Dungog.net SME help

This Help file has been prepared by Dungog Networks for use by it's customers. It may still be useful to general users of the SME server who have added contributed or GPL software Dungog Networks have been involved with.

Admin Guide: Installation and operation instructions for our commercial and gpl software that the System Administrator uses to help manage the server.

User Guide: Explains the interface that is made available via the User Manager for users to configure server side software.

We hope you find it useful. We welcome constructive feedback on our Help file, please email support@dungog.net with suggestions. For further information visit our website dungog.net/sme

Release 0.5a


Mitel SME server

The Mitel SME server is a very simple to use linux distribution for servers. If you have the budget available the mitel supported version is a good deal, and your support allows mitel to continue development.

The free download version is available from e-smith.org and mirrors. You can also order a CD from an online store for a few dollars. Use a search engine with eg 'mitel sme 5.6 CD' to find a local store, Australians can order from http://www.lankum.com/store/catalog/

Mitel SMEserver installation is explained at http://edocs.mitel.com/6000_SME_Server/smeserveruserguide/English/index.html or on the mitel CD in the documentation directory, The SMEserver.chm help file can be found in the documentation directory.

SME is code for Small to Medium Enterprise, in other words Small Businesses, because of the clever design of the servers interface it is also suitable for homes, schools and other uses.


Mitel SME server - Install

Mitel SME server Installation

Select a PC to dedicate as a server, minimum 450mhz 128mb ram,[ but double this is better] and plug into your network.

Insert the SMEserver CD and reboot, answer the initial questions to install the software, then answer the questions from the install wizard to suit your circumstances.

Restart a Client PC after the server has finished this allows the client to pickup a new DHCP address, and further configure your server with a browser at yourservername/server-manager, see next section.


Mitel SME server - Access

Server-manager
The server manager is a series of web forms called panels that enable a client PC to configure the server. Access to the server-manager is via a browser with the URL servername/server-manager, server.domain/server-manager or serverIPaddress/server-manager
User is Admin, with server Admin password

Command Line
Local access.
Keep a monitor attached to the server and press [alt]-[f2] to access a login prompt.

Remote access.
Preferably the server is placed in an out of the way location and it's monitor is removed.
Access to the command line is obtained with a ssh client (Secure SHell). Two free clients are in the dungog.net/sme/files directory putty and terratermSSH.

Before you can access the server with these you need to allow it at server-manager >> remote access
Secure shell access: Private OR Public
Allow administrative command line access over secure shell: Yes
Allow secure shell access using standard passwords : Yes

Admin or Root
When you ssh to the server or use it's own monitor/keyboard
login as root to access the command line or
login as admin to access the console wizard


Mitel SME server - Configuration

Windows LAN (Local Area Network)
Further configuration if the SMEserver will be your file server on you local LAN.

All windows PC's on a LAN need to be in the same workgroup. Set the server to be in the local workgroup via the server-manager >> workgroup. Also in the workgroup panel set your server to be the domain controller, this lets the server create one set of users for authorisation.

Add users via the server-manager >> user accounts panel and set a password for them.
Add a network drive via the server-manager >> information bay
You may need to logoff and logon again to access these new resources, you should see the network drive and a personal drive for the user in your network neighbourhood.

To map these drives either use windows explorer >> tools >> map network drive
select a letter then enter \\servername\homes or \\server\ibayname
Or configure your client to use netlogon.bat, and edit /home/netlogon/netlogon.bat
you must use a dos editor, one way to do this is copy or link to a windows visable area,
chown yourUserName netlogon.bat, make your changes, then copy back

If you use XPhome, it can't use the servers netlogon.bat, you can use it by placing a copy in your PC's startup folder


Admin Internet connection, panel

Admin Internet connection Usage

Custom Internet Connections

The SMEserver has been designed to work best on a permanent internet connection. This panel modifies the defaults, eg. to better suit a dialup user who has a flagfall on phone costs.

Either start/stop the connection, by clicking perform OR configure all settings and, click Save at the bottom of the page.

Establish or close an internet connection.

There are three ways to start your modem, by selecting start and clicking perform. Alternatively create an icon on your desktop to call a dialmon client, see readme OR by using a scheduled dialup.

Click here to add users who can control the modem with the dialmon client.

There are four ways to stop your modem, by selecting stop and clicking perform. By turning it off. by using a scheduled dialup. or by using the dialmon client.

Reset will restart diald, which is sometimes usefull.

Do what to the modem connection:

Alter default behaviour

In some cases the SMEserver will dialup more often than you would wish. To change between the SME behaviour and my alternate set of rules, select the checkbox below and click save at the bottom of the page. I now use the dialmon deamon.

 Enable alternate set of rules

Monitor dialup activity

These settings help to keep a check on your phone and ISP bill.

Send e-mail to netadmin each time your connect.
Make the modem noisy during handshaking.
We log activity to file each time you connect. view log

Scheduled Dialups

Below are pairs of automatic modem dialup and disconnection, delete or modify the times by clicking on the corresponding command. To enable the schedule, mark the checkbox in the modify page. Instructions on what the values mean are also in the modify section. You can enter disconnect times only as a check to ensure connections are terminated, remember to enter none in the connect field. Read the instructions carefully, I don't check any logic for the times you enter.

Click here to add a scheduled Dialup.

Status | Connect | Disconnect | on which Days |  |
 | none: AM | 11:38 PM | 0-6 | Modify... | Remove...


Antivirus, panel

Antivirus Usage

Virus scanning

Scan for viruses using your installed virus engines.

Quarantined and problem email

Check your quarantined and problem emails here, email sent in HTML format rather than plain text may overprint and be difficult to read.

id. no. | log file | email | release | Delete all
3edc74ae-2125 | view... | view... | release... | delete...

You have no problem email.

Scanning and Signature updates

For each virus engine you have installed you will be able to configure automated scans and updates by check a box, or perform them now by clicking on a button. Daily file scans are performed between 2 and 3am.
Daily virus signature downloads occur at a random minute in the hour you select. Unless you select: none, hourly-every hour, weekly-monday 3am, or monthly-on the first day of the month?

Email scanning and File scanning are enabled seperately. If you have multiple engines they can all be used, it's just slower.
Engine email scan file scan scan files now signature updates update now
ClamAV
H+bedv
F-Secure

File scanning options

The users area contains files in the users home directories and the users mail. Ibays contains server shares, web sites and FTP areas. Check a box to include each group in file scans

 User files and mail
I-bays + primary
Mail Results to admin

View the last 100 lines of /var/log/amavis-ng/amavis-ng.log
View the last 100 lines of /var/log/clamav/clamd.log
View the last 100 lines of /var/log/antivir


Backup - config, panel

Backup - config Usage

Modify the selected backup set.

Destination
Select a drive:

Timing

Select the time, and day or days to run. Hourly runs each hour at the nominated minutes past the hour. Enabling automatic backups by selecting on, allows you to choose which days to run.
Automatic backups:
Backup time, minute:
Backup time, 24 hour:
Backup time, day of week:

General
Description:

If you have, large drives but small backups, it may make sense to increment the backup file name eg, 20020829-1445 YearMonthDay-HourMinute Otherwise either use the file name smebackup.tgz or the entry you gave above for the description.
Rsync creates a dir called bus761409, the backup file name is ignored
Backup file name:

The maximum file size for 5.5 and lower SME servers is 2gb. If you have a 5.5 and lower split your backup set so the backup file is under 2gb.
SME 5.6 and an XP client should not have a file size limitation.[or maybe it does, a limitation of samba?]
Rsync copies all your files to a directory called 'smeserver to xp1', instead of compressing to a file. Rsync only to a secure local linux PC mounted with NFS to preserve permissions.
Method:
Save copies of backup:

Priority of backups, being nice to other applications lets them have the server CPU, backups will take longer. Normal lets the backup have the same priority as other programs ,this may slow other applications down, eg your webserver.
Priority:

The default backup includes SME system config files as well as data files. The config files should be regularly backed up but if you are only doing a data backup you do not need them, depending on how when and what you restore you may overwrite the config files with old values. if you select everything you should add an entry in the other directory section below.
Includes SME system config files:

Click Save to enable the above settings, the changes below are saved as you make them.

After saving your settings you can run the backup immediately by clicking below.

Information Bays

This backup set has a blanket exclusion enabled for ibays.

Name | Description
music | mp3's
programs | networked window programs
project | groupware
server | shared drives
smail | squirell mail
web | sites

User Accounts

You can exclude any user from the current backup set, users shown in red are not backed up.

Account | User Name |
cathie | cathie Smith | Modify...
daniel | daniel Smith | Modify...
dialmon | dialmon account | Modify...
joe | joe Smith | Modify...
jo | jo beth | Modify...
jane | jane Smith | Modify...
stephen | stephen Smith | Modify...

Other directories

By entering the full path you can exclude or include other directories from the custom backup, excluded are shown red. A user can keep bulk data under a specified directory, this can be excluded while his valuable work is saved. An included directory may be /usr/local/whizbang/config or /opt/administration, eg. files not normally backed up. Extra directories included in the backup are shown in black

Click here to add a directory to backup or exclude.

Server path |  |
opt | Modify... | Remove...
home/e-smith/files/primary/html/netjuke/var/music | Modify... | Remove...


Backup - modify dirs, panel

Backup - modify dirs Usage

Exclude or Include other directories.

Exclude or include other directories, see below for examples of a user directory, a web site in an ibay, files in an ibay or a website in the primary directory. Note, do not include the leading slash / of the path name.

  • home/e-smith/files/users/joe/home/mp3s
  • home/e-smith/files/ibays/website/html
  • home/e-smith/files/ibays/ghostimages/files
  • home/e-smith/files/primary/html/testsite

Directory name :
Other directories:


Backup - modify drives, panel

Backup - modify drives Usage

Modify the selected backup drive.

Destination

  1. A windows share name is in the format //pc/share,
  2. A unix NFS drive could be unixbox:/home/jeremy
  3. the server zip drive would be /mnt/harddrive

You may name your unix pc with the server-manager option -Hostnames and addresses- , also your NFS drive has to be correctly configured with the nominated drive exported.
Drive name:
Drive type:

Some shares require a user and password, eg NT,2000,XP
User:
Password:

Click to save settings.


Backup, panel

Backup Usage

Custom backup

An alternative method of backing up your server. Automatically backup to a desktop share or removable server drive and exclude selected ibays and users. Backups can be scheduled to any backup set highlighted in red. You can also backup to desktop as usual except now the selected directories are excluded.

Backup Set Summary

Click here to add a backup set.

Description | Frequency | Time |  |
all+opt to p3 | Daily | 23:10 | Modify... | Remove...
sme/stephen to zip | Daily | 11:10 | Modify... | Remove...
small to p3 | off |  | Modify... | Remove...
test2 | off |  | Modify... | Remove...
nfs mirim | off |  | Modify... | Remove...

Backup Drive Summary

Click here to add a backup drive.

Refresh the free disk space statistics below, this tests you connection details

Name | Disk size : used : free |  |
/mnt/zip | 96M 56M 40M | Modify... | Remove...
//p3/backups | 37G 4.3G 33G | Modify... | Remove...
austar:/home/dan | 14G 5.4G 9.1G | Modify... | Remove...

Restore

To verify or restore the files in your backup use the regular Backup or restore. If you excluded the SME config files you will be told The backup file was incomplete, you can ignore this error. Restoring part of a backup can usually be done via an archiving program such as winzip, see the howto for the command line method if that is insufficient, Data file restores do not require a reboot as may be suggested after you use the restore panel.


Change password, panel

Change password Usage

Change password

You are about to change the password for the user account "jane" (user name "Jane Smith").

To change your account password, please fill out the following form. You will need to provide your desired new password twice.

If you cannot change your password because you have forgotten the old one, your local system administrator can reset your password using the server manager.
Old password:
New password:
New password (verify):


Dansguardian - Access Denied

Dansguardian - Access Denied Usage

Access to the site:
http://sex.com/

has been denied for the following reason:
Weighted phrase limit exceded.

You are seeing this error because the website you attempted
to access contains material that has been deemed inappropriate.

If you believe block this to be in error please email
your local helpdesk or network support with details.
Please remember we do actual CONTENT filtering,
not just web sites, but the content within.

Powered by DansGuardian.org


Bandwidth Limiting, panel

Bandwidth Limiting Usage

Bandwidth Limiting

Squid Delay pool

If you have users downloading large files, slowing the internet connection for everyone else, these settings will allow you to restrict their bandwidth usage. The restriction works by examining the URL of the file being downloaded or site being viewed. Any part of the URL can cause a regexp match. eg the word hotmail will slow down hotmail.com and hotmail.fansite.org.
ftp will restrict ftp sites, but also ftp.org
To unlimit australian sites enter .net.au .org.au .gov.au, if you just entered .au you would also allow www.auto.com
Seperate each expression with a space in the appropriate text field below

Web Sites entered in the 'Restricted sites' field can be limited to the 'Reduced download speed' you set below . Sites you wish to be unaffected by bandwidth limits are entered the 'Unaffected sites' field. File downloads can be limited after a set size is reached, Examples of file extentions that you may wish to limit are .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov

Amount to download at full speed:

Reduced speed:

File extentions to limit

Restricted sites

Unaffected sites

Enter the time you want to limit access.
Use 24hr format with this syntax, note the leading 0
eg. Unrestrict lunchtime by using two timezones

  1. Restricted time 1 = 07:30-12:30
  2. Restricted time 2 = 13:30-17:30
  3. Restricted time 3 =

Restricted time 1 :

Restricted time 2 :

Restricted time 3 :

Enable Limiting:


Dansguardian - Exception and Denied Lists, panel

Dansguardian - Exception and Denied Lists Usage

Lists configuration.

Records for exceptionsitelist.

Create, edit or delete records for this catagory here. Details on what this file does and what the required entry is can be found at the top of the config file which you can view via the link below. Advanced users can add lists of records via a template fragment eg. /etc/e-smith/templates/etc/dansguardian/exceptionsitelist/30local

Click here to add another exceptionsitelist record. You currently have 6 records.

criterion |  |
made-to-order.net | Modify... | Remove...
paypal.com | Modify... | Remove...
yahoo.com | Modify... | Remove...
mnogo.ru | Modify... | Remove...
e-smith.org | Modify... | Remove...
dansguardian.org | Modify... | Remove...

Click here to view the current exceptionsitelist file.


Dansguardian - Pam Auth, panel

Dansguardian - Pam Auth Usage

User access

If you are using pam_auth for your proxy access method you can deny users access or give them unfitered access to the internet.

The default access is allowed and filtered. You can modify this below, users shown in RED are denied and users shown in GREEN are unfiltered. After making all changes click back to return to the main panel and click save to restart dansguardian with the new settings.

Account | User Name |  |  |
cathie | cathie Smith | deny... | unfiltered... | clear...
daniel | daniel Smith | deny... | unfiltered... | clear...
dialmon | dialmon account | deny... | unfiltered... | clear...
helen | helen Smith | deny... | unfiltered... | clear...
jane | jane beth | deny... | unfiltered... | clear...
miriam | miriam Smith | deny... | unfiltered... | clear...
stephen | stephen Smith | deny... | unfiltered... | clear...
fred | Fred Smith | deny... | unfiltered... | clear...


Dansguardian, panel

Dansguardian Usage

Web Content Filter

Filtering of web content is performed by the dansguardian program. for more information visit dansguardian.org Make your choices on this page and save them to configure DanGuardian.

