Jail
- •Client Setup
- •Final Jail Setup
- •Starting the Jail
- •Managing Jails
- •Shutting Down a Jail
- •Monitoring System Security
- •If You're Hacked
- •Chapter 9: Too Much Information About /etc
- •Overview
- •Varieties of /etc Files
- •Default Files
- •/etc/defaults/rc.conf
- •/etc/adduser.conf
- •/etc/crontab
- •/etc/dhclient.conf
- •/etc/fstab
- •/etc/hosts.allow
- •/etc/hosts.equiv
- •/etc/hosts.lpd
- •/etc/inetd.conf
- •/etc/locate.rc
- •/etc/login.access
- •/etc/login.conf
- •Specifying Default Environment Settings
- •/etc/mail/mailer.conf
- •/etc/make.conf and /etc/defaults/make.conf
- •/etc/master.passwd
- •/etc/motd
- •/etc/mtree/*
- •/etc/namedb/*
- •/etc/newsyslog.conf
- •/etc/passwd
- •/etc/periodic.conf and /etc/defaults/periodic.conf
- •/etc/printcap
- •Working with Printcap Entries
- •/etc/profile
- •/etc/protocols
- •/etc/rc.conf and /etc/defaults/rc.conf
- •/etc/resolv.conf
- •/etc/security
- •/etc/services
- •/etc/shells
- •/etc/spwd.db
- •/etc/sysctl.conf
- •/etc/syslog.conf
- •Chapter 10: Making Your System Useful
- •Overview
- •Making Software
- •The Pain and Pleasure of Source Code
- •Debugging
- •The Ports and Packages System
- •Ports
- •Finding Software
- •Legal Restrictions
- •Using Packages
- •Installing via FTP
- •What Does a Package Install?
- •Uninstalling Packages
- •Package Information
- •Controlling Pkg_add
- •Package Problems
- •Forcing an Install
- •Using Ports
- •Installing a Port
- •Using Make Install
- •Uninstalling and Reinstalling
- •Cleaning Up with Make Clean
- •Building Packages
- •Changing the Install Path
- •Setting Make Options Permanently
- •Upgrading Ports and Packages
- •Upgrading the Ports Collection
- •Ports Collection Upgrade Issues
- •Checking Software Versions
- •Hints for Upgrading
- •Chapter 11: Advanced Software Management
- •Overview
- •Startup and Shutdown Scripts
- •Typical Startup Script
- •Using Scripts to Manage Running Programs
- •Managing Shared Libraries
- •Ldconfig
- •Running Software from the Wrong OS
- •Recompilation
- •Emulation
- •ABI Implementation
- •Foreign Software Libraries
- •Installing and Enabling Linux Mode
- •Identifying Programs
- •What Is Linux_base?
- •Adding to Linux_base
- •Configuring Linux Shared Libraries
- •Installing Extra Linux Packages as RPMs
- •What Is SMP?
- •Kernel Assumptions
- •FreeBSD 3.0 SMP
- •FreeBSD 5 SMP
- •Using SMP
- •SMP and Upgrades
- •Chapter 12: Finding Hosts With DNS
- •How DNS Works
- •Basic DNS Tools
- •The Host Command
- •Getting Detailed Information with Dig
- •Looking Up Hostnames with Dig
- •More Dig Options
- •Configuring a DNS Client: The Resolver
- •Domain or Search Keywords
- •The Nameserver List
- •DNS Information Sources
- •The Hosts File
- •The Named Daemon
- •Zone Files
- •A Real Sample Zone
- •named.conf
- •/var/named/master/absolutebsd.com
- •Making Changes Work
- •Starting Named at Boottime
- •Checking DNS
- •Named Configuration Errors
- •Named Security
- •Controlling Information Order
- •More About BIND
- •Chapter 13: Managing Small Network Services
- •Bandwidth Control
- •Configuring IPFW
- •Reviewing IPFW Rules
- •Dummynet Queues
- •Directional Traffic Shaping
- •Certificates
- •Create a Request
- •Being Your Own CA
- •Testing SSH
- •Enabling SSH
- •Basics of SSH
- •Creating Keys
- •Confirming SSH Identity
- •SSH Clients
- •Connecting via SSH
- •Configuring SSH
- •System Time
- •Setting the Time Zone
- •Network Time Protocol
- •Ntpdate
- •Ntpd
- •Inetd
- •/etc/inetd.conf
- •Configuring Programs in Inetd
- •Inetd Security
- •Starting Inetd
- •Changing Inetd's Behavior
- •Chapter 14: Email Services
- •Email Overview
- •Where FreeBSD Fits In
- •The Email Protocol
- •Email Programs
- •Who Needs Sendmail?
