DanNorth.net

Apologies if you are looking for any articles or trying to post a comment and you are getting 404 errors, or if you wondered where jbehave.org or behaviour-driven.org had gone. Over the last few days I’ve managed to completely hose my server running Debian “testing” distribution, and I’ve had to downgrade to Debian “stable”. This involved some rsync backups and a complete reinstall of the virtual server.

Apologies especially to the lovely people whose blogs I host and who have been extremely patient with me over the last few days.

Because stable is about a year out of date, it is several versions behind fast-moving projects like WordPress, so I have some more fiddling to do before permalinks or comments will be working again.

If you are running Debian/testing in a Virtuozzo VPS, check your kernel version. It seems Virtuozzo uses a broken RedHat 2.6.9 kernel which simply doesn’t work with current Debian/testing packages. If your VPS provider uses a broken kernel, DO NOT UPGRADE libc6 to the current version (2.7) otherwise your system will simply die on its feet. It’s incredible – /bin/ls stops working, so does ssh (so you can’t log in to fix it!) – in fact it seems a huge weakness in the Debian setup. I would have expected the core admin packages and system binaries to be statically linked to avoid exactly this problem. A statically-linked busybox helped me enormously here while I monkey-patched it enough to get it to boot.

For the record, here’s my experience so far:

Places to back up

• /etc (all the system settings)
• /home (also contains /home/vmail where all the virtual mailboxes live
• /var/lib/mysql (lots of WordPress databases)
• /usr/share/wordpress/wp-content (mostly for themes and plugins)

• /var/www (wikis)

  I’m quite pleased things were this well organised. I thought I might be looking for files all over the place.

  Things that worked

• openssh with my existing config and keys. Hurrah!
• postfix and dovecot. Although that’s hardly surprising – they are both rock solid and quite stable. I just rsync’ed the mail directories and settings back and they both started working. After a recommendation by Steve Purcell I’ve been using dovecot as my imap server and authentication daemon with postfix and they are a joy.
• apache2. Enough said.
• mysql 5. I’m really starting to like mysql.

• moinmoin. Needed some love. Actually I needed to clear out all the caches before it would work, and install packages moinmoin-common and python-moinmoin, and of course libapache2-mod-python.

  Things that don’t work

• Apache2 mod-fcgi. I was having problems with this before which went away when I upgraded to Debian/testing, so I’m assuming it just doesn’t work properly in Debian/stable.

• Apache2 mod-svn. It just doesn’t exist in stable, and neither does mod_dav, so I can’t do funky internet filesystem things for my Windows friends.

  Things I’m still struggling with

• Links in WordPress. This is bound to be something really obvious that I’ll work out after a good night’s sleep. It seems ok for some blogs and not for others, so it might be to do with the themes. Update: it turns out I needed a /usr/share/wordpress/.htaccess owned by the apache user with the appropriate rewrite rules in it – thanks Ben Coleman for sorting that out.

  So far my VPS hosting company, Solar VPS, have been great with any support requests I’ve made. I really hope they come through with an up-to-date kernel so I can dist-upgrade everything back to Debian/testing. Update: Virtuozzo has no plans to upgrade the kernel before its next major release, so I’m stuck with Debian Stable (Etch).

This is the first of an occasional series of posts about Linux systems administration. I’ve been an on-off Linux sysadmin for about, well, my first Linux was Slackware on a stack of 3.5” floppies. Every now and then I do something “fiddly” and I want to capture these episodes in case I ever need to do it again, or in case someone else wants to and they find this useful.

I run Debian Testing on kenny, the server that hosts http://dannorth.net, http://behaviour-driven.org and a bunch of other websites, blogs and wikis. (Random plug: it’s hosted by the fine folks at SolarVPS. I have no affiliation with them but they rock.) It seems a good balance between Debian Stable – which is rock solid but always about a year out of date – and Unstable, which requires updating far too often and hosed my old server (cartman – can you see a theme here?).

Mostly it Just Works. In particular WordPress and MoinMoin are a joy to configure and use. I get change out of about 10 minutes to add a new blog.

I also use it as a mail server, using postfix for sending and receiving mail and courier-imap for reading it. I tried a number of mail servers and settled on postfix after dismissing sendmail and qmail as just too complicated and exim after staring at the impenetrable documentation one time too many.

I found it pretty easy to set up secure SMTP over TLS and secure IMAP over SSL, but I stumbled at setting up virtual mail addresses. This article is about how to do that using postfix and courier-imap. It’s pretty straightforward once you know where all the moving parts are, but they were less than obvious to me.

Virtual mail addresses

Mostly you send email to bob@address.com and it turns up in bob’s mailbox in bob’s login account. Sometimes you don’t want this. For instance, I host about 20 domain names on kenny, and addresses like info@blah.com or sales@blah.com need to go to specific people. That’s the first type of virtual addressing, known as virtual alias domains.