Configure Dansguardian

Age Sensitivity to porn is controlled by a PICS rating and by a weighted phrase calculation. The numeric value is only a rough indication of intended ages. If neccesary the weightedphrasemode and naughtynesslimit values can be manually altered at
/etc/e-smith/templates/etc/dansguardian/dansguardian.conf

Age Sensitivity:

To block ALL sites except those in the exceptionsitelist file or to block all sites specified only as an IP address eg 128.659.124.856

Block ALL sites, or Block sites called by ip address

DansGuardian can use the bannedlists maintained by mesd.k12.or.us

Use additional blacklists, and Update blacklists weekly, tuesday between 10 & 11pm

To update the blacklists immediately, click below. [if your online][the original lists are updated weekly]

Ban the following catagories of files, add more via file catagories below

may contain executable code.
may contain harmful macros and viruses
Archives, may contain any sort of file.
Time/bandwidth wasting files

Reporting and logging.

When web access is denied:

Amount of logging:

Format of Logfile:

View log file in a log utility written by Jimmy Myricks.

Click here to view the raw dansguardian access log file.

Other Settings

The following setting allows you to restrict the size of file the user can upload. Here we are filtering the upload instead of the download.

Maximum Size of file allowed to be uploaded:

Custom bans and exceptions

In some cases a site will slip through the filter that you wish to block, or a site you wish to visit is blocked. You can allow or disallow sites, phrases or people via the following table.

Description |  |
an entire domain mail.yahoo.com or .au | Allow... | Deny...
part of a site yahoo.com/adserver | Allow... | Deny...
phrases eg safe sex | Allow... | Deny...
computer IP address | Allow... | Deny...
user, pam_auth only | Allow... | Deny...
regular expression url |  | Deny...
file catagories eg.mp3 |  | Deny...
mime types |  | Deny...

Proxy Access and Browser Setup

Select from the following options.

  • no modifications to default server behaviour. Set browser proxy port to 8080 to filter, to 3128 to use proxy unfiltered. SME now has transparent proxying on port 3128 by default if you don't enter anything
  • pam_auth, set port to 8080, users are required to have valid accounts on the server and must enter their username/password to access the proxy. neddix.de has a script to generate users, passwords & printouts
  • ident, set port to 8080, assumes you have an ident server running on workstations.
    http://groups.msn.com/SmoothWallIDT
  • enable transparent proxy on 8080, no browser setup is needed.
  • stop dansguardian, and return server to default state.
Note. The dansguardian banneduser and exceptionuser setting are enabled when using pam_auth or ident. These settings allow you to block access to the internet for a user or to give unfiltered access.
When filtering on port 8080 access to 3128 & 80 has been disabled, this is to stop the filter being bypassed.

From SME5.6 you can change the port that is filtered. 1024 < port < 9999

Port to filter:

Proxy access method:


Data backup, panel

Data backup Usage

Data backup

This page allows you to create a copy of your own user data files, from your home directory and downloads it to your local desktop via your web browser. The Verify desktop backup file option can be used to view a list of files in a desktop backup file.

Click here to check/refresh the disk usage for this user.

When last checked with the link above your configuration and data files totaled 139M. Your backup will be compressed to approx. half that size. Most files are viewable with winzip, some such as email may require unix tools or winrar[rarlabs.com] to extract or view.

Select an action:


Dialmon Users, panel

Dialmon Users Usage

Dialmon User access

If you are using dialmon for your modem control you can set user access rights to dialmon here. Note: click save on the previous page to enable changes. for the dialmon client. Otherwise select users below who can control dialmon, users shown in RED are granted dialmon rights. You can create a user dialmon, then hand out that password

Account | User Name |
cathie | cathie smith | modify...
daniel | daniel smith | modify...
helen | helen smith | modify...
jane | jane beth | modify...
greg | greg smith | modify...
stephen | stephen smith | modify...


Email - Admin global, panel

Email - Admin global Usage

Global Settings

Global Email settings

By clicking 'Save' you will make a system wide change, either enabling procmail, or resetting users email to local delivery. Nochange allows updating the the .procmailrc file for procmail users.

Global Email Delivery:

Enable TMDA globally

Enable/Disable TMDA, or update the users generated TMDA files.

Global tmda setting:

Global filtering settings

Users need to have procmail enabled, Admin needs to install, configure and enable either junkfilter or spamassassin.

Filtering:

Select how you want spam handled. Forward to a nominated user to check (the pseudonym spamboss). Sort to a personal folder called 'junkmail', or just delete it.

Caution, if you select forward to spamboss, you may cause a mail loop if that user also filters their mail. Either don't enable filtering for that user or add a procmail rule to sort spamboss mail to a folder based on custom headers: of 'spamboss@'

Delivery action:

Global procmail rules.

Any rules you create will be placed before the users rules.

Click here to add another procmail rule. You currently have 2 rules.

priority | basis | criterion | destination | copy | copy to |  |
8789 | Subject | trip to fiji | spamboss | no |  | Modify... | Remove...
748587 | Subject | free offer | deleted | no |  | Modify... | Remove...


Email - Admin individual, panel

Email - Admin individual Usage

Single user setup

You are about to alter email delivery for the user account "helen" (user name "helen smith").

TMDA Enabled

Deselect this checkbox to disable tmda.

Enter your complete tmda confirmation e-mail address below, you can change to a virtual domain but you must keep your username:

Confirmation address:

To add or change a users server/tmda pending queue password type
/sbin/e-smith/signal-event conf-tmda-pwd username tmdapwd
or for users without one, set their tmda password to their 'Last Name' as set in the user accounts panel
/sbin/e-smith/signal-event conf-tmda-pwd-global

User defined TMDA rules

Click here to add another TMDA rule. You currently have 1 rules.

basis | criterion | destination |  |
from | garbage | accept | Modify... | Remove...

Enable procmail

Enabling procmail also lets a user modify her own email behaviour via the user-panel. Enabling local sends one unfiltered email to the users local mailbox. If you want to use the forwarding or both options from the standard User Account panel, go there to do it.

Email Delivery:

User rules

Click here to add another rule. You currently have 2 rules.

priority | basis | criterion | destination | copy | copy to |  |
helen449747 | less than | 50 | Trash | no |  | Modify... | Remove...
helen641138 | Subject | tttttttttt | Drafts | yes | jane@dungog.net | Modify... | Remove...

Options

Mailing list users sometimes attach a cc: to the author of a question when replying to the list. This option will delete one of these email. This option isn't generally necessary

Delete duplicates:

Amount of information written to your log file:

View user log file.Delete user log file.

Note: site-wide filtering has been enabled with junkfilter.

Disable additional filtering by junkfilter, or filter it and select how you want it handled. Forward to a nominated user to check (the pseudonym spamboss). Sort to a personal folder called 'junkfilter', or just delete it.

Filtering:

In geek mode creating and maintaining .procmailrc is your responsibility, this panel will not overwrite it. You can change to geek mode at any time, but if you want to change back to normal mode .procmailrc will be regenerated from the standard templates and any rules you have defined.

User mode:

When procmail is enabled we can make the final rule forward mail offsite, this lets all the enabled spam trapping features work.

Forward after filtering:

Forwarding address:

Current procmail rules file

#------------------------------------------------------------
# DO NOT MODIFY THIS FILE! It is updated automatically by the
# SME Server software. Instead, modify the source template in
# an /etc/e-smith/templates-custom directory. For more
# information, see http://www.e-smith.org/custom/
#
# copyright (C) 2002 Mitel Networks Corporation
#------------------------------------------------------------

# ---------------------------------------
# Default Shell, Program & file locations
# ---------------------------------------
SHELL=/bin/bash
DEFAULT=$HOME/Maildir/
FORMAIL=/usr/bin/formail
MAILDIR=$HOME/Maildir

PMDIR=$HOME
SENDMAIL=/usr/sbin/sendmail

# ------------
# some logging
# ------------
VERBOSE=no
LOGFILE=$HOME/procmail.log

# -----------------
# delete duplicates
# -----------------
:0 Wh: msgid.lock
| $FORMAIL -D 8192 msgid.cache

# ---------------------
#start of Global recipies
# ---------------------

:0
* ^Subject.*trip to fiji
$MAILDIR/.trip\ to/

:0
* ^Subject.*free offer
/dev/null

:0
* < 500
* ^Subject.*TMDA pending summary
/dev/null
# ----------------------
# start of user recipies
# ----------------------

:0
* < 50
$MAILDIR/.Trash/

:0
* ^Subject.*tttttttttt
{
   :0 c
   $MAILDIR/.Drafts/

   :0
   ! jane@dungog.net
}

# ---------------------------------------
# junkfilter - http://junkfilter.zer0.org
# ---------------------------------------
JFDIR=/opt/administration/junkfilter
INCLUDERC=$JFDIR/junkfilter
# ---------------------------------------

:0
* JFEXP ?? .
{
  :0 f
  * JFSTATUS ?? 1
  | formail -i "X-junkfilter: $JFVERSION" -i "X-Spammer: $JFEXP"

  :0 E
  {
    :0 f
    | formail -i "X-junkfilter: $JFVERSION" -i "X-Spammer: $JFEXP"
    :0 A
    ! spamboss
  }
}

# --------------------------
# all else goes to the inbox
# --------------------------
:0
$DEFAULT


Email - Admin RBLS, panel

Email - Admin RBLS Usage

Real Time Blacklists

Realtime Blackhole Listing Sources

Allow - no blocking, don't check against the rbls. Note. mail sent from offline dialup servers is delayed for a minute as the mail server attempts to connect to the rbls sites.
Reject - block mail immediately, deny mail from listed domains
Retry - allow retries, this tells legitimate domains to try again later. It gives innocent relay operators a chance to see the problem, prohibit relaying, get off the RBL, and get the mail delivered.

To view if mail is being blocked, use the server-manager panel 'view log files', select 'smtpfront-qmail/current', with a filter of rblsd

Status:

Enter your RBL sources, more sites can be found at http://cr.yp.to/ucspi-tcp/rblsmtpd.html, the default lists used are
-r list.dsbl.org -r relays.ordb.org
the format is -r then a site, -r then a site repeated for as many sites as you like, you may change the -r to a -a for a whitelist rbls. Note: -r or -a is needed for each rbls domain

RBLS blacklists:


Email - Admin junkfilter, panel

Email - Admin junkfilter Usage

Junkfilter settings

Junkfilter bans and exceptions

Junkfilter works by reviewing expression matching files. In these files you define expressions that you want junkfilter to recognize in messages and then filter those messages out of your user's inboxes. In some cases an email message might be filtered that your user's may not want to be removed from their inboxes. Junkfilter has a 'whitelist' feature which allows you to define certain people/mails so they are not filtered.

Click here to view or edit the junkfilter whitelist [white].

The remaining files will detect spam based based on headers, body content or sender. You can hand edit the files if you wish at /opt/administration/junkfilter/

Click here to view or edit the body content filter [bodychk].

Click here to view or edit the email headers/subject filter [headers].

Click here to view or edit the senders domain [domains/general].

Click here to view or edit the senders addresses [addresses].

Click here to view or edit the senders IP [ip].

Click here to view or edit the senders dialup connection [dialups].

When you have completed your editing, hit the Save button below to load your changes.


Email - Admin overview, panel

Email - Admin overview Usage

Email Management.

Application |
Global changes & procmail rules | Modify
Real Time Blacklists | Modify
Global TMDA settings | Modify
Global junkfilter settings | Modify
Spamassassin settings | Modify

Individual accounts.

You can modify a user's email delivery method by clicking on the link to the right of their name below.The system default filtering method is currently Spamfilter:both Deliver to:folder. Individual filtering overrides are shown.

Account | Name | email delivery | vacation | TMDA | spam filter |
cathie | Cathie Smith | procmail |  |  | systemdefault | Modify
christy | Christy Smith | local | on |  | junkfilter spamboss | Modify
clare | Clare Smith | local |  | on | spamassassin spamboss | Modify
catherine | Catherine Smith | procmail fwd |  | on | systemdefault | Modify
frog | Daniel Smith | local |  |  | systemdefault | Modify
greg | Greg Smith | procmail |  |  | none | Modify


Email - Admin TMDA, panel

Email - Admin TMDA Usage

TMDA settings

Site wide bans and exceptions

TMDA works by replying to email asking for confirmation, spam/UCM typically will not reply, while mailing lists and some other types of required mail can't reply. TMDA has a 'whitelist' feature which allows you to define certain people/mails so they are not filtered, and a blacklist to delete mail.

Click here to view or edit the site wide whitelist.

Click here to view or edit the site wide blacklist.

Global settings

Enter the length of time an email can sit in the pending que before the user is notified about it. The notification email is sent at 4am. The suggested time to wait is 1d. The time interval is given in seconds [s], minutes [m], hours [h], days [d], weeks [w], months [M], or years [Y]. eg 6h or 7d or 1M

Prompt user after :

Enter the length of time an email can sit in the pending que before it is permanently deleted. The suggested is 7d

 Clear an email after :

Enter the time to run the Daily pending queue check and purge, You can enter the time in 2 minutes to run it now.
The format is important, minutes space hour, mm hh,
30 19 is 7.30pm, valid values 0-59 0-23.

 Time of pending queue check :


Email Autoreply, panel

Email Autoreply Usage

Email Autoreply

The user 'jane', has the following pseudonyms, 'jane.smith jane_smith accounts'. You can enable an autoreply message for each pseudonym below.

The message that is sent is a file in the users home directory. Each pseudonym can have its own file but will default to the username's if it doesn't exist. The files are called autoreply.jane or autoreply.pseudonym eg autoreply.john_smith. If autoreply.jane doesn't exist an empty reply is sent.

The mail that is replied to is sorted into an imap folder 'autoreply', it will be created if it doesn't exist after the first email is replied to but you may need to subscribe to it.

Email address | Autoreply |
jane | disabled | modify
jane.smith | enabled | modify
jane_smith | disabled | modify
accounts | enabled | modify


Forward Mail, panel

Forward Mail Usage

Forward Mail

Modifying the email forwarding for user jane (jane smith).

Email delivery:
Forwarding address:


Installing rpms - Advanced, panel

Installing RPMS Usage

Advanced options

Currently installed rpms:

On rare occasions, some updates may require the use of the force option to properly install. If you have been instructed that force is required, please select Yes below. Otherwise leave this at the default No setting.
Require force?:
Update file (.rpm):

Click here to remove rpms.


Installing rpms - updates, panel

Installing RPMS Usage

Check for updates

You have compared the rpms on your server with the list at
http://www.dungog.net/dungog-update.txt,
The list below shows installed rpms that have different, probably older, version numbers.

Available Updates

Package
devinfo-mitel-update-system | download | Documentation
dungog-proftpd-chroot | download | Documentation
dungog-weex | download | Documentation


Installing rpms, panel

Installing RPMS Usage

Update system

The Update system panel is used for uploading and installing system update files that you have copied or downloaded onto your workstation. Update files have the extension .rpm and are available from your authorized reseller and participating developers.

You should be aware that some updates may take a while to upload and/or may require the server to reboot. Please review the documentation that came with the update file for details before proceeding.

Use the [ Browse ] button below to find the .rpm file on your workstation. The [ Update ] button will upload the file to the server and automatically launch the install process. When completed you will be shown a log file which you may review to see if the update was successful and without errors.

Update file (.rpm):

Click here to check for updates.

Click here for advanced options.

Click here to use .upd format.


Internet Connection, panel

Internet connection Usage

Internet Connection

Make a choice, then start or stop the internet connection, by clicking perform.

Do what to the modem connection:


Junkfilter Settings, panel

Junkfilter mail filtering Usage

Junkfilter Settings

Junkfilter is a rule based spam/UCM email reduction system.

You need to have procmail enabled in normal mode to have the spam filtering rules applied.