- •Replacing Sendmail
- •Installing Postfix
- •Pieces of Postfix
- •Configuring Postfix
- •Email Aliases
- •Email Logging
- •Virtual Domains
- •Postfix Commands
- •Finding the Correct Mail Host
- •Undeliverable Mail
- •Installing POP3
- •Testing POP3
- •POP3 Logging
- •POP3 Modes
- •Qpopper Preconfiguration Questions
- •Default Qpopper Configuration
- •APOP Setup
- •Configuring Pop3ssl
- •Qpopper Security
- •Chapter 15: Web and FTP Services
- •Overview
- •How a Web Server Works
- •The Apache Web Server
- •Apache Configuration Files
- •Configuring Apache
- •Controlling Apache
- •Virtual Hosting
- •Tweaking Virtual Hosts
- •.NET on FreeBSD
- •Installing the SSCLI
- •FTP Security
- •The FTP Client
- •The FTP Server
- •Chapter 16: Filsystems and Disks
- •Device Nodes
- •Hard Disks and Partitions
- •The /etc/fstab File
- •Disk Basics
- •The Fast File System
- •Vnodes
- •FFS Mount Types
- •FFS Mount Options
- •What's Mounted Now?
- •Dirty Disks
- •Fsck
- •Mounting and Unmounting Disks
- •Mounting Standard Filesystems
- •Mounting with Options
- •Mounting All Standard Filesystems
- •Mounting at Nonstandard Locations
- •Unmounting
- •Soft Updates
- •Enabling Soft Updates
- •IDE Write Caching and Soft Updates
- •Virtual Memory Directory Caching
- •Mounting Foreign Filesystems
- •Using Foreign Mounts
- •Foreign Filesystem Types
- •Mount Options and Foreign Filesystems
- •Filesystem Permissions
- •Removable Media and /etc/fstab
- •Creating a Floppy
- •Creating an FFS Filesystem
- •The Basics of SCSI
- •SCSI Types
- •SCSI Adapters
- •SCSI Buses
- •Termination and Cabling
- •SCSI IDs and LUNs
- •FreeBSD and SCSI
- •Wiring Down Devices
- •Adding New Hard Disks
- •Creating Slices
- •Creating Partitions
- •Configuring /etc/fstab
- •Installing Existing Files onto New Disks
- •Temporary Mounts
- •Moving Files
- •Stackable Mounts
- •Chapter 17: RAID
- •Hardware vs. Software RAID
- •RAID Levels
- •Software RAID
- •Vinum Disk Components
- •Vinum Plex Types
- •Preparing Vinum Drives
- •Dedicating Partitions to Vinum
- •Configuring Vinum
- •Concatenated Plex
- •Removing Vinum Configuration
- •Striped Volumes
- •Mirrored Volumes
- •Starting Vinum at Boot
- •Other Vinum Commands
- •Replacing a Failed Mirrored Plex
- •Chapter 18: System Performance
- •Overview
- •Computer Resources
- •Disk Input/Output
- •Network Bandwidth
- •CPU and Memory
- •Using Top
- •Memory Usage
- •Swap Space Usage
- •CPU Usage
- •When Swap Goes Bad
- •Paging
- •Swapping
- •Are You Swapping or Paging?
- •Fairness in Benchmarking
- •The Initial Test
- •Using Both CPUs
- •Directory Caching
- •Moving /usr/obj
- •Lessons Learned
- •Chapter 19: Now What's It Doing?
- •Status Mails
- •Forwarding Reports
- •Logging with Syslogd
- •Facilities
- •Levels
- •Syslog.conf
- •Wildcards
- •Rotating Logs with Newsyslog.conf
- •Reporting with SNMP
- •Basics of SNMP
- •MIBs
- •Snmpwalk
- •Specific Snmpwalk Queries
- •Translating Between Numbers and Names
- •Setting Up Snmpd
- •Index Numbers
- •Configuring MRTG
- •Sample mrtg.cfg Entry
- •Testing MRTG
- •Tracking Other System Values
- •Monitoring a Single MIB
- •Customizing MRTG
- •MRTG Index Page
- •Sample MRTG Configurations
- •Chapter 20: System Crashes and Panics
- •What Causes Panics?
