Email - Revision history

imported>Huston: A version aversion

2020-08-24T20:11:24Z

A version aversion

← Older revision		Revision as of 20:11, 24 August 2020
Line 192:		Line 192:
	After running Sendmail for a long time, I had a look at Postfix before one of the mail server upgrades. While Sendmail configuration has become so cumbersome that there's entire books dedicated to the configuration files (O'Reilly's [http://www.oreilly.com/catalog/sendmailckbk/ Bat Book]), Postfix's configuration is fairly straightforward. With mostly plain-English directives, I was able to setup a Postfix system that mirrored our Sendmail system in a fraction of the time. Whats more, the Postfix system allowed for sending a mail through a filter and then processing it on the other side, and authentication/authorization and encryption for security. Sendmail is only used for secondary systems now, and only because it's the default installation at the time.		After running Sendmail for a long time, I had a look at Postfix before one of the mail server upgrades. While Sendmail configuration has become so cumbersome that there's entire books dedicated to the configuration files (O'Reilly's [http://www.oreilly.com/catalog/sendmailckbk/ Bat Book]), Postfix's configuration is fairly straightforward. With mostly plain-English directives, I was able to setup a Postfix system that mirrored our Sendmail system in a fraction of the time. Whats more, the Postfix system allowed for sending a mail through a filter and then processing it on the other side, and authentication/authorization and encryption for security. Sendmail is only used for secondary systems now, and only because it's the default installation at the time.

	We're running Postfix 2.3.x compiled with SMTP AUTH via SASL (which in turn gets information through [[PAM]] using [[LDAP]]~~; there's also a local LDAP slave running on the mail server for its own use and to make the machine autonomous~~). Postfix is configured to use TLS encryption over the standard port (25), allowing for secure authentication to the server for relaying mail. We also have it listening on port 587 (mail submission from clients), which requires TLS and SMTP AUTH for all connections (even local deliveries).		We're running Postfix 2.10.x compiled with SMTP AUTH via SASL (which in turn gets information through [[PAM]] using [[LDAP]]). Postfix is configured to use TLS encryption over the standard port (25), allowing for secure authentication to the server for relaying mail. We also have it listening on port 587 (mail submission from clients), which requires TLS and SMTP AUTH for all connections (even local deliveries).


Line 205:		Line 205:
	To make the system more robust, I moved everything over to Cyrus IMAPD. Cyrus is a "black box" mail system - end users do not (and in fact, can not) login to the mail server, but only speak to it over IMAP. This makes the system better for us, since it no longer needs to rely on the availability of the home directory server - in fact, our mail server could be physically removed from the building, and plugged in somewhere else on campus, and as long as it can get the same IP address it uses while here, it will continue to function fully. Cyrus IMAPD allows for filtering via the [[Sieve]] filtering language (similar to how [[Procmail]] works). Cyrus is also compiled to use SSL or TLS encryption depending on the connection.		To make the system more robust, I moved everything over to Cyrus IMAPD. Cyrus is a "black box" mail system - end users do not (and in fact, can not) login to the mail server, but only speak to it over IMAP. This makes the system better for us, since it no longer needs to rely on the availability of the home directory server - in fact, our mail server could be physically removed from the building, and plugged in somewhere else on campus, and as long as it can get the same IP address it uses while here, it will continue to function fully. Cyrus IMAPD allows for filtering via the [[Sieve]] filtering language (similar to how [[Procmail]] works). Cyrus is also compiled to use SSL or TLS encryption depending on the connection.

	We use Cyrus IMAPD 2.3.x.		We use Cyrus IMAPD 2.4.x.


Line 211:		Line 211:
	In this day and age, it's impossible to run a mail server without filtering for spam (and it's irresponsible to run one without virus scanning as well). Early on in the process, I added AMaViS as a filter in the mail processing pipeline to do just that. It scans every incoming and outgoing mail for viruses, and scores mails based on their content to see if they're spammy or not. The spam filtering comes from SpamAssassin, a powerful filter which is very configurable and routinely updated.		In this day and age, it's impossible to run a mail server without filtering for spam (and it's irresponsible to run one without virus scanning as well). Early on in the process, I added AMaViS as a filter in the mail processing pipeline to do just that. It scans every incoming and outgoing mail for viruses, and scores mails based on their content to see if they're spammy or not. The spam filtering comes from SpamAssassin, a powerful filter which is very configurable and routinely updated.

