Dan Anderson's Weblog

Upgrading Sendmail to Postfix on Solaris

Life is too short for Sendmail!

Background

No Sendmail wizards!

The uninitiated may wonder is Sendmail evil, and why? Well, here's a few reasons off the top of my head:

• Configuration is difficult. Here's two samples from the sendmail.cf configuration file:

  V10/Sun Cwlocalhost Fw/etc/mail/local-host-names CP. DS'smtp-server.san.rr.com' CO -AT- % ! C.. C[[ C{ResOk}OKR # . . .

  SHdrFromSMTP R$+ $: $>PseudoToReal $1 sender/recipient common R:; <@> $@ list:; special case R$* <@> $* $@ $1 <@> $2 pass null host through R< @ $* > $* $@ < @ $1 > $2 pass route-addr through R$* $: $>MasqSMTP $1 qualify unqual'ed names R$+ $: $>MasqHdr $1 do masquerading SMasqRelay R$+ $: $>MasqSMTP $1 R$+ $: $>MasqHdr $1 Msmtp, P=[IPC], F=mDFMuX, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\ n, L=990, T=DNS/RFC822/SMTP, A=TCP $h Mesmtp, P=[IPC], F=mDFMuXa, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r \n, L=990, # . . .

  In fairness, this complexity can be partly-hidden with m4 macros. Here's an example:

  VERSIONID(`@(#)sendmail.mc 1.11 (Sun) 06/21/04') OSTYPE(`solaris8')dnl DOMAIN(`solaris-antispam')dnl MASQUERADE_AS(`drydog.com')dnl FEATURE(`dnsbl', `sbl.spamhaus.org',`"550 Mail from " $`'&{client_addr} " refused - see http://www.spamhaus.org/sbl/"')dnl define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl FEATURE(local_procmail)dnl MAILER(`local')dnl MAILER(`smtp')dnl MAILER(`procmail')dnl LOCAL_NET_CONFIG R$* < @ $* .$m. > $* $#esmtp $@ $2.$m $: $1 < @ $2.$m. > $3

  However, the above is very position oriented. Add a line in the wrong location and sendmail breaks. Furthermore, when things go wrong you still have to debug the original sendmail.cf file, not the slightly-more-friendly sendmail.mc macro file.
• Error messages are cryptic and require searching Google and Google Groups for hints for what they mean. For example, try figuring out what's wrong when you get these cryptic error messages:

  550 5.1.2 <nameremoved@illinois-DOT-edu>... Host unknown (Name server: 127.0.0.1.com: host not found)

• The Sendmail (or "bat" book), the "Bible" for Sendmail users, is 1308 pages long!
• Sendmail has poor ("add-on") integration with useful filters such as SpamAssassin, Procmail, SSL certificates, and various Blackhole lists.
• People who favor Sendmail seem to like gratutious complexity. Sendmail experts tend to call themselves Wizards—as if complex, buggy, mysterious, hard-to-use software is acceptable!
• Finally, life is short. Spending time on Sendmail is like dying a little bit sooner.

Although Postfix is not in OpenSolaris, a custom version of it is used by opensolaris.org to deliver email.

Installation

Postfix is available from a few sources. I used the one from Blastwave. Blastwave packages tend to be solid, but they also tend to install a lot of library packages that duplicate what's already in Solaris. Blastwave packages are not supported by Sun Microsystems. I won't repeat the steps to setup Blastwave. Instead carefully follow the steps at http://www.blastwave.org/howto.html

When complete, type these commands to add Procmail, along with SpamAssassin (useful mail filters):

pkg install SUNWprocmail # use pkg-get procmail for Solaris 10
pkg-get spamassassin
pkg-get postfix

Other alternative Postfix ports are available. OpenCSW is a fork of Blastwave and has packages for Solaris 8 and later, including Postfix. The Postfix port by Dogan is popular, but I haven't tried it. See here for a list of Postfix ports: http://www.postfix.org/packages.html You can also download and compile the source from http://www.postfix.org/download.html Neither are Sun-supported. If you know of other Postfix ports to Solaris, leave a comment.