- •What Does a Panic Look Like?
- •Responding to a Panic
- •Prerequisites
- •Crash Dump Process
- •The Debugging Kernel
- •kernel.debug
- •Dumpon
- •Savecore
- •Upon a Crash
- •Dumps and Bad Kernels
- •Using the Dump
- •Advanced Kernel Debugging
- •Examining Lines
- •Examining Variables
- •Apparent Gdb Weirdness
- •Results
- •Vmcore and Security
- •Symbols vs. No Symbols
- •Serial Consoles
- •Hardware Serial Console
- •Software Serial Console
- •Changing the Configuration
- •Using a Serial Console
- •Serial Login
- •Emergency Logon Setup
- •Disconnecting the Serial Console
- •Submitting a Problem Report
- •Problem Report System
- •What's in a PR?
- •Filling Out the Form
- •PR Results
- •Chapter 21: Desktop FreeBSD
- •Overview
- •Accessing File Shares
- •Prerequisites
- •Character Sets
- •Kernel Support for CIFS
- •SMB Tools
- •Configuring CIFS
- •Minimum Configuration: Name Resolution
- •Other smbutil Functions
- •Mounting a Share
- •Other mount_smbfs Options
- •Sample nsmb.conf Entries
- •CIFS File Ownership
- •Serving Windows File Shares
- •Accessing Print Servers
- •Running a Local Lpd
- •Printer Testing
- •Local Printers
- •X: A Graphic Interface
- •X Prerequisites
- •X Versions
- •Configuring X
- •Making X Look Decent
- •Desktop Applications
- •Web Browsers
- •Email Readers
- •Office Suites
- •Music
- •Graphics
- •Desk Utilities
- •Games
- •Afterword
- •Overview
- •The Community
- •What Can You Do?
- •Getting Things Done
- •Second Opinions
- •Appendix: Some Useful SYSCTL MIBs
- •List of Figures
- •Chapter 1: Installation
- •Chapter 5: Networking
- •Chapter 6: Upgrading FreeBSD
- •Chapter 19: Now What's It Doing?
- •List of Tables
- •Chapter 4: Kernel Games
- •Chapter 5: Networking
- •Chapter 8: Advanced Security Features
- •Chapter 9: Too Much Information About /etc
- •List of Sidebars
- •Chapter 15: Web and FTP Services
Relay Control
Generally speaking, an email server will either accept mail destined for its local domains or mail being sent from its local domains. Let's continue with the http://absolutebsd.com/ mail server example. If that server receives an email for an address at http://absolutebsd.com/, it will accept the message. If the server receives an email from an address at http://absolutebsd.com/ but to another domain, and if other access controls are met, the server will accept the message. If someone completely unrelated to http://absolutebsd.com/ tries to use that mail server as a relay for mail to a third party, the server will reject it.
People who send unsolicited commercial email (aka spam) search constantly for email servers that allow anyone to transmit email through them. If your server allows this sort of relaying, you are a potential source of junk email.
Note You really, really must control email access through your system. If you allow unrestricted relay through your servers, you will be blacklisted by various groups. You can expect to lose connectivity to about 30 to 40 percent of the Internet until you control relay access.
So, what are these "other access controls"? One of the most common is restricting the IP addresses that can send mail to any address through your system. By only allowing people on your local or corporate network to send email through your servers, you instantly eliminate outsiders' ability to use your server to transmit junk mail.
If you provide dial−up service to users, you can also configure your mail server to allow relay from those IP addresses. It's possible that someone could buy a dial−up package from you and use your server to send out junk mail. It's best to make sure that your terms of service not only preclude this behavior, but also list very high punitive damages to compensate you for the masses of complaints you will receive.
Junk Mail Blacklists
"How do you use the blacklist of junk email servers?" you ask. Using one of these blacklist services is a very effective way to cut down on received junk mail, but it can also block legitimate traffic, so you need to at least be aware of whether you're using such a service. These services are generally subscriptiononly, and they require a service contract.
The biggest junk − mail blocking service is the Realtime Blackhole List, or RBL (http://mail−abuse.org/). Most mail server programs include hooks to check sites against the RBL. Consult the blacklist's Web site to see how to integrate their features into your mail server.
[1]Remember from Chapter 5 that 127.0.0.1 is always the local host.