Disable additional filtering by junkfilter, or filter it and select how you want it handled. Forward to a nominated user to check (the pseudonym spamboss). Sort to a personal folder called 'junkfilter', or just delete it.

Filtering:


Mailfilter, panel

Mailfilter Usage

Mailfilter configuration.

Settings

Enable mailfilter

If unsure, you can elect to log mailfilters actions untill you can see what it is doing.

Action:

Allow and deny rules

Click here to add a rule for mail filtering.

Action | Topic | Definition |  |
DENY | To | shared | Modify... | Remove...
DENY | To | everybody | Modify... | Remove...
DENY | From | @50megs.com | Modify... | Remove...
DENY | Subject | fruit | Modify... | Remove...

Individual accounts.

You can delete a user's email by clicking on the link to the right of their name below. For names shown in RED, receipt of external email has been disable, including the . and _ Pseudonyms

Account | Name |
cathie | cathie smith | Modify
daniel | daniel smith | Modify
dialmon | dialmon account | Modify
joe | joe smith | Modify
jo | jo beth | Modify
greg | greg smith | Modify
stephen | stephen smith | Modify

Existing rules

#------------------------------------------------------------
# DO NOT MODIFY THIS FILE! It is updated automatically by the
# SME Server software. Instead, modify the source template in
# an /etc/e-smith/templates-custom directory. For more
# information, see http://www.e-smith.org/custom/
#
# copyright (C) 2002 Mitel Networks Corporation
#------------------------------------------------------------

LOGFILE=/var/log/mailfilter
VERBOSE=2

#pop accounts
SERVER=tpgi.com.au
USER=dancer
PASS=weak
PROTOCOL=pop3
PORT=110

SERVER=pop.mail.yahoo.com.au
USER=duke
PASS=wayne
PROTOCOL=pop3
PORT=110

REG_CASE=no
DEL_DUPLICATES=yes
REG_TYPE=basic
NORMAL=yes
# Maximum e-mail size in bytes that should not be exceeded.
MAXSIZE_DENY=3000000
# The maximum e-mail size in bytes that messages from friends
# should not exceed. Set this to 0 if all your friends (ALLOW)
# can send messages as long as they want.
MAXSIZE_ALLOW=0
#user defined rules
DENY=^To:.*shared
DENY=^To:.*everybody
DENY=^From:.*@50megs.com
DENY=^Subject:.*fruit
DENY=^To:.*dialmon
DENY=^To:.*dialmon_account
DENY=^To:.*dialmon.account
DENY=^To:.*jo
DENY=^To:.*jo_beth
DENY=^To:.*jo.beth


Modify Users FTP Access - Nominate, panel

Ftp Root Directory Usage

Modify the Users FTP Access.

Here you can modify the directory the user arrives at after ftp'ing in. The default location is /home/e-smith/files/users/helen/home Another possibility is /home/e-smith/files/ibays/test This allows the user to ftp into this ibay only.
Note on ftp usage: the password is sent in the clear, if possible use scp or rsync with ssh.

Chroot User:
Chrooted directory:


Modify Users FTP Access, panel

Ftp Root Directory Usage

Proftpd chroot users

If you have users connecting via ftp this will allow you to restrict their movement.

Account | User Name | Chrooted | Directory |
cathie | cathie smith |  |  | modify...
fred | fred smith |  |  | modify...
helen | helen smith |  |  | modify...
jane | jane smith | yes | /opt/gm | modify...
stephen | stephen smith | yes | /home/e-smith/files/users/stephen/home | modify...
Chroot all users to their home dir:


Multidrop email, panel

Multidrop email Usage

Multiple pop accounts

This panel allows you to add extra remote pop accounts and optionally designate a user to recieve the mail for an account.

Remote pop mail accounts

< P>You can remove any account or edit the account's details by clicking on the corresponding command next to the account. Edit the first account in the e-mail retrival panel. NOTE: if you enter invalid data fetchmail will fail and no mail will be collected. The deliver to: lets you redirect a pop account to a user or group, the e-mail address needs to be complete eg user@server.net, fetchmail calls this singledrop. * is used for normal sorting

Click here to add a pop account for mail collection.

Status | Account | Password | Server Name | Deliver to: |  |
enabled | smith | wtwist894 | mail.blobby.net.au | stephen | Modify... |
 | username | password | server.net | jim@noisy.net | Modify... | Remove...

Filter mail before downloading

Mailfilter is a flexible utility to get rid of unwanted spam mails, before having to go through the trouble of downloading them into the local computer. Mailfilter connects to any POP3 mail box and compares part of its content to a set of user defined filter rules. That way the spam gets deleted directly on the mail server.

Enable mailfilter, configure filter or view the log file

Domain Email alias

Create a list of domain names to enable mail to be delivered locally, eg. your domain is hosted externally and you want to prevent mail on your local network from having to go via the internet. Note, you could create an virtual domain with the server-manager but then the external web site is not reachable from your lan.

Click here to modify the list of virtual domains you wish to alias.

Currently domains set are: toaster.id


Procmail configuration, panel

Procmail Configuration Usage

Procmail Configuration

User defined procmail rules

Click here to add another procmail rule. You currently have 6 rules.

priority | basis | criterion | destination | copy | copy to |  |
307 | Subject | daveworld | dw | yes | cathie | Modify... | Remove...
903 | greater than | 2000 | jim@noisy.net | no |  | Modify... | Remove...
117650 | address | boccadice | cathie | yes* |  | Modify... | Remove...
362543 | Subject | picklist | spuds | yes | kate/more/than/this | Modify... | Remove...
583297 | Subject | devinfo | devinfo | yes | devinfo/hold | Modify... | Remove...
932663 | address | kabul | deleted | no |  | Modify... | Remove...

Options

Mailing list users sometimes attach a cc: to the author of a question when replying to the list. This option will delete one of these email. This option isn't generally necessary
Delete duplicates:
Amount of information written to your log file:
View your log file.
Delete your log file.
In geek mode creating and maintaining .procmailrc is your responsibility, this panel will not overwrite it. You can change to geek mode at any time, but if you want to change back to normal mode .procmailrc will be regenerated from the standard templates and any rules you have defined.
User mode:

Current procmail rules file

# --------------------------------------
# .procmailrc
# --------------------------------------

# Default Shell, Program & file locations
SHELL=/bin/bash
DEFAULT=$HOME/Maildir/
FORMAIL=/usr/bin/formail
SENDMAIL=/usr/sbin/sendmail

#some logging
VERBOSE=no
LOGFILE=$HOME/procmail.log

# BEGIN RECIPES

#start of user recipies
# ---------------------

:0
* ^Subject.*daveworld
{
   :0 c
   $HOME/Mail/dw/

   :0
   ! cathie
}

:0
* ^>.*2000
! joe@offsite.net

:0 c
* ^TO_.*boccadice
! cathie

:0
* ^Subject.*picklist
{
   :0 c
   $HOME/Mail/spuds/

   :0
   $HOME/Mail/kate/this/
}

:0
* ^Subject.*devinfo
{
   :0 c
   $HOME/Mail/devinfo/

   :0
   $HOME/Mail/devinfo/hold/
}

:0
* ^TO_.*kabul
/dev/null

# --------------------------
# all else goes to the inbox
:0
$DEFAULT


Procmail Rules, panel

Procmail Rules Usage

Procmail Rules

First action

Select the part of the email/headers to be tested.
Based on:

The criterion could be an email address, a subject line, just parts of them, or the email size.

The custom header criterion should be similar to: "X-From_: noreply@sourceforge.net". Procmail will perform an exact match from the X- to the .net
Criterion:

Define what you are going to do with your message.
Action:

Leave the Destination field blank if you are deleting the email or sending to an existing mail folder. If you want to create a mail folder enter the new name here. It will be created the first time it receives mail however you must remember to subscribe to the new folder in your IMAP client to make it visible. Alternatively create and subscribe to the folder in your IMAP client first, then it will appear in the Existing mail folder box below. To forward to an email address, enter the address in the Destination box, eg [ user@domain.com ].
Destination:
Existing mail folder:
Optional copy

Send a copy of the email to somewhere else. If you want the copy to continue to be processed by the rest of your rules; select send to my inbox. Then it will end up in your inbox if no other rules intercept it.
Copy:
Action of copy:
Destination of copy:
Existing mail folder:
Priority

Change the order in which rules are evaluated by altering the numeric value. Priority is determined by ascii value, and must be unique or you overwrite the other rule with that value. eg user101 goes first, then user5 then user99. because 1<5<9

Order of rule execution:


Rsync, panel

Rsync Anonymous server Usage

Anonymous Rsync

Ibays

Information Bays shown in red have Global Access set to global [Entire Internet- no password required], this settings enables Anonymous Rsync access to the ibayname/files directory.

Click modify to toggle the ibays Public Access to 'global' to allow access [shown in red] or 'local' disallow access [shown in black].

Use the Information Bays panel for finer control for deselecting global Public access and to set read permission, For anonymous rsync either set user access read to everyone, or if read access is set to group, group is everyone.

To allow external access to your files install.
e-smith-rsyncd-0.0.1-04 for SME 5.5
e-smith-rsyncd-0.0.2-01 for 5.6 & above
Charlie Brady prepared these rpms which are also available at dungog.net/sme/files. Thanks Charlie !

Click here to view logs of recent access to your rsync server.

Name | Description | Permissions |
biz | smith business |  | Modify...
dummy | testing | check | Modify...
dungog | dungog net web site |  | Modify...
smith | smith ibay | ok | Modify...

Status

Disable or enable access to files on your server via Anonymous Rsync

Anonymous Rsync:


Rsync config, panel

Rsync config Usage

Modify the selected backup set.

General

For this process to be automated you should have configured a user to be able to slogin to a server and be allowed in without a password prompt

For multiple directory or server transfers it could get very confusing, so only enter multiple entries for one catagory, if you enter extra entries only one is used.

 Description:
Select a users for rsync to run as:
Method:
Options:
Delete files that don't exist on the sending side, Always test first.
compress file data, This option is useful on slow links.
Don't ping server first, some servers don't respond.
to include mysql tables in your transfer, requires you to send the dir /home/e-smith/db/mysql or a parent dir.

To run a command or shell script, before or after the rsync job enter the command below, leave blank for no command. Pre rsync command, eg, /usr/bin/moveaway:
Post rsync command, eg, /usr/bin/moveback:

Local server - sme5.dungog.net

Local directory
/home/testrs copy&Edit... Remove...
add directory, eg,/home/e-smith/files/ibays/vital:

Remote server
dell.dungog.net copy&Edit... Remove...
add server:

Remote directory

/home/stephen/Desktop | copy&Edit... | Remove...
/home/stephen/sme/files/ | copy&Edit... | Remove...
add directory:
Timing

Select the time, and day or days to run. Hourly runs each hour at the nominated minutes past the hour. Enabling automatic backups by selecting on, allows you to choose which days to run.

 Automatic backups:
Backup time, minute:
Backup time, 24 hour:
Backup time, day of week:

Click Save to enable the above settings

After saving your settings you can run the backup immediately by clicking below.

Current rsync script file

#!/bin/bash

# rsync 'driver' script.  (Uses SSH as the transport layer.)
# based on http://www.scrounge.org/linux/rsync.html
# modified stephen@dungog.net [dungog.net/sme]

# Does copy, not so verbose.
OPTS='-u -a  --delete --rsh=ssh --stats'

# May be needed if run by cron?
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin

    echo 'Begin rsync transfer.'

# Only run rsync if dell.dungog.net responds.
VAR=`ping -s 1 -c 1 dell.dungog.net > /dev/null; echo $?`
if [ $VAR -eq 0 ]; then
    echo ''
    echo 'Recieving /home/stephen/Desktop from dell.dungog.net.'
    rsync $OPTS stephen@dell.dungog.net:/home/stephen/Desktop /home/testrs
else
    echo 'Cannot connect to dell.dungog.net.'
fi

# Only run rsync if dell.dungog.net responds.
VAR=`ping -s 1 -c 1 dell.dungog.net > /dev/null; echo $?`
if [ $VAR -eq 0 ]; then
    echo ''
    echo 'Recieving /home/stephen/sme/files/ from dell.dungog.net.'
    rsync $OPTS stephen@dell.dungog.net:/home/stephen/sme/files/ /home/testrs
else
    echo 'Cannot connect to dell.dungog.net.'
fi

    echo 'Ending rsync transfer.'


Rsync, panel

Rsync Usage

Rsync mirror

Automatically mirror your data to another server. Use either secure rsync using ssh keys, or anonymous rsync. Transfers have been scheduled for sets highlighted in red. You also have a transfer now option for each set

Transfer Summary - Secure

Click here to add a transfer set.

Description | Frequency | Time |  |
virtual to wrcct | Daily | 21:19 | Modify/Run... | Remove...
test rsync to vm | off |  | Modify/Run... | Remove...
sme to virtual | Daily | 20:16 | Modify/Run... | Remove...

Transfer Summary - Anonymous [todo]

Description Frequency Time

Configure your server as an Anonymous Rsync server

Click here to view which ibays are setup to allow anonymous rsync downloads. You can also enable or disable anonymous rsync to your server


Tagged Mail Delivery Agent, panel

TMDA email filtering Usage

Tagged Mail Delivery Agent

TMDA is a confirmation based spam/UCM email reduction system.

Enable TMDA

Select this checkbox to enable tmda.

Enter your complete tmda confirmation e-mail address below, you can change to a virtual domain but you must keep your username:

Confirmation address:

To check your pending queue at servername/tmda If you forget it just create a new one.

TMDA pending password:

TMDA Tagged Addresses

Create a reply to: address that you can paste into your email client: that will bypass the TMDA rules.

  • a temporary e-mail address which only works for a defined time interval. The time interval is given in seconds [s], minutes [m], hours [h], days [d], weeks [w], months [M], or years [Y]. eg 6h or 7d or 1M.
  • a keyword address which will work for any sender and indefinitely unless specifically revoked. Any string can be used as the keyword.
  • a sender address which is an e-mail address that only a certain sender can use, eg a mailing list.

Type of tagged address: keyword or expiry:

User created TMDA lists

Click here to view or edit your individual whitelist.

Click here to view or edit your individual blacklist.

Click here to view your tmda incoming rules.

User defined TMDA rules

You may use existing procmail rules to make tmda accept email, this may reduce duplication of rule creation, it may also cause confusion, enable this option below, and click perform above to save. Edit procmail rules here

User procmail rules:


Subject: TMDA pending summary Sun Jun 30 10:54:56 EST 2002
From: stephen@smith.net
Date: Sun, June 30, 2002 10:54 am
To: stephen@smith.net

Priority:
Normal

1025233918.4818.msg (2 of 2 / 3 bytes)
>> Date: Fri, 28 Jun 2002 13:11:50 +1000 (EST)
>> From: "Helen smith"
>> To:
>> Subj: g2
stephen-confirm-1025233918.4818.11e763@smith.net


TMDA email filtering rules

Add or modify a TMDA rule.