Customization

After Postfix is installed, you only need to type "svcadm enable cswpostfix" to start it (after disabling sendmail with svcadm disable sendmail). I (optionally) setup some links (for /etc/postfix), a spool directory at /var/spool/postfix, and copy over the aliases file from Sendmail to Postfix:

# Disable sendmail (works for S10 or higher)
svcadm disable svc:/network/smtp:sendmail
# Enable NFS client (prerequisite for cswpostfix, even if not used)
svcadm enable nfs/client
# Change spool directory to /var/spool/postfix
mkdir /var/spool/postfix
chgrp postdrop /var/spool/postfix
cd /opt/csw/var/spool/postfix; find . -depth | cpio -pdm /var/spool/postfix
# Setup /etc/postfix link to configuration directory:
cd /etc; ln -s opt/csw/postfix
# Setup link for SpamAssassin spamc for easy access:
ln -s /usr/csw/bin/spamc /usr/bin
# Copy aliases from sendmail:
cp /etc/mail/aliases /etc/postfix
/opt/csw/bin/newaliases
# Allow Postfix sendmail to be used for a client for outgoing email:
chmod 755 /opt/csw/sbin/sendmail

Here's the (optional) changes I make to the Postfix /etc/postfix/main.cf configuration file (in bold). The main.cf file has lots of comments to explain what these lines mean. The host and domain name stuff default to reasonable values, but I set them anyway, just to be sure they're correct. Other changes are for spam control.

# By default only IPv4 is enabled, this enables IPv6 if supported:
inet_protocols = all
queue_directory = /var/spool/postfix
command_directory = /opt/csw/sbin
daemon_directory = /opt/csw/libexec/postfix
mail_owner = postfix
myhostname = tahoma.drydog.com
mydomain = drydog.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
mynetworks_style = subnet
alias_maps = dbm:/etc/opt/csw/postfix/aliases
alias_database = dbm:/etc/opt/csw/postfix/aliases
mail_spool_directory = /var/mail
# Use /opt/csw/bin/procmail for Solaris 10:
mailbox_command = /usr/bin/procmail
debug_peer_level = 2
debugger_command =
	 PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
	 xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /opt/csw/sbin/sendmail
newaliases_path = /opt/csw/bin/newaliases
mailq_path = /opt/csw/bin/mailq
setgid_group = postdrop
html_directory = /opt/csw/share/doc/postfix/html
manpage_directory = /opt/csw/share/man
sample_directory = /opt/csw/share/doc/postfix/samples
readme_directory = /opt/csw/share/doc/postfix/README_FILES
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_mynetworks,
	reject_rbl_client sbl.spamhaus.org,
	reject_rbl_client bl.spamcop.net,
	reject_unauth_destination,
	reject_non_fqdn_sender,
	reject_unknown_sender_domain,
	reject_non_fqdn_recipient,
	reject_unknown_recipient_domain,
	reject_unauth_pipelining,
	reject_unknown_client,
	reject_invalid_hostname,
	reject_non_fqdn_hostname

Finally, I start postfix and test it by sending and receiving myself emails to myself locally and remotely (e.g., from gmail or Yahoo). Errors and messages are logged to /var/log/syslog by default.

svcadm enable cswpostfix

When customizing Postfix, or software in general, I recommend changing just one thing at a time and verifying it works. Also, save old copies of the configuration files you modify— especially main.cf Type svcadm refresh cswpostfix after modifying main.cf to have Postfix re-read the current version of main.cf.

For more information on Postfix use and configuration, see postfix.org's documentation and mailing lists. RFE 6386192 concerns adding Postfix to Solaris.

Posted at 03:55PM Jan 06, 2009 by DanX in Solaris  |  Comments[8]