	We're running amavisd-new version 2.5.x, and SpamAssassin 3.2.x.		We're running amavisd-new version 2.11.x, and SpamAssassin 3.4.x.

imported>Huston: Backscatter article is no more too :/

2020-08-24T20:08:36Z

Backscatter article is no more too :/

← Older revision		Revision as of 20:08, 24 August 2020
Line 183:		Line 183:
	# If you want a good resource for virus information, including links to removing some viruses and worms, see the [http://www.symantec.com/enterprise/security_response/threatexplorer/index.jsp Symantic Threat Explorer].		# If you want a good resource for virus information, including links to removing some viruses and worms, see the [http://www.symantec.com/enterprise/security_response/threatexplorer/index.jsp Symantic Threat Explorer].
	#: This is not only a good place for reading about viruses old and new, but it also explains what they do, how they work, and how to remove them. Also, if you get a mail that you think might be a hoax, you can usually find it here as well.		#: This is not only a good place for reading about viruses old and new, but it also explains what they do, how they work, and how to remove them. Also, if you get a mail that you think might be a hoax, you can usually find it here as well.

	~~Here's an article on Backscatter - one of the reasons for receiving mails that "you" sent that bounced back from the recipient - courtesy of Computerworld:~~
	~~http://www.computerworld.com.au/index.php/id;1698505531;fp;16;fpid;1~~

imported>Huston: RT's PGP interface broke a while ago

2020-08-24T20:06:17Z

RT's PGP interface broke a while ago

← Older revision		Revision as of 20:06, 24 August 2020
Line 134:		Line 134:
	==== ...know this email was sent by someone? ====		==== ...know this email was sent by someone? ====
	If the email is not cryptographically signed (say, with [[GPG]]), you don't. Emails can be forged, very easily. They can appear to come from anywhere, and with varying degrees of believability; anything from "no way in hell" to "only the NSA knows." If your work requires you verify that an email came from the person who appeared to send it, then you both need to install [[GPG]] (and if you use [[Thunderbird]], you'll want the Enigmail extension; see [[Thunderbird#Useful plugins\|here]]) and learn how to use it.		If the email is not cryptographically signed (say, with [[GPG]]), you don't. Emails can be forged, very easily. They can appear to come from anywhere, and with varying degrees of believability; anything from "no way in hell" to "only the NSA knows." If your work requires you verify that an email came from the person who appeared to send it, then you both need to install [[GPG]] (and if you use [[Thunderbird]], you'll want the Enigmail extension; see [[Thunderbird#Useful plugins\|here]]) and learn how to use it.

	As of 2006/02/20, any ''automated'' emails sent from the address listed in [[Requesting assistance]] are [[GPG]] signed. This doesn't include the actual trouble ticket mails, however it does include the [[Passwords#Password warnings\|password expiration reminders]], and user account expiration notices that are sent out. This way you can verify that the email is legit and is from us here. The key used for signing the mails has the ID <tt>0x5BF560E9</tt> and the fingerprint <tt>A197 9F2E 99E1 1CC9 92AC D93C BF8E 880F 5BF5 60E9</tt>. The key is also signed by Steve and Leigh (keys <tt>0xE6E97FD4</tt> and <tt>0xB220F113</tt>).

imported>Huston: Notes about forwarding; bad link for Mailman tutorial.

2020-08-24T20:05:34Z

Notes about forwarding; bad link for Mailman tutorial.

← Older revision		Revision as of 20:05, 24 August 2020
Line 96:		Line 96:
	=== How do I ... ===		=== How do I ... ===
	==== ...get all my mail in one place? ====		==== ...get all my mail in one place? ====
	If you have an account with OIT, you also have an email address on their servers. However, many people don't like to have to check multiple accounts, and would rather have their mail all in one location. We'~~ll leave out issues~~ of ~~server availability~~ and ~~uptime :>~~		If you have an account with OIT, you also have an email address on their servers. However, many people don't like to have to check multiple accounts, and would rather have their mail all in one location.

			'''''NOTE:''''' We '''DO NOT''' recommend forwarding mail anymore. In today's age, forwarding your email does not always work, as senders can set specific rules on the handling of email from their domains, and places such as Google will look at a forwarded message and discard it for not matching those rules. It is much safer to simply have your mail land in one location and deal with it there, rather than forwarding it everywhere. Note that you '''WILL LOSE MAIL''' in some cases of forwarding, and this is not something we can control at all - it is completely at the decision of the sender's mail servers and your eventual recipient honoring those wishes.