Select the part of the email message to be tested.
Based on:

The criterion could be an email address, a subject line, a text phrase, or the email size.
Criterion:

Define what you are going to do with your message.
Action:


User Manager - Panel Access, panel

User Manager Usage

Modify user-manager access

Account name: globalUP
User Name:
Accessible Panels:
Panel | Description
backup | Backup or restore
blades | Blades
dansguardian | WWW Filter
datetime | Date and time
directory | Directory
dungogbackup | Custom backup
dungogrsync | Custom rsync
emailblocking | E-mail blocking
emailretrieval | E-mail retrieval
greymatter | Greymatter weblog
groups | Groups
hostentries | Hostnames and addresses
ibays | Information bays
ispconnection | ISP connection
localnetworks | Local networks
multipop | pop3's and prefilter
online-manual | Online manual
otheremail | Other e-mail settings
password | Password
printers | Printers
processmail | E-mail filtering
pseudonyms | Pseudonyms
qmailanalog | Mail log file analysis
quota | Quota management
reboot | Reboot or shutdown
reinstall | Create reinstallation disk
remoteaccess | Remote access
review | Review configuration
starterwebsite | Create starter web site
support | Support and licensing
updates | Update system
useraccounts | User accounts
userpanel-autoreply | Email autoreply
userpanel-forwarding | Forwarding
userpanel-password | Change Password
userpanel-procmail | Process Mail.
userpanel-tmda | TMDA Email Confirmation
userpanel-userbackup | USER backup & restore
userpanel-vacation | Vacation Message
userpanelaccess | User Panel Access
usershellaccess | User shell access
uservacations | User vacations
vdomain | Virtual domains, Advanced
viewlogfiles | View log files
virtualdomains | Virtual domains
webexchanger | Website exchanger
workgroup | Workgroup


User Manager, panel

User Manager Usage

Change access to server-manager panels for user accounts

You can modify individual users access to the server-manager panels below by clicking on the link next the account. Users in red have some form of extra access. You can globally assign a panel by editing the global account

Current List of User Accounts

Account | User Name |
cathie | cathie Smith | Change Access...
dan | daniel Smith | Change Access...
helen | helen Smith | Change Access...
jane | jane beth | Change Access...
stephen | stephen Smith | Change Access...
Global | every user | Change Access...


Vacation Message, panel

Vacation message Usage

Vacation Message

Modifying the vacation message for user jane (jane smith).

Enter a vacation message here. You can use the keyword "$SUBJECT" anywhere in the text to be replaced with the subject line from the email that activated the auto-reply. All text up-to the first blank line will be part of the reply email's header so ensure to leave at leave one blank line before you start your reply message.
Enable Vacation Messages:


Virtual Domain, panel

Virtual Domain Usage

Virtual domain email settings

Mail forwarding acts on mail for your virtual domains when it gets to the mail server.

Current List of Virtual Domains editable by admin.

Domain | Description | Mail Delivery | Delegation
xidac.com.au | virtual test | Modify ... | admin
netball.nsw.org | netball organisation | Modify ... | technical
gaggle.org | test domain | Modify ... | greg


Virtual Domain - Email forwarding, panel

Virtual Domain - Email forwarding Usage

Modify virtual domain Email.

Delegate the virtual domain "xidac.com.au"

Forward all email for this domain to a remote mailserver, either use a FQDN sub.domain.net or an IP address. Leave blank to forward some or all virtual domain address to local users, you set this up below.

Server Name or IP:

Forward selected email to users

Forward to users. The Catchall email address allows you to forward all email for this Domain to a local user. You can enter a virtual aliases below, it will overrule the catchall address.

Note: All email has to go to a local user first. That user can then forward mail to a remote address, or possibly use procmail to forward to multiple addresses.

Catchall email address.:

There are no email accounts for the virtual domain "xidac.com.au"

Click here to add your first Virtual Domain address.


Virtual Domain - Individual, panel

Virtual Domain - Individual Usage

Modify virtual domain Email.

The Catchall email address allows you to forward all email for this Domain to a local user, leave the following field blank to sort normally. When you enter a virtual aliases below it will overrule the catchall address.

Note: All email has to go to a local user first. That user can then forward mail to a remote address, or possibly use procmail to forward to multiple addresses.

Catchall email address.:

Current List of email accounts for the virtual domain "smith.wattle.id.au"

Click here to add another Virtual Domain address. You currently have 3 addresses.

Virtual Domain address | Forwarding address |  |
james.bond | stephen | Modify... | Remove...
stephen | helen | Modify... | Remove...
fdsgvsfdvsfg | daniel | Modify... | Remove...


Virtual Domain - Options panel

Virtual Domain - Options Usage

Modify virtual domain - Options

Domain name: tantrum.us

Alternative administrator:

Restrict the userlist in the dropdown box to members of a group.
Useful for delegated domains where an ordinary user is managing other users.

Alternative group:


Web app Greymatter, panel

Web app Greymatter Usage

Greymatter Weblog Creator

Operation status report

Weblog created, user Alice pwd wonderland, note case. you should now:

  • create a new user and remove Alice
  • add your email address and review options
  • run the diagnostics
  • add the first entry which gives users something to look at.

Before creating your weblog you need to set up an ibay, give your preference of public access, and enable cgi. Note: once you create a weblog in an ibay permissions are changed so only the webserver can write to files in it. ibays currently being used as weblog holders are: blog blogtest cart

Brief Description:
Select ibay to hold the weblog:
Refer to dungog.net, for included template examples. These work perfectly in explorer, less so in other browsers.
Select template:
Options:
Enter a subdirectory for this ibay, this is to group sets of weblogs together.eg. ibay = people, subdirs = gordon, charlie, peter.
Sub directory:
Enter a different webname eg. a virtual domain
Web server name:

Current List of weblogs.

Weblog | Description |  |  |
www.dungog.net/blog/ | ibay root | weblog .. | admin .. | Delete ..
www.dungog.net/blog/daniel | daniel | weblog .. | admin .. | Delete ..
www.dungog.net/blog/greg | surfing | weblog .. | admin .. | Delete ..
netball.nsw.org//dungogjnr | dungog junior | weblog .. | admin .. | Delete ..
netball.nsw.org//dungogsnr | dungog senior | weblog .. | admin .. | Delete ..


Web Content Filter, panel

Web Content Filter Usage

Web Content Filter

Filtering of web content is performed by the dansguardian program. for more information visit dansguardian.org Make your changes on this page and save them to configure DanGuardian. The exceptionsitelist file is updated after restarting. Saving the settings and restarting the filter may take the server 30 seconds.

Allow a blocked site

Click here to add another exceptionsitelist record.

web site |  |
yahoo | Modify... | Remove...
hotmail.com | Modify... | Remove...
ebay.com | Modify... | Remove...
bbc.co.uk | Modify... | Remove...

Click here to view the current exceptionsitelist file.


Admin Tools

Admin Guide

Programs to help in administration of and access to your SME server.
Most programs here include server-manager panels to help configure the the task you are performing. These are accessed by a web browser at the address http or https://yourserver/server-manager. To access the web pages you need the Admin Password.

Topics contained in books with red stars are about our software, these are purchased from dungog.net/sme/purchase.php These include panels and/or ancillary files to configure a task or another program. The other program that is configured could be GPL'd, you are able to use it without buying anything from us, our job is to simplify it's use.

Other topics cover GPL software that we have written, been involved with or think is cool.

Summary of commercial programs

Note: we recommend you be aware of later versions of our software, These will have additional features or bugfixs, we have made this as painless as possible. By using the Update System Panel it's only a few clicks.

Email filtering and user managment
User email management, Spam/UCE mitigation with junkfilter and/or TMDA (tagged mail delivery agent). Email blocking for permanent connections.

WWW content filtering and Bandwidth limiting
Dansguardian installer , with a web interface to control content and access. Bandwidth limiting, a seperate rpm to set limits on the speed users can download large files.

Custom backup to disk &/or rsync locally or remotely
Create different sets of files to be backed up at a preset time, send to different destinations on your local network, ie. server drive, windows share, nfs drive. Mirror files to or from a remote server, Configure an ibay to be an anonymous rsync server.

Mail and File virus scanning
A panel that allows most virus engines to be used on your SME server, mail scanning with amavis-ng , with a choice of three virus engines.

Virtual domains
Modify the DNS information for a domain on your local server to redirect to another site, Forward all or only some of the email addressed to a domain, Delegate these functions to another user.

Dialup Tools [for servers with a dialup internet connection]
Multidrop mail multiple pop3 mail retrieval and pre-filtering. Alternate ISP connection methods. Show the current status of your dialup internet connection, Web site duplicator, replicates a local site to a remote host.

Web Applications
Install multiple Greymatter Weblogs, Configure Chained SSL certificated from freessl.com


Email - Admin

Email managment and filtering

User management
The email admin panel has links to sub panels and shows a table of all users and displays what settings have been applied to their email.

In the table of users their emal delivery option is shown, with a link to modify that users configuation. Standard email delivery optons are local, forward or both. Alternative options are procmail and procmail fwd. Procmail allows server side processing of mail as it arrives, procmail forward, forwards mail after filtering spam and running procmail rules.

The panel also shows which users are using Vacation, TMDA and if using Junkfilter what setting is being used.

Links lead to sub panels that enables you to set global settings, individual settings, RBLS settings and the junk mail filters junkfilter,spamassasin and TMDA. Methods for handling spam

Tagged mail delivery agent (TMDA) thwarts incoming junk-mail is simple yet extremely effective. You maintain a "whitelist" of trusted contacts which are allowed directly into your mailbox. Messages from unknown senders are held in a pending queue until they respond to a confirmation request sent by TMDA. Once they respond to the confirmation, their original message is deemed legitimate and is delivered to you.

Junkfilter filters a wide range of spam using many different types of filters, typically body content or subject. It is configurable on a systemwide or per-user basis. Admin has three alternatives for dealing with detected mail, to delete it, to sort to a users mail folder for her to review or to forward to an common account [spamboss] for later review.

Spamassasin
e-smith-spamassasin filters spam using different types of filters, similar to junkfilter, it is set up with a separate GPL rpm. The latest version keeps changing locations, search e-smith.org forums or contribs.org for latest download site. Dungog-emailfiltering reports on these Spamassasin settings in the email management panel so admin can monitor user usage.

Email - Admin overview panel


Email - Admin install

 1. User-manager

e-smith-usermanager & both perl-* rpms at dungog.net/sme/files/userpanel
rpm -Uvh [three files in the userpanel download folder]
this provides the userpanel for users to configure their own email settings and installs a few files that are required for junkfilter and procmail

2. User management

purchase & download from dungog.net/sme
rpm -Uvh dungog-emailfiltering-0.1-12.noarch.rpm
This provides the panel for management of users email settings
and the user-manager panels for tmda and junkfilter
access via server-manager >dungog.net >email filtering
and/or via user-manager >junkfilter or TMDA

2a. Junkfilter

dungog.net/sme/files
junkfilter requires :: junkfilter-2.25-1 & dungog-emailfiltering

rpm -Uvh dungog-junkfilter-2.25-1.noarch.rpm
go to the server-manager >dungog.net >email filtering
then >junkfilter to edit or review the black and whitelists
and >global settings to propagate the desired settings across your users

users can configure Junkfilter via the user-manager

2b. TMDA

dungog.net/sme/files
tmda requires :: tmda-0.71 , tmda-cgi-0.71 & dungog-emailfiltering-0.1-12 and greater.
tmda also requires python2. New versions of SME server, 5.5 and above, include python2

rpm -Uvh tmda-0.71.noarch.rpm
rpm -Uvh --nodeps tmda-cgi-0.71.noarch.rpm [nodeps because of a false dependancy]
[ if using the 'update system' panel the advanced link has a --nodeps toggle

set up at the server-manager >dungog.net >email filtering
then >TMDA to edit or review the global blacklist, whitelist, and notification settings
and >global >update settings to propagate the desired settings across the tmda enabled users

users can configure TMDA via the user-manager

updating
versions of tmda and dungog-emailfiltering must match
if you were using tmda-0.63 the last version of dungog-emailfiltering you can use is 0.1-11 when moving from 0.63 to 0.71 the method for accessing the pending queue changes, see the user panel instructions


Email - Admin global

 Global Email delivery settings
You can make a system wide change, either enabling procmail, or resetting users email to local delivery. Nochange allows updating the the .procmailrc file for procmail users. eg if you add or change a template fragment

Enable TMDA globally
Enable or Disable TMDA for all users on the system, or update the users TMDA settings.
Nochange allows updating the the TMDA config files for users, sometimes required after updating dungog-emailfiltering or TMDA rpms

Global junkfilter settings
Users need to have procmail enabled in normal mode to use Junkfilter, or spamassassin, both run as a procmail rules. Enable or Disable Junkfiltert and select how you want spam handled.

  • Forward to a nominated user to check (the pseudonym spamboss).
  • Sort to a personal folder called 'junkfilter',
  • Delete it.
Caution, if you select forward to spamboss, you may cause a mail loop if that user also filters with junkfilter. Either don't enable filtering for that user or add a procmail rule to sort spamboss mail to a folder based on custom headers of: 'spamboss@'

Global procmail rules.
Create procmail rules that all users run, they will be placed before the users rules.

Email - Admin global panel


Email - Admin individual

 With the Individual settings, admin can change the alternate email delivery methods

Enable/disable TMDA and make changes to default reply to address,and add and modify tmda filters

Enable/disable procmail and make changes to procmail rules, options,and forwarding address. As well as reviewing the .procmailrc file, and reviewing and deleting the procmail log file, Admin can select the junkfilter filtering method filtering and set user to procmail geek mode which allows hand editing of the .procmailrc file

Enable/disable Vacation and set the vacation message.

Email - Admin individual panel


Email - Admin RBLS

 Block mail before it enters your server by using Real time Blacklists Sources - RBLS

Install e-smith-mailfront-1.0.0-02rbl.noarch.rpm or later from ftp://ftp.e-smith.org/pub/e-smith/contrib/CharlieBrady/RPMS/noarch/, your server will now block mail from sites listed at the active rbls

The RBLS panel allows you to disable blocking, or block more aggressivly by denying retries

You may also add more or change the default RBL source.

Email - Admin RBLS panel


Email - Admin TMDA

 Tagged Message Delivery Agent

The way TMDA thwarts incoming junk-mail is simple yet extremely effective. You maintain a "whitelist" of trusted contacts which are allowed directly into your mailbox. Messages from unknown senders are held in a pending queue until they respond to a confirmation request sent by TMDA. Once they respond to the confirmation, their original message is deemed legitimate and is delivered to you. Updating your whitelist insures they won't have to confirm future messages. SMEserver TMDA has been configured to automatically whitelist confirmed senders. Users can also define rules that match on mail headers or body to allow mail through.

TMDA's functionality is based upon the following assumptions about the current Internet infrastructure:

  1. You cannot keep your email address secret from spammers.
  2. Content-based filters can't distinguish spam from legitimate mail with sufficient accuracy.
  3. To maintain economies of scale, bulk-mailing is generally:
    • An impersonal process where the recipient is not distinguished
    • A one-way communication channel (from spammer to victim)
  4. Spam will not cease until it becomes prohibitively expensive for spammers to operate.

Usage:
In the simplest form which most users can adopt, valid email is confirmed by the sender, mail with an invalid reply to: address is summarised in a daily email and spam is deleted from a pending queue after seven days.

Upgrading:
TMDA is beta software and undergoing change. When upgrading versions you will need to be cautious. The versions of dungog-emailfiltering and TMDA must be compatible,see the install instructions. The users TMDA config files should be updated, with the update command in the global section. You may also like to temporarily disable TMDA checking while you check operation on a test account.

User-manager
Users can set individual options with the user manager. They can check messages in their pending queue at yourserver.net/tmda
Refer to the TMDA User Guide.

server-manager
On your internal network, open your server-manager in a browser.
You should see an option in the left side navigation menu in the dungog.net section for 'email filtering'. Admin can edit the global whitelists and blacklist. Add all your clients and regular contacts here. The behaviour of mail in the pending queue and email notification of that mail can be modified here. whitelist would contain e-mail addresses and/or wildcard expressions, one per line.