[2]In some circles, forging email to a friend is a rite of passage. That doesn't mean that you should do it, mind you. A competent systems administrator can also recognize forged email at a glance, just by checking the email's full headers.
Email Programs
For many years now, UNIX has included the sendmail email server. This program is huge, obscure, obtuse, and downright intimidating to new administrators. Many experienced UNIX administrators also find it huge, obscure, obtuse, and downright intimidating. Take a look in /etc/mail/sendmail.cf for an example of a very basic sendmail configuration file.
318
Been there? Okay, you can get off the ceiling now. FreeBSD supports alternatives that are not only simpler to configure than sendmail, but also more efficient and more secure, as well. Unless you have to use or provide some older styles of mail service, you don't need to use sendmail.
Who Needs Sendmail?
An ancient (for the Internet) adage holds that "Sendmail is complicated because the real world is complicated." That's true. Sendmail is also well tested, and FreeBSD's sendmail maintainer is also a sendmail developer. Sendmail is needed if you relay mail via BITNET, UUCP, or some other obscure protocols. Almost nobody in North America today uses any of those services. They are used in other parts of the world, where bandwidth is dear and hardware even dearer.
Sendmail even breaks one of the cardinal rules of UNIX, that of having many small tools that can be combined at will. Sendmail is huge and monolithic. The replacements are smaller, and made of several individual programs.
If your email services run entirely over the Internet, like the majority of the mail servers I've seen, you don't need sendmail. If you provide services to a wide variety of clients, at some point you will run into one of those edge cases where sendmail is the only solution. You can build a sendmail solution for that one special client, and leave the rest of the world running on a simpler, easier−to−manage email platform.
Personally, I like sendmail. I'm rather proud of being able to hand−edit /etc/mail/sendmail.cf. I also know a guy who is proud of being able to crush full beer cans against his forehead. Neither is something you really want to brag about, however.
Replacing Sendmail
The two most popular non−sendmail mail servers are qmail and postfix. Both are smaller and easier to secure than sendmail. Both are easier to configure. Postfix has a more BSD−style license, however, while qmail has restrictions on its use, modification, and redistribution. All else being equal, the license makes the difference; we'll use postfix. Since postfix can handle up to a million different email messages a day on commodity hardware, it'll certainly meet your needs.
Installing Postfix
You can install postfix just like any other piece of software, via port or package. Postfix has a couple of extra steps, however, that vary with the version of FreeBSD you are using. I recommend installing it from a port, and following the instructions given by the port.
Pieces of Postfix
Unlike sendmail, postfix has many smaller parts. One part handles receiving mail from the network. Another part handles delivering mail to individual mail−boxes. Yet another transmits queued email. To run postfix well, you must be at least vaguely familiar with the main components. Don't worry if you don't understand what all of these things do yet; we'll cover that as we go.
Master The master daemon supervises all the other parts of postfix. It tells other programs when to run and how much they should do. If something isn't running, you should check the configuration of the master daemon.
319
Smtpd The smtpd program receives email from the network. It does some basic checking to be sure that this is a real piece of email and not an attack of some sort.
Sendmail The program called sendmail handles mail generated locally. Many UNIX programs expect to be able to dump their output into something called "sendmail" and have it mailed. To minimize breakage, postfix includes a program that behaves just like sendmail, but instead delivers the mail to the postfix system (in a maildrop directory, which we'll discuss later).
Pickup The pickup program takes messages from sendmail's maildrop directory, does some basic error checking, and hands the message off to the innards of postfix.
Cleanup The cleanup program receives messages from all other sources. It adds things like the From: header if needed, transforms the mail headers as appropriate, and sends the message to the incoming queue.
Queue Manager (qmgr) Both incoming and outgoing mail sits in queues. The queue manager (qmgr) examines each message, decides where it should go, and hands it off to the appropriate delivery agent.
Trivial−rewrite The trivial−rewrite daemon resolves addresses, determining whether they're local or remote, and rewrites the headers appropriately.
Local The local delivery agent puts mail in local user mailboxes. If you're replacing sendmail and have users using .forward files or procmail to handle their mail, use this delivery agent.
Virtual The virtual delivery agent handles delivery to local user mailboxes, but it doesn't handle
.forward files or procmail. It does handle virtual domains, however. If you're running a typical Internet server, where clients download their mail to a personal computer, this is your best choice.
Smtp Client The smtp client program accepts mail from the queue manager and tries to deliver it to remote hosts (other domains).