The second case is “more” virtual – the user doesn’t even need to exist on the server with a regular login account. Postfix puts the mail into a special directory, and courier-imap presents that directory as the mailbox when the user “logs in” over IMAP. This is where all the moving parts come in. This is known as virtual mailbox domains.

Setting up postfix for virtual alias domains

This is the easier of the two, since the mail ends up in a real email address, so there is no corresponding configuration on the courier-imap side. This information came from the Postfix Virtual Domain Hosting Howto.

In /etc/postfix/main.cf add the following lines:

virtual_alias_domains = dannorth.net virtual_alias_maps = hash:/etc/postfix/virtual

This says that postfix will treat the name dannorth.net as a virtual alias domain and will use the file /etc/postfix/virtual to do the mappings. Your /etc/postfix/virtual might look like this:

# deliver to local account dan@dannorth.net dan # forward to another mail address example@dannorth.net dan@example.com

Once you have this file configured, run the command:

postmap /etc/postfix/virtual

to create the hash database that postfix will use, then run:

postfix reload

to update the configuration.

Setting up virtual mailbox domains

Ok, there are several moving parts here. We need: * a directory to deliver the mail to * to tell postfix to deliver it there * to enable virtual users in courier * to tell courier where the virtual users’ mail lives

In this example, I’ll set up two virtual users, fred and barney, at example.com.

System accounts and directories

The virtual users’ files need to be owned by someone, so we’ll create a “fake” user and group. I’m using vmail for both the user and group names, with uid and gid both set to 5000.

From a root prompt:

# groupadd -g 5000 vmail # useradd -g vmail -u 5000 vmail # mkdir -p /home/vhosts/example.com # chown vmail:vmail /home/vhosts/example.com

Configuring postfix for virtual mailbox domains

In /etc/postfix/main.cf

virtual_mailbox_domains = example.com virtual_mailbox_base = /home/vhosts virtual_mailbox_maps = hash:/etc/postfix/vmailbox virtual_minimum_uid = 100 virtual_uid_maps = static:5000 virtual_gid_maps = static:5000

This is pretty self-explanatory. It says example.com is a magic virtual mailbox domain, all users and groups map to a fixed number (you can get cleverer than this but I’m not worried about it for now), and that all the interesting stuff is in /etc/postfix/vmailbox. The minimum uid is postfix’s safety measure in case I do something stupid. It means I can’t accidentally let someone have access to system files.

Now let’s look at /etc/postfix/vmailbox:

fred@example.com example.com/fred/ barney@example.com example.com/barney/

The magic here is the / at the end of each line. This says to use maildir format (the format courier-imap is expecting) rather than clunky old mbox format. Postfix will create the appropriate directory structure for fred and barney,

Again we create a hash of this for postfix:

# postmap /etc/postfix/vmailbox # postfix reload

Phew! That’s the postfix side done. Now stop for a cup of tea.

Configuring courier-imap for virtual mailboxes

On Debian, courier imap runs as three executables, each with separate init.d scripts. courier-imap and courier-imap-ssl are the imap servers themselves (I run courier-imap bound to localhost for webmail). courier-authdaemon is the chap that does all the authentication. That’s the one we’re interested in.

Firstly, we need to enable virtual users. In the file /etc/courier/authdaemonrc you need to make sure your authmodulelist setting contains authuserdb as one of its authentication mechanisms. Mine looks like this:

authmodulelist=”authuserdb authpam”

Don’t forget to tell the auth daemon you’ve made a change:

invoke-rc.d courier-authdaemon reload

Courier uses a file called /etc/courier/userdb to store virtual user mappings, but you don’t usually edit this file yourself. It has an arcane format (using tabs and pipes as delimiters) and should be left well alone. Instead, courier provides you with some command line tools to manipulate it.

To create an entry for fred, we do this:

# userdb fred set uid=vmail gid=vmail home=/home/vhosts/example.com/fred mail=/home/vhosts/example.com/fred

(That should all be on one line – your browser might wrap it.) Then set a password for fred:

# userdbpw -md5 | userdb fred set systempw

Do the same for barney. Finally we build the hashed user database that courier will actually use:

# makeuserdb

Note: don’t forget to run makeuserdb after making any changes to the virtual user data otherwise courier won’t know.

Testing the configuration

Firstly, try sending an email to the virtual user. Postfix should create the maildir structure under example.com/fred. Then try connecting to courier to read the mail. If you find you are getting authentication problems from the courier side, you can try setting DEBUG_LOGIN=1 in /etc/courier/authdaemonrc and restarting the auth daemon. Don’t forget to switch it off again once it’s working.