Email notification
The user is notified about mail that has been held in the pending queue for 24 hrs by an email which contains details and a mailto link to release the mail. This email is sent daily at a time you enter in the tmda panel, you can set the time to 2 minutes time to hasten the sending of the tmda pending email. Once an email is sent the user in not notified about it again. Email not confirmed after seven days is deleted. These time intervals are alterable.

Options
To enable pending queue email the user needs to have shell access enabled. To do this shell access is temporarily given then taken away during the check, If you gave a user shellaccess previously it may be removed unless you used the panel written by daniel van raay, e-smith-usershellaccess-0.1-1.noarch.rpm from dungog.net/sme/files/ this installs in the server manager 'Security' section , 'User shell access'. Refer to the Server Shell Access

Note :You don't have to give users shell access, the process is automatic. this is only you want to give shell access for other reasons. If you use another method or shell you need to set/unset a db property with '/sbin/e-smith/db accounts getprop username LoginShell /bin/bash'

The user may elect to convert existing procmail rules to an equivalent tmda rule in the users incoming file. This has the effect of allowing in the mail you have already sorted with procmail, rather than create a new tmda allow rule.

TMDA penfing queue
A new feature since tmda-0.71 is a cgi that give access to your pending queue at yourserver.net/tmda Previous versions of dungog-emailfiltering used the user-panel to do a similar thing but a change in tmda-pending forced a change to this method. The user can create a tmda password via the userpanel
or admin can create one with
/sbin/e-smith/signal-event conf-tmda-pwd username tmdapwd
or for users without one, set their tmda password to their 'Last Name' as set in the user accounts panel
/sbin/e-smith/signal-event conf-tmda-pwd-global'
it's not very secure, but the option is yours if you wish.

TOFMIPD - tmda old fashioned mail injection system deamon
A new feature since tmda-0.63. Is not working yet but it shows great promise. You configure a 'mail proxy' that rewrites your email headers and generates a tagged reply address on the fly, saving the bother of generating and keeping track of your tagged addresses.

Servers older than 5.5
SME 5.5 installs with python2 by default. for older servers TMDA requires python2 to be added to the server, NB. python[1] is left untouched. For more information refer to dan york's guide at www.lodestar2.com/software/howto/python2-sme-howto.html. You only need to install one 5mb rpm.

More information
For more information on TMDA especially the more detailed options refer to the TMDA documentation at www.tmda.net.

Email - Admin TMDA panel


Email - Admin junkfilter

 Junkfilter
Junkfilter works by reviewing expression matching files. In these files you define expressions that you want junkfilter to recognize in messages and then those messages are tagged. You then proccess these tagged message.

Site wide policy
Junkfilter can be enabled sitewide in the global section, you are notified what the filtering policy is. The user can't override.

Sorting options
Filter to folder junkfilter
Mail tagged as spam is sorted to an imap folder junkfilter, the folder is created if it doesn't exist, to view the folder you need an imap email client or the server webmail

Filter and fwd to spamboss
Mail tagged as spam is forwarded to a nominated user who checks to see if there is any valid mail in the filtered mail
Caution, if you select forward to spamboss, you may cause a mail loop if that user also filters with junkfilter. Either don't enable junkfilter for that user or add a procmail rule to sort spamboss mail to a folder based on the header X-junkfilter:

Filter and delete
Mail tagged as spam is deleted completely, it is NOT sent to your trash folder

Disable junkfilter
No filtering takes place

Configuration files
Whitelist
In some cases an email message might be filtered that your users may not want to be removed from their inboxes. Junkfilter has a 'whitelist' feature which allows you to define certain people/emails so they are not filtered.

Blacklists
Seperate files contain expressions to trap spam. Edit the appropriate file if you with to block specific mail.

email body content filter [bodychk].
email headers/subject filter [headers].
the senders domain [domains/general].
the senders addresses [addresses].
the senders IP [ip].
the senders dialup connection [dialups].

Email - Admin junkfilter panel


Email - Admin flowchart

 Mail Flowchart with all filtering components
The following is a summary of mail flow if you install all the components available.

          the internet
               |
               |
              / \
             /   \
            /     \
           /       \
          /         \
         /           \
        /             \
        |             |
        |             |
    standard      multidrop
    delivery        pop3
        |             |
        |             |
        |             |
        |             |
        |-X  block mail from entering the server
        |             |   [e-smith-mailfront-rbl]
        |             |
        |             |
        |             |-X delete mail from the pop3
        |             |   mailbox before downloading
        |             |   [dungog-multipop]
        |-------------|
               |
               |
               |
Tagged Mail Delivery Agent [TMDA]
process mail based on rules
1.admin controlled black and whitelists of addresses
2.user defined TMDA rules
3.import and translate existing procmail rules to tmda rules
               |
               |-X delete
               |--o--|| hold in pending queue
               |  |--> request confirmation from sender  -|-X delete
               |                                         -\ or
             allow        <-- release from pending   <----/
               |
               |
Process with procmail [e-smith-user-manager]
1.admin controlled site wide rules  [dungog-emailfiltering]
2.user defined rules
               |
               |-X delete
               |-> sort to folder
               |-> forward
               |
               |
Process with junkfilter or spamassasin
1.admin controlled black and whitelists of addresses,headers/body content
               |
               |-X delete
               |-> sort to junkfilter folder
               |-> forward to spam reviewer
               |-> to inbox for client side filtering of added headers
               |
Forward mail after filtering   [dungog-emailfiltering]
               |
               |-> you@elsewhere.com
               |
           your inbox !


Email - delete double bounce

dungog-doublebounce is an rpm that configures qmail to delete the return bounce from an unknown email address. This can happen when a spam mail is bounced from your server, the spam has an invalid address to a valid server, the remote server replies to your servers bounce sending a message to admin.

rpm -Uvh dungog-deletedoublebounce-0.1-1.noarch.rpm to install
rpm -e dungog-deletedoublebounce to cleanly uninstall.


Dansguardian

Web Content Filter

Users on your LAN can have their web browsing filtered, eg. to block objectionable sites. Filtering of web content is performed by the dansguardian program.

Squidguard comparison
Squidguard is a free program that blocks access via a blacklist of sites. We built the first squidguard / e-smith-squidguard rpms and one of my sites used it for a year and a half. We changed to dansguardian because while it can filter via blacklists, it can also block pages based on content. Reasons why you need this are; new sites making the blacklist out of date, pages that cross the line that are part of otherwise acceptable sites, or to allow parts of sites that are part of larger domains that you don't want to allow.

Legal
A word from the Dan behind dansguardian, Please read http://dansguardian.org/?page=copyright2 and register and/or pay and/or donate for DansGuardian as you feel appropriate.


Dansguardian - config

 Sentitivity
Filtering sensitivity of content is controlled by a PICS rating and by a weighted phrase calculation. The numeric value is only a rough indication of intended ages. PICS is a voluntary rating sites can use to set different web filters judged site content. Weighted Phrases is a core method of dansguardians ablity to rate a site based on the text content of each web page. Each time a banned phrase is mentioned it adds to a points score, if the score is high enough the page is denied.

Blacklists
Sites can be banned if they are recorded in a blacklist of sites without being filtered, this reduces the load on the server which may help if you have a lot of users and a low powered server. A set of Blacklists is made available at dungog.net/sme/files. This set is maintained at squidguard.mesd.k12.or.us. This blacklist may be too agressive and can be disabled. You can use the exception lists to exclude a site in the blacklist.

Options
By checking a box you can deny ALL sites except those in the exceptionlist, or URL's entered as an IP address.
Files of a certain type can be banned, either check a box to ban a catagory or add individual types via a list.
You can ban uploading files, or uploading large files. select your option from a drop down box, default is not blocking.
Reports can be viewed in the raw format, or analysed to report on internet access usage eg how many sites have been denied.

Bans and Exceptions, see the next section
The following catagories can override other settings, and either allow or deny sites, pages, files or users.

  • Sites
  • URL
  • Phrases
  • IP
  • Users
  • regular expression url
  • file type
  • mime type
Proxy Access and Browser Setup
# no modifications to default squid or masq behaviour. Set browser proxy port to 8080 to filter, to 3128 to use proxy unfiltered. SME now has transparent proxying on port 3128 by default if you don't enter anything.

# pam_auth, set port to 8080, users are required to have valid accounts on the server and must enter their username/password to access the proxy.

# ident, assumes you have an ident server running on workstations.
load onto windows client the ident server, http://groups.msn.com/SmoothWallIDT
set port to 8080

# enable transparent proxy, no browser setup is needed.

# stop dansguardian, and return masq and squid to default states.

The dansguardian banneduser and exceptionuser setting are enabled when using pam_auth or ident. these settings allow you to block access to the internet for a user or to give unfiltered access.

When filtering on port 8080 access to 3128 & 80 has been disabled, this is to stop the filter being bypassed.

Dansguardian panel


Dansguardian - Exception and Denied Lists

Banned and Exception Lists.

These lists can override other settings such as weighted phrase or blacklists. They either allow or deny a page depending on the settings.

Exceptionsitelist, Bannedsitelist
Affects the hostname part of a URL eg yahoo.com or for finer control mail.yahoo.com You can affect everything from the .us domain with .us or allow all things australian by using just using .au

ExceptionURLlist, BannedURLlist
Affects the parts of a domain eg abc.net.au/children or bbc.co.uk/cricket will affect the childrens and cricket sections of the domains

Exceptionphraselist, Bannedphraselist
While checking the contents of a page will block or allow if these phrases are found. This is slightly different to weighted phrases which scores the contents and won't have an affect until enough the set limit is reached.

A word or phrase is enclosed by < sex> angle brackets, a leading or trailing space inside the angle brackets is significant. eg [space]sex will not find middlesex

Exceptioniplist, Bannediplist
Affects a PC on the local network with that IP address, Note. SMEserver can assign a static IP based on a network card's MAC address via the hostname and addresses panel

Exceptionuserlist, Banneduserlist
Affects a user when the proxy access method is set to Pam Auth, see the next section for details

Bannedregexpurllist
Affects a URL that contains a pattern that is matched by a unix regular expression. This is very powerful but also difficult to understand and get right if you don't know your regular expression rules.

Bannedfileextlist
Common catagories of files have been grouped so you only need to check a box on the config page. You can ban other file types not included in that list. Bannedmimetypelist
Affects files of a defined mime type

Dansguardian - Exception and Denied Lists Usage


Dansguardian - Pam Auth

Pam auth

When the proxy access method is set to Pam Auth, a user is required to enter their user password before they can have access to the internet.

By changing a users Pam Auth settings they can be denied any access or granted unfiltered access.

Depending on your version of SMEserver and how your network is configured PAM Auth either may not work or the user may be able to bypass the Authentication by changing his browsers proxy settings. You may be able to force a user to use a proxy with windows policys, if you know how we would appreciate a short note on how you did it, to add to these instructions.

Dansguardian - Pam Auth Usage


Dansguardian - Access Denied

Access Denied Usage

When a page is blocked the following screen is displayed. The details of why the page was blocked can be brief or detailed depending on the settings. You can use a template which you hand edit. It is found on the server at /etc/dansguardian/template.html it will be overwritten when you upgrade the Dansguardian rpm

Dansguardian - Access Denied Usage


Dansguardian - Pam Auth

 Further modifications may be made at the shell by advanced users.

blacklists are provided and maintained by a high school district in the US
you may wish to use your own or modify the time you update \usr\bin\rsync-sgbl is script where the lists are rsynced, you can replace the source if you have your own set available with anonymous rsync.
\etc\e-smith\templates\etc\crontab\30rsync-sgbl is where the update time is set

you may only wish to block ads and not use the other squidguard blacklists, go to \etc\e-smith\templates\etc\dansguardian\bannedurllist\40squidGuardIncludes and comment out lists you don't wish to use eg.
$OUT .= "#\.Include</etc/dansguardian/blacklists/audio-video/urls>\n";

Changing the port from 8080 to say 8081
for SME 5.6+ it's easy use a db command as explained in the panel
for SME 5.5down only, edit :
1./etc/e-smith/templates/etc/dansguardian/dansguardian.conf:
$OUT .= "filterport = 8080\n";
2./etc/e-smith/templates-custom/etc/rc.d/init.d/masq/35transproxy:
$OUT .= " /sbin/ipchains --append input -j REDIRECT 8080 -p tcp ";
3./etc/e-smith/templates-custom/etc/rc.d/init.d/masq/35transproxy:
$OUT .= " /sbin/ipchains --append input -j REDIRECT 8080 ";
4./etc/e-smith/templates-custom/etc/rc.d/init.d/masq/45DenyDansquardian:
/sbin/ipchains --append input -p tcp -y -s 0/0 -d $OUTERNET 8080 -j denylog
Lines that are just for documentation are not listed, eg/etc/e-smith/web/functions/dansguardian


Bandwidth Limiting

An rpm to limit bandwidth usage of local user accessing the internet.

The Bandwidth limiting panel configures the squid proxy delay pools feature, and allows you to enable or disable limiting

A list of filename extentions determines the content that is limited. A set amount is allowed to download at full speed, typically the size of a web page, then after the set amount the speed of the download is slowed down to another set amount. This will vary depending on your connection speed.

Sites you want unlimited access to can be bypassed, no limiting occurs.

You can set limiting to only occur at set times, eg during work hours.
Enter in 24 hour format without spaces 07:30-18:00

Bandwidth Limiting panel


Rsync

 Summary: File Transfers

With the dungog-rsync rpm, automate mirroring between servers or most linux pc's with ssh and rsync.

Mirroring with rsync

Transfer files between your sme server and any other linux server with rsync installed.
Automate the process using a easy to setup secure ssh connection.
Distribute or collect data to other servers automatically, eg. users of dansguardian can maintain consistancy district wide by rsyncing config files from Head Office to your sites.

Before you start using dungog-rsync

To establish a secure connection without being prompted for a password you need to install ssh authorized keys, select/create a user on both server with enough permission to read the files you want to transfer, you may need to make them a member of the group that owns the files or chown the files. Using root should work but is never recommended.
Give both users shell access, as the user, use the program ssh-keygen to create your encryption keys then copy the public key to the remote server
slogin to the remote server and add you public key to the file authorized_keys, logout of remote, now you should be able to slogin to the remote server from the local server without being prompted for your password.
The following commands should be all you need.

Note, the method you use here is independant of the rsync rpm, the rsync rpm will not work until you can slogin to the remote server without being prompted for a password or passphrase.

  • enable shell access to both servers for a common username
  • ssh to both servers, mkdir ~/.ssh
  • ssh to local.server.net, cd to ~/.ssh
  • ssh-keygen -t rsa [accept file name id_rsa][don't enter a passphrase]
  • scp id_rsa.pub remote.server.net:.ssh/local.pub
  • slogin remote.server.net
  • cd .ssh
  • cat local.pub >> authorized_keys
When you fill in the rsync form at the servermanager it creates a shell script /usr/bin/dungogrsyncxxxx and a crontab entry if you automate the process.

Rsync, panel


Rsync config

 server-manager >> dungog.net >> rsync settings

After configuring ssh keys for a user you can set up a file or directory to transfer.
Mirroring to 2nd hard drive

You can rsync to a 2nd hard drive in your server without needing ssh, setup the drive so you can mount with mount /mnt/2ndDrive then enter in the 'Pre rsync command' field the mount command and in the 'Post rsync command' field the 'umount /mnt/2ndDrive' command

Rsync config, panel


Rsync Anonymous client

 server-manager >> dungog.net >> rsync settings

Set up files or directories to mirror from an anonymous rsync server
on demand or automated.