Configuring Postfix
Postfix's configuration files are stored in /usr/local/etc/postfix. You'll find a whole mess of sample files here, but they're generally just plain−text versions of man pages. The files you need to be primarily concerned with are main.cf and master.cf.
Master.cf tells postfix's master program how to handle the other daemons it's responsible for. While it's possible that you'll need to tweak this file, you almost certainly won't. Postfix is fast and efficient enough that the defaults probably exceed your needs.
Main.cf controls mail handling. It tells postfix where to send different types of mail, what sorts of mail to accept, and how to behave in general. This is the file you'll need to configure.
We won't cover all the options: Some you should never touch unless you're a very experienced mail administrator, others are obvious (such as the path to particular programs). In general, options are variables. For example, the following line in main.cf would define the variable $myhostname:
...............................................................................................
myhostname = mail.AbsoluteBSD.com
...............................................................................................
320
In later configuration statements, you can set other variables to $myhostname. That way, when you change one variable, the change will propagate properly throughout the system. The port sets most of these to sensible defaults, but you'll almost certainly need to tweak something.
So, without further ado, here are the config statements you need in order to get basic email working.
...............................................................................................
myhostname = mail.AbsoluteBSD.com
...............................................................................................
The myhostname variable is the default hostname, originally taken directly from the operating system. It's used for all sorts of things. You probably don't want to change this, but it is an option if you're doing something funky—for example, if you have a machine that's part of your network but dedicated to a particular client with another domain name. You might also change myhostname if you're inside a firewall and want to conceal your host's real name.
...............................................................................................
mydomain = AbsoluteBSD.com
...............................................................................................
The mydomain variable is similar to myhostname—mydomain is the domain name of the host. It's created by taking the hostname and lopping off the first word. You might need to set this manually if you have an unusual hostname.
...............................................................................................
myorigin = $mydomain
...............................................................................................
The myorigin variable's setting is where outbound mail appears to be coming from. It defaults to $myhostname. On your central mail server, you probably want to set this to $mydomain. You'd like your email address to appear as "username@domain.com", not "http://username@mail.domain.com/", after all.
On other machines that send mail, the default is fine. You'll probably want all these remote machines to send their automated reports to you, and changing the apparent source will just confuse you.
...............................................................................................
mydestination = $myhostname, localhost.$mydomain
...............................................................................................
The mydestination variable specifies the domains and hostnames that the machine thinks it should receive. The default is to accept mail for the system's hostname and for localhost. For example, http://mail.absolutebsd.com/ would accept mail for http://mail.absolutebsd.com/ and http://localhost.absolutebsd.com/.
The mydestination default is fine for a standalone machine, but if this is the corporate mail server, you would want to add a few additional hosts. The example given with postfix is a good
321
place to start:
...............................................................................................
mydestination = $myhostname, localhost.$mydomain, $mydomain,
mail.$mydomain, www.$mydomain, ftp.$mydomain
...............................................................................................
You might want to add other important machines in your network, such as nameservers, to this list.
These settings should get you up and running.
Restricting Mail Relay
The simplest way to control mail relaying in postfix is with IP address restrictions. The mynetworks statement in main.cf controls which clients can transmit email through the server:
...............................................................................................
mynetworks = subnet
...............................................................................................
The default setting will work for a small office, but you need to add some things if you're providing email service for an Internet network. The subnet keyword tells postfix to allow anything on the same subnet as the server to send email. Take a look at ifconfig −a for your current subnet address. To specify additional networks by IP address, just list them. Separate different subnets by commas.
...............................................................................................
mynetworks = 192.168.141.128/28, 127.0.0.0/8
...............................................................................................
If you cannot relay email from a client system, check to confirm that its IP address is in $mynetworks.
...............................................................................................
relaydomains = $mydestination
...............................................................................................
You can also use the domain name to control relaying, by using the relaydomains setting in main.cf. In this example, if mail is to or from a host in the $mydestination list, postfix will relay it.
If you're using virtual domains (see the "Virtual Domains" section later in the chapter), postfix will also relay for those domains.
Central Relaying
If you want all your machines to relay their mail through a central mail server, you can use the relayhost keyword. You might have a dozen servers that send mail on rare occasions, but want your central mail server to handle all the communication with the outside Internet. (This is a very common configuration.) Set relayhost to the name or IP address of your mail server:
...............................................................................................
322