Line 127:		Line 129:

	==== ...learn more about Mailman & mailing lists? ====		==== ...learn more about Mailman & mailing lists? ====
	You can browse the documentation at the main Mailman website, http://www.list.org/docs.html~~. Chris Kolar wrote some very good docs for list managers and admins, which is available at http://staff.imsa.edu/~ckolar/mailman/~~ .		You can browse the documentation at the main Mailman website, http://www.list.org/docs.html.

imported>Huston: s/VM//g

2020-08-24T19:57:05Z

s/VM//g

← Older revision		Revision as of 19:57, 24 August 2020
Line 64:		Line 64:

	* [[Mail.app]] is the default email client that comes with Mac OS X machines.		* [[Mail.app]] is the default email client that comes with Mac OS X machines.
	* [[VM]] is an email client that runs within Emacs.

imported>Price: Advice on e-mail client for Android.

2020-07-15T22:16:39Z

Advice on e-mail client for Android.

← Older revision		Revision as of 22:16, 15 July 2020
Line 70:		Line 70:
	Unfortunately, different Android devices use different implementations of the e-mail client, so it's difficult to come up with a catch-all set of instructions. If you have trouble getting '''outgoing''' e-mail working with the settings under the section below, try ''disabling'' the option to encrypt connections to the outgoing mail server. Our mail server will reject non-encrypted attempts to login, anyway, so it should be safe to try. The problem is that by checking that box, some Android devices force a mode of SSL which our server doesn't support. Instead, our server uses TLS, which works in a different manner (and which Android should support). I've tested this setup on an Motorola Droid X running Android 2.1 (aka Eclair) and it works.		Unfortunately, different Android devices use different implementations of the e-mail client, so it's difficult to come up with a catch-all set of instructions. If you have trouble getting '''outgoing''' e-mail working with the settings under the section below, try ''disabling'' the option to encrypt connections to the outgoing mail server. Our mail server will reject non-encrypted attempts to login, anyway, so it should be safe to try. The problem is that by checking that box, some Android devices force a mode of SSL which our server doesn't support. Instead, our server uses TLS, which works in a different manner (and which Android should support). I've tested this setup on an Motorola Droid X running Android 2.1 (aka Eclair) and it works.

			[https://android-apk.org/com.lge.email/ LG Email] works for reading incoming e-mail, but many others do not.

	==== Use your own ====		==== Use your own ====

imported>Lkoven: /* To forward OIT mail to here */ Changed instructions to point users to OIT's own article for doing this in exchange.

2018-10-11T22:09:10Z

To forward OIT mail to here: Changed instructions to point users to OIT's own article for doing this in exchange.

← Older revision		Revision as of 22:09, 11 October 2018
Line 100:		Line 100:

	===== To forward OIT mail to here =====		===== To forward OIT mail to here =====
	# ~~Go to http~~://~~support~~.~~princeton~~.~~edu~~/~~account/ and select "Forward your e-mail" from~~ the ~~list of choices under "Manage your e-mail account". Login with your~~ OIT ~~user name and password.~~		# [https://princeton.service-now.com/snap?id=kb_article&sys_id=0f2a27064f9ca20018ddd48e5210c781 Follow the instructions in OIT's KB here]
	~~# Click the "Change entry" button.~~
	~~# Select the radio button next to the blank text field, and enter your Peyton email address (username@astro.princeton.edu).~~
	~~# Click "Submit changes" at the bottom of the page.~~


	===== To forward astro email elsewhere =====		===== To forward astro email elsewhere =====

imported>Lkoven: /* How to activate your E-mail Account at Peyton Hall */

2018-09-06T17:44:39Z

How to activate your E-mail Account at Peyton Hall

← Older revision		Revision as of 17:44, 6 September 2018
Line 41:		Line 41:
	If you'd prefer, you can also activate your e-mail account from the web by logging into Roundcube at https://webmail.astro.princeton.edu/roundcubemail/		If you'd prefer, you can also activate your e-mail account from the web by logging into Roundcube at https://webmail.astro.princeton.edu/roundcubemail/
	# Login to Roundcube		# Login to Roundcube
			# Ignore the error about your mailbox not existing. We're going to fix that below...
	# Hit the 'Settings' button		# Hit the 'Settings' button
	# Click 'Folders'		# Click 'Folders'

imported>Lkoven at 19:45, 4 September 2018

2018-09-04T19:45:01Z

← Older revision		Revision as of 19:45, 4 September 2018
Line 29:		Line 29:


	== How to activate your E-mail Account at Peyton Hall ==		=== How to activate your E-mail Account at Peyton Hall ===
	In order to prevent people who don't wish to use their Peyton e-mail account from having mail pile up and go unread, you must explicitly activate your e-mail account and create your INBOX. If you do not do this, mail to you will bounce.		In order to prevent people who don't wish to use their Peyton e-mail account from having mail pile up and go unread, you must explicitly activate your e-mail account and create your INBOX. If you do not do this, mail to you will bounce.

imported>Lkoven: Added instructions on how to setup a mail account

2018-09-04T19:44:19Z

Added instructions on how to setup a mail account

← Older revision		Revision as of 19:44, 4 September 2018
Line 25:		Line 25:
	== Using email in Peyton Hall ==		== Using email in Peyton Hall ==
	There's a few ways to read your email while in Peyton Hall, which are outlined here. A word on "support" first, however. Because there are so many different ways to access email, we cannot possibly support every permutation of them. However, we have selected a few programs which are widely used and easily setup so that we can guarantee support with those programs. This does not mean you must run only one of those programs; you're free to use whatever software you like for reading and sending emails. However, if the program you've chosen does not work properly, or has some kind of problems that are not a fault of the mail server itself, you will be on your own to figure out the problem and corresponding solution. See [[#Other clients\|Other clients]] below for information if you wish to use an unsupported email client.		There's a few ways to read your email while in Peyton Hall, which are outlined here. A word on "support" first, however. Because there are so many different ways to access email, we cannot possibly support every permutation of them. However, we have selected a few programs which are widely used and easily setup so that we can guarantee support with those programs. This does not mean you must run only one of those programs; you're free to use whatever software you like for reading and sending emails. However, if the program you've chosen does not work properly, or has some kind of problems that are not a fault of the mail server itself, you will be on your own to figure out the problem and corresponding solution. See [[#Other clients\|Other clients]] below for information if you wish to use an unsupported email client.
	: '''''Note''''': You '''MUST''' login to your email inbox with a new account '''before''' it is created! If you do not login at least once, you'll have no mailbox yet.		: '''''Note''''': You '''MUST''' login to your email inbox with a new account '''before''' it is created! If you do not login at least once, you'll have no mailbox yet. Instructions are just below...
	: '''''Note 2''''': If you do not configure your real name in your mail client it will usually show up as "username@astro.princeton.edu". If you care about people seeing your real name, you should edit it in the client.		: '''''Note 2''''': If you do not configure your real name in your mail client it will usually show up as "username@astro.princeton.edu". If you care about people seeing your real name, you should edit it in the client.


			== How to activate your E-mail Account at Peyton Hall ==
			In order to prevent people who don't wish to use their Peyton e-mail account from having mail pile up and go unread, you must explicitly activate your e-mail account and create your INBOX. If you do not do this, mail to you will bounce.

			# First login to your account. We recommend using Alpine at the command line of any of our managed Linux workstations. You will need to do this at some point to set your password anyway, so you might as well do this while you're doing that. So, run 'alpine' from the command line to launch the program.
			# You will get an error that your Inbox does not exist. Ignore it and hit 'L' to open the collection list.
			# Choose the "Global Folders" collection and you'll see the global folders on the system (LearnSpam mainly).
			# There if you press 'A' to add a new folder and type 'INBOX' you'll create the inbox.

			That should do it.

			If you'd prefer, you can also activate your e-mail account from the web by logging into Roundcube at https://webmail.astro.princeton.edu/roundcubemail/
			# Login to Roundcube
			# Hit the 'Settings' button
			# Click 'Folders'
			# Set the Folder Name to 'INBOX' and the Parent Folder should be left as ---
			# Hit Save

	=== Supported clients ===		=== Supported clients ===
Line 150:		Line 167:

	=== People said mail to my new account bounces! ===		=== People said mail to my new account bounces! ===
	Have you '''ever''' logged into your mailbox yet? If you have not, then the mail system hasn't created your account yet. Most people will login within a day or so of getting their account, but if you didn't login yet, then your inbox hasn't been created yet, and mails to your account will of course bounce. ~~Login with one of the mail clients listed, and your inbox will be created for you.~~		Have you '''ever''' logged into your mailbox yet? If you have not, then the mail system hasn't created your account yet. Most people will login within a day or so of getting their account, but if you didn't login yet, then your inbox hasn't been created yet, and mails to your account will of course bounce.