Rsync Anonymous client, panel


Rsync Anonymous server

 server-manager >> dungog.net >> rsync settings

To make files available for download by Anonymous Rsync you place them in the files directory of an ibay and make it globally accesable. The panel shows which servers have the correct settings and warns of possible errors in permissions. It has an option to enable or disable anonymous rsync access.

You need to install e-smith-rsyncd-0.0.1-04.noarch.rpm or later from ftp://ftp.e-smith.org/pub/e-smith/contrib/CharlieBrady/RPMS/noarch/

e-smith-rsyncd-0.0.1-04 was written for SME 5.5. A new version for 5.6 is being prepared by charlie brady but until then *5.6* users also need to *add* e-smith-rsync-56 from login.dungog.net to allow external access to your files. Charlie has been sent this patch, not that he needs my help ;-)

Rsync Anonymous server, panel


Backup - Tar

 server-manager >> dungog.net >> custom-backup

Using either tar or rsync dungog-backup allows you to create multiple backup sets and can automate backups to remote 'shares' or to a 2nd drive on the server.

The backup sets are created via a web form. You can backup to desktop as usual except now the selected directories are excluded. Non standard directories can also be backed up, and ibays or users can be partially excluded.

You can backup to a 2nd hard drive with either of our rpms sucessfully. The cost of hard drives being what they are this may be the best option in a lot of cases. A typical setup may be to use two drives, one of which is taken offsite periodically. Drives can be extracted from the server more easily if you use either a removable hard drive rack or a USB2 hard drive. USB works much better on SME6 than previous versions

This article gives clear instructions on the details of formatting as ext3 and editing your /etc/fstab file to enable easy mounting.

http://www.linuxplanet.com/linuxplanet/tutorials/4232/1/

Backup, panel


Tar - configuration

 server-manager >> dungog.net >> custom-backup

Allows you to create multiple backup sets and can automate backups to remote 'shares' or to a 2nd drive on the server.

The backup sets are created via a web form.

Select a destination, from a list of drives you have verified.

Optionally set a time to automatically run

Give a Description of the backup set to identify it, and optionaly to be used at the backup filename

Select how the backup is named, use the description, an automatically dated name or just call it smebackup.

Backup program to use, tgz for tar and gzip, rsync is for unix nfs drives or 2nd hard drives formatted as ext3

Save up to five copies of the backup file ,the original and the four most recent versions.

Decrease the load on the server by giving priority to other programs, let the backup run when the server isn't busy

Exclude whole sections of the server easily by using the drop down boxes or clicking on an ibay or user.

Add or exclude other direcories.

Backup - config, panel


Backup - modify drives

 A windows share name is in the format //pc/share,
A unix NFS drive could be unixbox:/home/jeremy
the server zip drive would be /mnt/zip

The catch here is Linux uses / , if you map a drive in windows you would use \

You can backup to a 2nd hard drive installed in your server, mount the drive as /mnt/zip in fstab and refer to it in the backup panel destination as /mnt/zip, if you format it as ext2 or ext3 you can use rsync and it will store permissions correctly.

Backup -select destination, panel


Backup - modify dirs

 Include other directories that are not normally backed up, eg the /opt directory

Or exclude directories not required in your backup, eg a large mp3 collection

Backup - Exclude/include directories, panel


Antivirus

 Summary:
Requires SMEserver 5.5 and above. The Antivirus panel configures your installed virus scanner. Tested with ClamAV, h+bedv and F-secure. Currently uses Amavis-ng for real time email scanning and has options to scan server nightly or on demand.

Antivirus engines
Select one or more from the following Antivirus Engines. ClamAV, h+bedv or F-secure. Clam is GPL free, h+bedv is free for non comercial home use, F-Secure is commercial

Installation
[amavis and clam is setup as per http://www.pagefault.org/howto/amavis_clam.shtml, note, if you use the following instructions you don't need to refer to pagefault, but credit where it's due ...]

from http://dungog.net/sme/files/amavis-antivirus/
download 16perl&archives-rpms.zip and extract to a directory then rpm -Uvh *.rpm
download and rpm -Uvh the clamav, amavis-ng and qmail-bsmtp rpms
purchase, download and install the dungog-antivirus RPM.
go to yourserver/server-manager > virus scanning
This gives you a SME panel to set scanning times and locations, and helps to set up the remaining config files, enables you to view/delete/release the quarantined and problem email and lets the mail scanning to be quickly turned on or off.

Mail scanning
Select from the server manager panel from the available virus engines which to use to scan email.

File scanning
Select from the server manager panel from the available virus engines which areas to scan by ticking check boxes and saving. This creates a shell script that is either run nightly or on demand by clicking a 'run now' button.

Usage
On your internal network, open your server-manager in a browser.
You should see an option in the Dungog section for "virus scanning".
If you have installed any of the three supported antivirus engines you will have options to set.

Testing
The site http://www.rexswain.com/eicar.html has an of explanation of the eicar virus software test. Copy the file to a directory and scan it or email it to yourself.

Antivirus panel


Antivirus - ClamAV

 Antivirus engines - ClamAV

Clam Antivirus has been packaged for the SME server by Damien Curtain, for more information see pagefault.org and clamav.elektrapro.com.

http://www.pagefault.org/howto/amavis_clam.shtml

scanning switches
A shell script is generated from /etc/e-smith/templates/usr/bin/ if your preferred switches aren't used you can change them here.


Antivirus

 Antivirus engines

visit http://www.hbedv.com download the antivir virus scanner avlxsrv.rpm [antivirus-linux-server.rpm] and obtain the apropriate license.
uncompress the downlaod, tar -zxvf avlxsrv.tgz and copy the license into the new directory ie.
/home/e-smith/files/ibays/dl/files/antivir-server-2.0.7/hbedv.key
to install the virus engine run ./install

scanning switches
A shell script is generated from /etc/e-smith/templates/usr/bin/ if your preferred switches aren't used you can change them here.


Virtual Domain

Summary
You have a virtual domain setup on your SME server but need to alter the standard configuration to either.

  • forward all or only some of the email addressed to a virtual domain
  • Delegate these functions to another user, ie not admin
With this rpm you can have info@domain1.com and info@domain2.org sent to different users on your server. You can safely allow selected users or groups to create their own address under their own domain.

Install
[root@sme5 files]# rpm -Uvh dungog-vdomain0.1-?.noarch.rpm
or with the system-update panel

Virtual Domain Usage


Virtual Domain - Email forwarding

 Each virtual domain can have all it's mail forwarded two ways,
  • To a delegated mail server
  • To a single user on your server.
When the alternate mailserver has been set up to recieve the mail for the virtual domain you enter the domain name or server IP. If you set up the DNS mail forwarding this field is entered automatically. With this option your server accepts the mail and then qmail forwards the mail on.

When you forward to a single user, the users mail can be forwarded off site, or you could use the procmail panel to split and forward the mail.

Virtual Domain - Email forwarding Usage


Virtual Domain - Individual

 User email address
Each virtual domain can have the same user address forwarded to a separate account:
info@domain.org ->gordon
info@site.net ->charlie
info@_all other domains_ goes to user/group/psuedonym info or is rejected

Virtual Domain - Individual Usage


Virtual Domain - Options

 Delegating a Virtual Domain
Alternative administrator:
Each domain can be delegated to a user by a setting in the options. The same panel is accessed via the via the server-manger or user-manager, users who are allowed access to the panel are only shown their delegated domains.

Alternative group:
By selecting a group from the drop down box just users from this nominated group are displayed in the individual forward drop down box.

Install the User manager to make it easy to add the 'virtual domain, advanced' link to a users set of panels.

Virtual Domain - Options panel


Multidrop email

 dungog-multipop
An rpm to download multiple pop3 accounts and optionally redirect individual mailboxes to users or groups.

It requires you to be running your Email retrieval mode: as multidrop [standard mode is being worked on]

Multidrop mail delivery needs help in sorting some mail, eg mailing lists. You may also need to forward admin's mail to a user, enabling procmail with the user manager and creating procmail rules which enables users to sort and process their email.

Usage
Remote pop mail accounts
On your internal network, open your server-manager in a browser.
You should see an option in the left side navigation menu in the dungog.net section for 'pop3's and prefilter'

The first line shown in red is the server default mailbox.
Additional mailboxes are entered with the panel and shown in a table. The status check box should be ticked to enable downloading or unchecked to stop polling, if for example the user wishes to download his mail directly to his email client.

Mail can be sorted directly to a users mailbox by entering his email address, by entering a * mail is sorted in the default manner.

Mail can be downloaded and the original kept on the server by ticking keep

Filter mail before downloading
Mailfilter is a flexible utility to get rid of unwanted spam mails, before having to go through the trouble of downloading them into the local computer. Mailfilter connects to any POP3 mail box and compares part of its content to a set of user defined filter rules. That way the spam gets deleted directly on the mail server.

If you wish to use this option, install the mailfilter rpm
Follow the link the configure mailfilter link
Add rules to identify spam, see next section for details.
Check the Enable mailfilter box to filter pop3 mailboxes.

Virtual domain alias
Configure the in-house server with a different domain name to that used by the company and fool the mail system into treating internal and incoming email addressed to the company domain as though it was addressed to the in-house server domain name. Use this when you do not want to use a virtual domain because you see the local web site instead of the externally hosted one.

Enter a list of domains separated by a space

Multidrop email panel


 Mailfilter

Is a flexible utility to get rid of unwanted spam mails, before having to go through the trouble of downloading them into the local computer. It offers support for one or many POP3 accounts and is especially useful for dialup connections via modem, ISDN, etc. Mailfilter connects to any POP3 mail box and compares part of its content to a set of user defined filter rules. That way the spam gets deleted directly on the mail server. With Mailfilter you can define your own filters (rules) to determine which e-mails should be delivered and which are considered waste. Rules are Regular Expressions, so you can make use of familiar options from other mail delivery programs such as e.g. procmail. All relevant documentation for Mailfilter is provided with the Mailfilter distribution. Online versions of some of these documents are available on the official Mailfilter home page:

Note. installing and enabling Mailfilter is optional.
http://mailfilter.sourceforge.net/ or http://dungog.net/sme/files

If you wish to use this option, install the mailfilter rpm
To configure mailfilter follow the link from the pop3 and mailfilter panel.
Check the Enable mailfilter box to filter pop3 mailboxes
While testing you can set mailfilter to just log activity and not perform the action requested

To add a new filtering rule follow the link.
Action: Deny or Allow
Deny will delete the email from the remote mailbox
Allow will override a subsequent rule

Topic: To, From, Subject
Select an email based on a type of header or other setting.

Definition
Enter a value the Topic is compared against

The Individual accounts option creates three rules to delete a standard users default email accounts.

The mailfilter rules are shown at the bottom of the page for your information. It should list all pop3 accounts you are downloading. Some settings are hardcoded into the SME templates can you change these manually if you wish.

Mailfilter panel


Firewall

 Summary:iptables additions

With the dungog-masq rpm, Block ports, eg to disable client applications such as ftp or MS messenger.

Unrestricted time

Enter a time that you want to restrict access to an alternative set of ports

Firewall, panel


Dialup

 Dialup dungog-dialup
This allows an override of the SME settings for when to allow an internet connection, you can alter the time considered 'office hours' and you can have a different 'office hours' for the weekends. You can also set the frequency and time of collection for mail. The rpm also configures an australian external ISDN modem.

Dialup, panel


 Web Applications

For web servers, these applications have been made into rpms to make it easier to install onto a SME server.

The Greymatter Weblog rpm has a panel to enable multiple weblogs to be set up quickly and easily.

Dungog-ssl configures a chained SSL certificate from freessl.com


Web app Greymatter

 dungog-greymatter allows you to build multiple weblogs with greymatter,
  • easy administration, choice of four preset templates
  • setup multiple blogs fast, all path settings calculated
  • multiple blogs in the one ibay
  • install to a virtual domain
Usage
Give a description, this is only refered to within the panel
Select an ibay to use, it will become owned by the web server
Select a template, this is the header image and colour scheme
Enter a subdirectory name if you wish to group to keep groups of weblogs together.

Naming convention to access weblog
for normail use: server/ibay/subdirname
for a virtual domain: virtualdomain/subdirname
or without subdir name if you don't use one
Post install
After creating a weblog, secure the site and add some content.

  • create a new user and remove default user Alice pwd wonderland
  • add your email address and review options
  • run the diagnostics
  • add the first entry which gives users something to look at.
You may notice on the sample blog above the demo links. These are altered via the greymatter template system. These are changed by logging in, following the links, then altering
-> Edit Templates
-> Editing Header, Footer & Sidebar (& Custom) Templates
-> Sidebar Template

<a href="">Fake Link One</a><br />
<a href="">Fake Link Two</a><br />
<a href="">Fake Link Three</a><br /><br />

you can add an admin link here, something like this
<a href="http://domain.au/cgi-bin/directory/gm.cgi" title="blog admin">Admin</a><br>
Search:<br>
<a href="http://google.com" title="google">google</a><br>

Web app Greymatter Usage


Off Tilt

[Main Index]

08/11/2002: "Binklee"

We're having chicken for dinner. Hello, i'm Binklee the elephant. We are carnivourous elephants. I mostly eat tigers but today all the tigers are sour. Most of the time I am eating food for them but today I have a free day off. I'm finding the lost principal.

I didn't exactly know where I was going and before I knew it I was in the traveling forest ZOOOOOOOOOOOM!!!!!!!!!!!!!!! I was in a desert with bones of animals.Even though I didn't know where I was I ran out.And tripped over a pile of bones.A gust of wind came and knocked me over.I can't think how,but it did.Then SHUUUUUUUURP!!!!!!!!!! I was drawn towards a cave.A tornadoe came and pulled me right inside the cave.A couple of black people with drums came just a little to close and I ate them.Then they suddenly came out of my body.They were ghosts!They started to play their drums and I did a cartwheel.They stopped and I stopped.

Replies: 1 Comment

I really liked your start. So keep up the good work.

helen said @ 08/11/2002 01:22 PM CST

Add A New Comment Name

E-Mail (optional)

Homepage (optional)

Comments

Remember Me Forget Me

nav:
home
archives
email

links:
fakelink #1
fakelink #2
fakelink #3

Powered by Greymatter


Web server SSL Certificate

 Your Secure Webserver is accessed at https://
When a browser visits a https page the browser checks it's list of Authorised Certificates, against the issuer of the certificate your web server gives. The default is self issued. Your browser then prompts you if you want to add this certificate to your browsers list.

If you have a SSL certificate issued by a major Certificate Authority you are not prompted about the validity of the certificate. The best value SSL certificate can be found at freeSSL.com but you can also use other suppliers. At freeSSL you have these options, more detail is at their website

  • freeSSL $15 certificate recognised by 92% of browsers ie5+ ns7+
  • chainedSSL $35 recognised by 96% of browsers ie5+ ns4+ opera5+ aol5+
  • wildcard.chainedSSL $199 as above but secures multiple subdomains
Setup
1. create passwordless server key
[paswordless allows secure web server to start without entering the password]
see also http://www.freessl.com/resources/csr/apache_mod_ssl.htm
sme specific specs below
cd /home/e-smith/ssl.key/   [Your Keys]
cp secure.domain.dom.key old.domain.dom.key
/usr/bin/openssl genrsa 1024 > /home/e-smith/ssl.key/secure.domain.dom.key

2.create certificate request
cd /home/e-smith/ssl.crt/    [Your Certificates]
mv secure.domain.dom.crt old.domain.dom.crt
/usr/bin/openssl req -new -key /home/e-smith/ssl.key/secure.domain.dom.key -out /home/e-smith/ssl.crt/domain.dom.req
enter your details, your server will likely be www.domain.dom not just domain.dom
Enter nothing for the final two optional questions

3a.$15/yr 'free' SSL certificate::  your.cert || The USERTRUST Network.cert
http://freessl.com/index.html

copy and paste the text from /home/e-smith/ssl.crt/domain.dom.req into the form
select appache + MOD SSL
follow the prompts, & verify with an automated phone call

save certificate that is emailed to you as secure.domain.dom.crt
save it and secure.domain.dom.key in a safe place

copy to /home/e-smith/ssl.crt

or
3b.$35/$199/yr Chained SSL certificate:: your.cert || chainedSSL.cert || The Baltimore root.cert
http://freessl.com/index.html

copy and paste the text from /home/e-smith/ssl.crt/domain.dom.req into the form
select appache + MOD SSL
follow the prompts, & verify with an automated phone call

save certificates that are emailed to you as baltimore.crt & secure.domain.dom.crt
save them and secure.domain.dom.key in a safe place

copy to /home/e-smith/ssl.crt

install dungog-ssl
this adds httpd.conf custom fragments required to
recognise the baltimore chained certificate
expand the template and restart httpd and httpd-admin
by /sbin/e-smith/signal-event conf-ssl

4. if neccesary
check ownership
chown root.root /home/e-smith/ssl.key/secure.domain.dom.key
chown root.root /home/e-smith/ssl.crt/secure.domain.dom.crt
chown root.root /home/e-smith/ssl.crt/baltimore.crt *

and permissions
chmod 400 /home/e-smith/ssl.key/secure.domain.dom.key
chmod 644 /home/e-smith/ssl.crt/secure.domain.dom.crt
chmod 644 /home/e-smith/ssl.crt/baltimore.crt *
* [ for chained certificates only ]

reload your  webserver
/etc/rc.d/init.d/httpd-admin graceful
/etc/rc.d/init.d/httpd-e-smith graceful

close your browsers, reopen and test
https://www.domain.dom


User Manager

give users access to
  • user panels
  • selected admin functions
Download the user-manager rpm from dungog.net/sme/files/userpanel
e-smith-user-manger now requires both perl-Unicode-* rpms, install these first.

Install
rpm -Uvh *.rpm
or via the server-manager with "Administration"-'update system'

Admin Usage
To delegate panels to users on your internal network, open your server-manager in a browser. You should see an option in the Security section for "user panel access". Select a user and check the box next to the functions they are allowed to use. You can select the global link to allow everyone to access specific panels, eg the userpanel-* type are designed for users, although you may not want to assign all functions. By default the change password and email forwarding are allowed for all users.

To allow access from the internet add the IP address to the remote access panel of the server manager
SME versions before 5.5 see http://e-smith.org/docs/howto/remote-mgr-access-howto.html

User Usage
Panels delegated by admin are available at https://www.yourserver.net/user-manager.

The following panels are part of e-smith-userpanel, other user panels may be included as part of other rpms. Refer to the User Guide for userpanel usage.

  • Change password : change your password
  • Data backup : backup user data
  • Email autoreply : create an autoresponse message for a single pseudonym
  • Forward mail : modify your email forwarding
  • Process mail : enable procmail mail filtering
  • Vacation message : create an autoresponse message

SME 6

The delegating of admin functions or SME 6 server-manager panels has a few problems. Depending on the panel, translation descriptions may not work correctly which makes it difficult to understand the instructions. Some panels won't work at all because required links and buttons are missing. It's possible to reuse panels from ealier versions of SME if they exist. All Dungog Network panels work under the user manager.

Credits

The userpanel was developed by daniel van raay, then enhanced by stephen noble darrel may and Shad Lords. It followed a similar concept of an admin panel by charlie brady which worked on e-smith-3.x
This version intergrates the delegating of admin functions and allows the admin to only give the advanced userpanel functions to users according to site policies.

User Manager Panel

User Manager Access Panel


Modify Users FTP Access

chroot options for the ProFTPd ftp server

When users FTP into the sme server they are allowed to view ibays, primary and some system information
By chrooting the user you restrict the user to below that directory

Install

rpm -Uvh dungog-proftpd-chroot-0.1-2.noarch.rpm
or use the update system link in the server manager

Usage
open the server-manager, select 'ftp user root' under dungog.net You can chroot all users to their home dir with the global change button. Individuals can be changed with the modify link next to their name. You can chroot a user [or create a new user] to an ibay, this way she can upload without traversing the server directory tree.

Note: the password is sent in the clear if you use ordinary ftp, if possible use a ssh derivative. ssh.com have a secure ftp client, or scp or rsync with ssh.

Credits

The explanation of how this works and the ProFTPd template fragment was provided by Damien Curtain at pagefault.org Thanks Damien !

Ftp Root Directory Panel

Ftp Root Directory Nominate Panel


Installing rpms

Installing 'update-system' rpm
Download and install devinfo-mitel-update-system, if you are unsure of how to do this, perform the following steps
  • download and save the above rpm to your server in your home directory
  • ssh into your server and change directories to your home directory, eg cd /home/e-smith/files/users/bruce/home/
  • type, rpm -Uvh devinfo-mitel-update-system-0.1-1?.noarch.rpm
Congratulations, ALL rpms can now be installed via a browser.

Installing rpms using the browser based server manager.

To install a new rpm, download the rpm to your home directory, then from the server manager 'Update System link, use the browse/choose button to select the download, and click save.

The advanced page lets you set the --force or --nodeps options, use these only if instructed to do so.
Rpms can be uninstalled from the advanced page. This is potentially dangerous to your server if you select the wrong one. This option is only available after enabling it with the following command;

/sbin/e-smith/db configuration setprop updatesystem RemoveRpm enabled

The .upd format is an alternative file format that is sometimes used.

Checking for later versions.

Click the link to check your server for later versions of rpms tht already exist on your server.

Installing RPMS Panel

Installing RPMS Advanced Panel

Installing RPMS updates Panel


Access to the server shell

as root, chsh -s /bin/bash username
to take it away, chsh -s /bin/sshell username

Alternately
daniel van raay has a contrib rpm that optionally gives sudo access in addition.
sudo gives a user root privileges by prefixing the command with sudo
eg. sudo tail /var/log/messages

From
ftp://ftp.e-smith.net/pub/e-smith/contrib/DanielVanRaay/RPMS/noarch/
or dungog.net/sme/files

Install
rpm -Uvh e-smith-usershellaccess-0.1-1.noarch.rpm
or via the server-manager with 'update system'

Usage
On your internal network, open your server-manager in a browser.
You should see an option in the Remote Access section for "shell access".

Access
ssh is the prefered method of access, it must be enabled via the server Manager - Remote Access panel. There are many clients available, see also server - Access.


Dialin access to the server

WARNING
This a developers release.
Enabling dialin isn't supported or recommended

It is untested on later versions of SME server

From
ftp://ftp.e-smith.org/pub/e-smith/contrib/DanielvanRaay/RPMS/noarch/
a mgetty rpm from any late verson redhat CD
--nodeps as we don't need voice and fax etc.

Install
rpm -Uvh --nodeps mgetty.......
rpm -Uvh e-smith-dialin...

Usage
On your internal network, open your server-manager in a browser.
You should see an option in the security section for "User dialin access". Set which users you want to allow to dialin.
Next configure your modem, go to the Configuration section "Dial in", configure and save.

On your client, configure dialup as you would for any isp connection.

Footnote
If you get callback working, be a sport and submit a mini howto, and i'll add it.
> google > callback dialin mgetty
> then http://www.linuxgazette.com/issue77/sunil.html
> looks promising

i tried to do the settings suggested on the url you
gave me and with a little bit of configuration not
mentioned on the site dialin with callback worked.

the extra configuration done was to change attributes
or permisions of /usr/sbin/pppd to suid with the
command:
chmod u+s /usr/sbin/pppd

another thing was to set the ip address of the dialup
connection on the windows client exactly the same that
the dialin server would assign to dialin serial port
settings on the e-smith manager panel. otherwise you
would get a failure that the server failed to assign
an ip address to the dialin client.

although i was able to login and successfully
connected (by testing internet connection) i can no
longer ping to some client machines (LAN where my
dialin server is connected). i guess this is because
i'm known to the network as pppd user. i was able to
ping to those clients with just the dialin feature
without callback.

good luck on your new projects and thank you for
helping those in need. your help is highly
appreciated.


Share server cd, zip and floppy.

The available drives are subdirectories in an ibay.
Autofs allows access without mounting.

Install

Note:if you are upgrading
before installing run: service autofs stop
and after: service autofs start

run
rpm -Uvh dungog-autofs-0.1-5.noarch.rpm
which displays the following

autofs-3.1.7-14.i386.rpm looks for libssl.so.1
but SMEserver 5.5 has libssl.so.2, add --nodeps switch as below

Create an ibay or use an existing one to hold the drives
then type the following, where shareddrive eq the ibay name
/sbin/e-smith/signal-event conf-autofs shareddrive

dungog-autofs upgrades may need: service autofs reload

dungog-autofs assumes the following is correct for your drives,
which will likely be the case unless you added drives after your install
if you don't have a zip drive it is just ignored
cdrom -> /dev/cdrom
floppy -> /dev/fd0
zip -> /dev/zip

then run
rpm -Uvh --nodeps autofs-3.1.7-14.i386.rpm

create your ibay, eg shareddrive
for a windows pc you may need to logout and back in to see the new share

run the event
/sbin/e-smith/signal-event conf-autofs shareddrive

Usage
If you have disks in the servers drives they will be visible in the coresponding ibay subdirectory when you access them. If no disks are in the drives the zip, floppy and cdrom directories do not exist. Note, The automounting requires all users to stop accessing the drive before it will unmount, then it waits 10 seconds, then you can insert another disk.


Other Rpms

dungog.net/sme/files/dungog-controlaltdel-shutdown-0.1-1.noarch.rpm

Install
rpm -Uvh dungog-controlaltdel-shutdown-0.1-1.noarch.rpm
or via the server-manager with "Administration"-'update system'

Usage
After it's installed give a three finger salute and the server shuts down and powers off.
rpm -e dungog-controlaltdel-shutdown to return the server to the default of restarting after ctrl-alt-del


User Guide

Programs to help users configure server based software of your SME server.

The user-manager panels help configure the the task you are performing. These are accessed by a web browser at the address https://yourserver.net/user-manager. To access the web pages you need the User Password.

By default only Change Password and Email Forwarding are visable to users, other user-panels need to be delegated by admin either to all or just to selected users.

The user-manager may be made available outside your LAN but the administrator has to allow and set it up, from SME5.5+ this is done in the remote access panel of the server-manager.

Topics contained in books with red stars is commercial software, these are purchased from dungog.net/sme/purchase.php


Process Mail

User panel to allow a user to enable procmail

Procmail is a program used to process your email on the server. It works by following rules defined by you. Common uses are to sort mail into folders or forward email on to other email addresses. The rules that you define are executed as email arrives in your mailbox on the server, and are independent of your email client. If you sort to folders you will need to use a IMAP mail client, POP3 will only be able to read your inbox and not the folders.

Enable Procmail
You have two options for how to use Procmail. Most people will use normal mode. Only select geek mode if you wish to manually write your .procmailrc rules and don't want them overwritten by the browser based configuration.

After selecting one of these modes and saving procmail is enabled, disabled by going to Forward Email and resetting email delivery.

Advanced
The first screen offered has a reduced number of options to make it easier for novices to use. By clicking Advanced you can modify more options and use more complex rules.

Testing
After adding a rule you should test it, some characters may cause mail to be lost, eg. ] [


Procmail Configuration

Basic procmail configuration page
Shows a table of active rules and the order they are executed in. Each rule has links to modify or remove them.

An advanced link lets users set options to change the order the rules are executed in , delete duplicate emails, set the amount of logging, view and delete their procmail.log file and view there .procmailrc file.

Procmail Configuration Panel


Procmail Rules

Lets a user define a pattern for emails that if they match them an action occurs, and optionally a second action to a copy.

Procmail Rules Panel


Alcor On-Line Help: procmail recipe example

procmail recipe example

A typical procmail application is to catch mail messages from certain people, or certain mailing lists, and drop them in separate folders. What follows is an edited version of an exchange on the help newsgroup, where a user was trying to do just that.

Here's the netnews article:

A user asked: > > My ~/.procmailrc is now invoked properly, but I'm still seeing > my messages in my inbox despite trying to file them in another > folder. I had logging enabled: > # > LOGFILE=$MAILDIR/LOG > LOGABSTRACT=all > VERBOSE=yes > but I can't seem to find the log file... Where do I look? Look a bit higher in your .procmailrc file, and you'll see where MAILDIR is set to "$HOME/.procmail" -- thus, look at "~/.procmail/LOG". I see in your subsequent post that you must have done just that, since you posted an extract from the logfile. > As for the recipe I'm using, this is the .procmailrc entry: [...] > INCLUDERC=persrecip > > And this is the recipe (the "persrecip" file) itself: [...] > :0 > *^FROMjane > INPers > > INPers is a second incoming mail folder that I've created in alcor which > *should* get any mail from jane@cs.concordia.ca. The logfile extract you posted separately shows: >> procmail: No match on "^FROMjane" [...] >> From jane@cs.concordia.ca Sun Mar 9 12:11:25 1997 In other words, your recipe is being used, but the pattern you give does not match the incoming mail. I think you are hoping that "^FROM" is a special procmail expression, like "^TO", "^FROM_DAEMON", and "^FROM_MAILER"; unfortunately, this is not the case. What you meant is probably: * ^From:.*jane However, that would catch mail from "joe@janet.com", which is ^^^^ probably not quite what you want either. Perhaps * ^From:.*\<jane@cs\.concordia\.ca\> would fit the bill. What it means is: * Start pattern. ^ Match at beginning of a line; i.e. the next word or symbol must occur at the start of the line. From: Match the word "from" (upper or lowercase or mixed), followed by a colon. That's the "From:" header. .* Match anything (zero or more "wildcard" characters); this will eat any "comments", such as the person's full name, etc., and possibly the space after the "From:", though the last non-alpha, non-digit character before the start of the thing you want to match will be eaten by... \< Match a "word delimiter" character (anything except a letter, digit, or underscore) or a newline -- this avoids matching on, say, "jbjane@cs...". jane@cs\.concordia\.ca Match your target address, where dots are *not* wildcards but match real dots. You don't *have* to escape the dots, but if you don't, you might accidentally match "jane@csxconcordiaxca", which is not what you want. \> Now match a word delimiter or a newline again; this avoids matching the unlikely "jane@cs.concordia.cam.org", for example. :0 * ^From:.*\<jane@cs\.concordia\.ca\> $PINEDIR/INPers

Copyright, © 1999, Concordia University, (IITS).
Author: Anne Bennett
Credits: Tory Atwood
Modified for SMEserver 12/2001 -- dungog.net


Change password

User panel to allow a user to change their password

Enter the existing password
Then the new one, and again to confirm.

Change password panel


Data backup

User panel to allow a user to backup and restore her data from the server to a file on her desktop PC. You can extract most files from the download with archive programs such as winzip. Email messaged are stored in a format that require special programs to open, either unix programs or a windows program winrar available from rarlabs.com

File size
The data saved is from your home drive on the server, this also includes configuration files and mail on the server that isn't ordinarily visable to the user. Click the file size link to find out how much data you have. You may choose not to save the data if you have a large amount and a slow connection eg a dial up modem.

Backup to desktop
This will compress your data to a file 'username.tgz' and prompt you for a location to save it to, usually your PC's hard drive.

Verify desktop backup file
Verify prompts you for the location of the backup file then display a list of files in the archive.

Restore from desktop
Uploads the data to the server, this will overwrite any existing files with the same name.

Data backup Panel


Email Autoreply

User panel to allow a user to create an autoreply message.

Usage
A user on a SME server has at least three email addresses, their username and two pseudonyms, a . and _ separating their names. Other pseudonyms may be created for the user in the panel example it's accounts.

All these address can have seperate autoreply messages. To send a message relating to a pseudonym you create a plain text file in you home directory with it's name eg. on a windows PC with the home drive mapped to h:/ for the pseudonym accounts the file would be h:/accounts

Mail that is autoreplied to is moved to the autoreply folder.

Email Autoreply panel


Forward Mail

User panel to allow a user to forward her email messages.

Deliver email locally
Mail is left on server for the user to access with their email client

Forward to address below
Mail is forwarded to an alternate email address, eg jane@hotmail.com

Both deliver locally and forward
Mail is left on server and a copy is forwarded to an alternate email address.

Use procmail to process mail
If procmail is enabled, you can use the procmail userpanel to create rules to sort, forward, copy or delete mail.
If you have dungog-emailfiltering installed, [ if you have the option of junkfilter or TMDA you do]. You can forward mail to another email address after processing/removing spam by including a forwarding address, AND requesting your admin to enable procmail forwarding for you.

Forward Mail Panel


Vacation Message

User panel to allow a user to enable a vacation message

All mail for the user including pseudonyms will recieve the message.

No vacation message is sent if forwarding is enabled or if procmail is enabled and the mail doesn't reach the inbox, eg it's forwarded or sorted to a folder.

Vacation message Panel


Procmail Configuration Pro

The Procmail Pro userpanel is included with the dungog-emailfiltering rpm. It would be delegated in preference to the gpl procmail panel.

The Pro version of the procmail panel allows a second test before it is selected. eg. sender address of 'bbc.com.au' but only with subject of 'news of the day'

The rules and options are all shown on the opening page without going to the advanced link

Shows a table of active rules and the order they are executed in. Each rule has links to modify or remove them. A yes* in 'copy to' copies the email to your inbox

Options are to change the order the rules are executed in, delete duplicate emails, set the amount of logging, view and delete their procmail.log file and view their .procmailrc file.

Procmail Pro Configuration Panel


Procmail Rules Pro

Procmail Rules

Lets a user define a pattern for emails that if they match them an action occurs, and optionally a second action to a copy.

Procmail Rules Pro Panel


Tagged Mail Delivery Agent

User panel to allow a user to enable and configure TMDA settings.
Part of dungog.net/sme Email management & filtering

Enable When you enable TMDA any emails sent you are held in a pending queue until the sender confirms. They confirm by replying to a email request the TMDA generates automatically. Spammers are very unlikely to confirm.

Confirmation email address The confirmation address defaults to your username and primary domain name. You can change it to a virtual domain if you choose but it's important to keep your username.

Pending queue Some valid email may not be confirmed because the sender didn't understand the confirmation request or the email had an invalid reply to: address eg mailing lists. This mail can be handled in a few ways.

Email confirmation: an email is sent to you daily containing the days mail which is stuck in the queue. The email has an embedded link you can click to send the confirmation reply yourself. You can ignore the rest they will be automatically deleted at a set interval, set default is a week sample

Web based interface: using the password you create, you can visit yourserver.net/tmda to view, delete or release the mail in your pending queue

TMDA rules These are similar to procmail rules, they allow you to allow, deny or hold based on sender, recipient, content, headers or size. You can also add users or domains to your individual whitelist or blacklist. You should add existing mailing lists to your whiletlist, or preferably subscribe using a Tagged address

Tagged Addresses You can generate a tagged address to give to others to allow them direct entry to your inbox. eg a dated address for promotions you won't want to hear from again in a few weeks time.

TMDA email filtering Panel


TMDA email filtering rules

 Add or modify a TMDA rule.

It's possible if you add a rule with invalid syntax your email will be blocked. If unsure always send an email to check you recieve an email confirmatin request.

TMDA email filtering rules Panel


Junkfilter Settings

Part of dungog.net/sme Email management & filtering

User panel to allow a user to enable junkfilter and set where filtered mail is sent.

Site wide policy
If junkfilter has been enabled sitewide, you are notified what the filtering policy is. The user can't override.

Filter to folder junkfilter
Mail tagged as spam is sorted to an imap folder junkfilter, the folder is created if it doesn't exist, to view the folder you need an imap email client or the server webmail

Filter and fwd to spamboss
Mail tagged as spam is forwarded to a nominated user who checks to see if there is any valid mail in the filtered mail

Filter and delete
Mail tagged as spam is deleted completely, it is NOT sent to your trash folder

Disable junkfilter
No filtering takes place

Junkfilter mail filtering Panel


Admin Internet connection

 Summary: make a connection request from a client pc or via a schedule of times.

The default connection methods can be either too restrictive or cost too much in local phone calls and ISP fees to connect each time a request is inadvertantly made. Dialup when you decide, manually from your desktop, and/or on a predetermined schedule

Setup Instructions

1. Read about the dialmon daemon from www.quaking.demon.co.uk/dialmon.html This is the tool we use to control the connection.

2. Download and Install

  • download from dungog.net/sme/files and install rpm -Uvh dialmon-0.8-1.i386.rpm on the server
    • then either install the dialmon windows client, dialmonW95.zip on your pc's [Note for the dialmon client config we use port 7390 not the default 7002]
    • or delegate the internet connection user-panel
  • purchase and then go to login.dungog.net for the dungog-ispconnection rpm.
3.Open the server-manager, in the ISP connection section, select your preference and click save. Note: The first time after install you may need a diald restart as well.

With the dialmon client you need to use force and block to raise and lower the connection. I'm having problems getting the link to stay up using a normal up/down.

Usage
dungog-ispconnection provides four alternative ways to initiate a connection to your isp
a. create an icon on any desktop that uses a dialmon client
b. set up schedules in the server-magager, set up connect and disconnect times for selected periods, this can also be used to setup a backup disconnect time for manual connections that get forgotten about.
c. click a button in server-magager >dungog.net > isp connection
d. click a button in the simplified user-manager >your settings > isp connection
Note, the usermanager panel has to be delegated to any user you want to allow to control the modem

dungog-ispconnection also provides these as options:
* e-mail notification to admin and logging when a connection is made.
* modem speaker can be turned on or off.
* sending mail doesn't bring up the link, ie external email is queued.

Notes
1. if you select alternate rules external mail is only called once on connection. If this is a problem install dungog-multipop which calls fetchmail to poll your ISP mailboxes each two minutes.
2. To check if pop3 mail has finished downloading go to the server-manager -> View log files, and enter the following.

  • Choose a log file to view maillog
  • Filter Pattern (optional) fetchmail
  • Highlight Pattern (optional) starting

Admin Internet connection panel


Backup

 Three backup/transfer methods are available

Tar, is the default backup to desktop method used by the SME server
Prior to version 5.6 the problem with this was a 2gb file size limit, for SMEserver 5.6+ this is no longer a problem, unless you mount a drive with samba which still has the 2gb limit
Use dungog-backup to use tar.

Rsync, is a Linux tool that only copies the part of a file that changes, so after copying once the second copy will be very fast if only small changes have been made to the original.
Use dungog-backup if you are backing up the server via NFS to another Linux PC.
Use dungog-rsync if you are transfering data from your server to or from another Linux PC.

Rar, is a shareware program. It works similar to tar but it allows you to split the backup into seperate files. It isn't really needed with 5.6 and greater servers, if you want to split your file eg to backup to CD you could use a file splitting program.
Use dmc-mitel-backup2ws if you want to use rar.

You can backup to a 2nd hard drive with either of our rpms sucessfully. The cost of hard drives being what they are this may be the best option in a lot of cases. A typical setup may be to use two drives, one of which is taken offsite periodically. Drives can be extracted from the server more easily if you use either a removable hard drive rack or a USB2 hard drive. USB works much better on SME6 than previous versions

This article gives clear instructions on the details of formatting as ext3 and editing your /etc/fstab file to enable easy mounting.

http://www.linuxplanet.com/linuxplanet/tutorials/4232/1/


 Dialmon Users
When using the dialmon client, you can create a user dialmon and configure the client to use this as the user. Or use the panel below to give selected users individual rights

Alernatively give users access rights to the Dialmon user-panel.

Dialmon Users panel


Email - Admin overview

 The admin panel has links to sub panels and shows a table of all users and displays what settings have been applied to their email.

In the table of users their emal delivery option is shown, with a link to modify that users configuation. Standard email delivery optons are local, forward or both. Alternative options are procmail and procmail fwd. Procmail allows server side processing of mail as it arrives, procmail forward, forwards mail after filtering spam and running procmail rules.

The panel also shows which users are using Vacation, TMDA and if using Junkfilter what setting is being used.

Links to set global settings, individual settings, realtime blacklist source (RBLS) settings and the junk mail filters junkfilter and TMDA are found here. They are discussed in the next sections.

Email - Admin overview panel


Internet Connection

Part of dungog.net/sme Dialup Tools

User panel to allow a user to connect or disconnect a modem to the internet.

Start or Stop
Request the modem either connect or disconnect

Reset
Reset will restart the Diald program on the server that handles modem connections. This is only required occasionally, eg if the ISP has been busy and the retries are too infrequent due to the backoff command double the delay frequency.

Internet connection Panel


Internet connection status

 Summary: show the current status of your dialup internet connection by toggling a graphic at http://yourserver/linkstatus.jpg each time a connection is made or dropped.

Install
[root@sme5 files]# rpm -Uvh dungog-linkstatus-1.0-4.noarch.rpm
or use the update system panel

Configure
Add a link to the image in a suitable location on your internal web site, eg home page, internet links or search engine page.

<IMG SRC="http://www.yourserver.net/linkstatus.jpg"> internet connection status


Web Content Filter

User panel to allow a user to add a site to the dansguardian exception list
Part of dungog.net/sme www filtering

The Usermanger dansguardian page allows users to add sites to the exception list. It is intended for staff/teachers to bypass the filter quickly eg. if it is holding up a lesson.

The full set of configuration options are in a seperate panel that isn't delegated as generously.

Web Content Filter Panel


Dialup - diald, panel

Dialup - diald

Dialup Settings

Set when and if connections are allowed and how quickly the link is dropped.
Set the frequency and time of collection for mail.

Defaults are; early * 7:59:59; daytime 8:00:00 17:59:59; late 18:00:00 *
Connections are: never = down; continuous is permanently on; 3 min; 10 min; 20 min; 60 min. is how long before the line is disconnected due to inactivity. Note. all sorts of things can keep the line up!
Mail will be collected unless connection is set to never. You can also enter never into the email field to stop mail requests. Email is a two part entry, first how often, then the hours to request
eg 15 0-7 = 0:15, 1:15 ... 7:15
*/10 8-17 = every ten minutes from 8am to 6pm
0 18-23/2 = every two hours 6pm to midnight.

early daytime late
Weekdays:
Weekdays, Mail:
Weekends:
Weekends, Mail:

Options,
Services to ignore must be in /etc/services, or added to a the template fragment 21ignore. Separate service names with a space, /usr/bin/diald-top can be used to find diald triggers skype.com uses port 33033, this is included as an example, Note these services will still work we only stop them holding the link up. Ports can be blocked with dungog-masq

Use these altered connection settings:
ignore icmp & undefined packets:
Services to ignore:
Use an external NT2 ISDN modem:
NT2 ISDN modem AT commands, default !Z=9!M=2!T0=25!T1=15!T2=8:

Don't restart Diald, which drops the link
note. only mail settings changes are used until diald is restarted.


Dansguardian - Bandwidth Limiting, panel

Firewall - iptables

iptables Port Blocking

Block ports in and out of your server, maybe worms are triggering diald and keeping the link up when you don't want it to, maybe you want to block a client app such as messenger, donkey, QQ, ftp ....

Enter ports to block separated by a space, you can enter a range eg, 2130:2150

Ports to permanently block

Ports to block at certain times

Times that the ports above are blocked
[start bocking][;][stop blocking][;][days][space][nextperiod]
eg. 8:30;12:30;1-5 13:30;4:30;1-5 :: 24hr 1-5=weekdays 0,6=weekends


Procmail configuration Pro, panel

Procmail Configuration Pro Usage

Procmail Configuration

User defined procmail rules

Click here to add another procmail rule. You currently have 14 rules.

basis | criterion | 2nd basis | 2nd criterion | destination | copy | copy to |  |
custom | support@ |  |  | support | no |  | Modify... | Remove...
Subject | management edge |  |  | management | yes | geoff@pp.nu | Modify... | Remove...
Sender | gargoyles@yahoogroups.com |  |  | digests | yes* |  | Modify... | Remove...
Subject | ocean races | Sender | yachtclub | hold | no |  | Modify... | Remove...

Options

Delete duplicate emails:
Amount of information written to your log file:
When procmail is enabled we can make the final rule forward mail offsite, this lets all the enabled spam trapping features work.
Forward after filtering:
Forwarding address:
View your .procmailrc file.
View your log file.
Delete your log file.
Delivery method:


Procmail Rules, panel

Procmail Rules Pro Usage

Procmail Rules

Select the part of the email to be tested. The criterion could be part of an email address, header or subject, or the email size. The second test is optional.
First Test:
First Criterion:
Second Test:
Second Criterion:

Leave the Destination field blank if you are deleting the email or sending to an existing mail folder. If you want to create a mail folder enter the new name here. It will be created the first time it receives mail however you must remember to subscribe to the new folder in your IMAP client to make it visible. Alternatively create and subscribe to the folder in your IMAP client first, then it will appear in the Existing mail folder box below. To forward to an email address, enter the address in the Destination box, eg [ user@domain.com ].
Destination:
Existing mail folder:
Optional copy

Send a copy of the email to somewhere else. If you want the copy to continue to be processed by the rest of your rules; select send to my inbox. Then it will end up in your inbox if no other rules intercept it.
Copy:
Action of copy:
Destination of copy:
Existing mail folder:
Priority

Change the order in which rules are evaluated by altering the numeric value. Priority is determined by ascii value, and must be unique or you overwrite the other rule with that value. eg user101 goes first, then user5 then user99. because 1<5<9

Order of rule execution:


Rsync Anonymous client, panel

Rsync Anonymous client Usage

Anonymous Rsync

General

This form allow you to mirror a set of files from a remote server to your local server, when the remote files are being made available with a rsync server.

 Description:

Options:
compress file data, This option is useful on slow links.
if automating, email any errors to admin.

Locations

The remote server is the source you will be mirroring, it will be in the form domain.dom::directory

remote server and directory:

The local directory is the destination for the copy enter an existing directory on your local server, eg. /home/e-smith/files/ibays/anibay/files/data

local directory:

Timing

Select the time, and day or days to run. Hourly runs each hour at the nominated minutes past the hour. Enabling automatic backups by selecting on, allows you to choose which days to run.

 Automatic backups:

Backup time, minute:

Backup time, 24 hour:

Backup time, day of week:

Click Save to enable the above settings

After saving your settings you can run the backup immediately by clicking below.

Current rsync script file

#!/bin/bash

# rsync 'driver' script.  (Uses anonymous rsync.)

# Does copy, but still gives a verbose display of what it is doing.
OPTS='-v -u -a --compress --stats --progress'

  echo 'Begin rsync transfer from dungog.net::test to /home/e-smith/files/users/stephen/home/dl3.'

  /usr/bin/rsync $OPTS dungog.net::test /home/e-smith/files/users/stephen/home/dl3

  echo 'Ending rsync transfer.'