You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-user@james.apache.org by Renen Watermeyer <re...@gmail.com> on 2007/07/09 09:44:07 UTC
Opening SMTP
Hello,
I have been sending mail locally from a James server for a couple of years.
I want to up the ante and send mail remotely - that is, from random
computers located randomly on the internet. No, not spam: normal, user
driven email.
What is the most secure / safest way to do this? I know can simply allow
SMTP access via the conf file. But is this not opening a can of worms by
doing that?
Thanks in advance!
Renen.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Opening SMTP
Posted by Stefano Bagnara <ap...@bago.org>.
Renen Watermeyer ha scritto:
> Thank you for the speedy reply.
>
> I may have asked my question badly. Let me describe the scenario more
> completely.
>
> I have a James server that currently sends server generated email. Only a
> specific application server is able to connect to the James server, and it
> sends mail on behalf of several users (generally, workflow generated email).
>
> The mx records, reverse DNS lookups etc are bound to the James server - and
> everything seems to be working happily (and has been working for some time).
> Mail is sent and received.
>
> Because I am (sometimes!) a little nervous, I tried to prohibit relaying of
> email (even legitimate email from, for example, myself). I did this by using
> the <authorizedAddresses> setting and only allowing the application server
> that sends email (which in hindsight may have been slightly misguided).
>
> I would now like to allow trusted third parties (like myself) to send email
> via the James server. To do this, I think I need to:
>
> * Comment out the <RemoteAddrNotInNetwork> setting (because most of our
> users use dynamic IP addresses);
> * Leave the <authorizedAddresses> setting as I want the application server
> to be able to send email without authenticating;
> * Uncomment the <authRequired>true</authRequired> setting.
The best thing is create users with passwords and have them use a
password to authenticate the session (every mail client supports
authentication) from any IP in order to relay.
Just create users and configure the clients to use the user/pass you
assigned.
Stefano
> I am inclined to also uncomment the <verifyIdentity>true</verifyIdentity>
> line - but I suspect that this will mean that the application server can't
> send email on behalf of other users. Is this correct?
>
>
> Have I got the general idea? And, from a James perspective, is there
> anything more I can do to secure the server?
>
> Thank you for your guidance!
>
> Renen.
>
>
> -----Original Message-----
> From: Stefano Bagnara [mailto:apache@bago.org]
> Sent: 09 July 2007 09:53 AM
> To: James Users List
> Subject: Re: Opening SMTP
>
> Renen Watermeyer ha scritto:
>> Hello,
>>
>> I have been sending mail locally from a James server for a couple of
> years.
>> I want to up the ante and send mail remotely - that is, from random
>> computers located randomly on the internet. No, not spam: normal, user
>> driven email.
>
> Do you want JAMES to act as MX server for your domain? Or do you simply
> want to enable an Authenticated-users only mail submission service?
>
> The first is the default for JAMES Server, so simply revert changes you
> did to remove the receiving part.
>
> Unfortunately as soon as you'll accept mail for a domain you will also
> receive spam. You can try enabling online blacklists and bayes filters,
> but this will only help a bit.
>
> Stefano
>
>> What is the most secure / safest way to do this? I know can simply allow
>> SMTP access via the conf file. But is this not opening a can of worms by
>> doing that?
>>
>> Thanks in advance!
>>
>> Renen.
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
> For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
> For additional commands, e-mail: server-user-help@james.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
RE: Opening SMTP
Posted by Renen Watermeyer <re...@gmail.com>.
Thank you for the speedy reply.
I may have asked my question badly. Let me describe the scenario more
completely.
I have a James server that currently sends server generated email. Only a
specific application server is able to connect to the James server, and it
sends mail on behalf of several users (generally, workflow generated email).
The mx records, reverse DNS lookups etc are bound to the James server - and
everything seems to be working happily (and has been working for some time).
Mail is sent and received.
Because I am (sometimes!) a little nervous, I tried to prohibit relaying of
email (even legitimate email from, for example, myself). I did this by using
the <authorizedAddresses> setting and only allowing the application server
that sends email (which in hindsight may have been slightly misguided).
I would now like to allow trusted third parties (like myself) to send email
via the James server. To do this, I think I need to:
* Comment out the <RemoteAddrNotInNetwork> setting (because most of our
users use dynamic IP addresses);
* Leave the <authorizedAddresses> setting as I want the application server
to be able to send email without authenticating;
* Uncomment the <authRequired>true</authRequired> setting.
I am inclined to also uncomment the <verifyIdentity>true</verifyIdentity>
line - but I suspect that this will mean that the application server can't
send email on behalf of other users. Is this correct?
Have I got the general idea? And, from a James perspective, is there
anything more I can do to secure the server?
Thank you for your guidance!
Renen.
-----Original Message-----
From: Stefano Bagnara [mailto:apache@bago.org]
Sent: 09 July 2007 09:53 AM
To: James Users List
Subject: Re: Opening SMTP
Renen Watermeyer ha scritto:
> Hello,
>
> I have been sending mail locally from a James server for a couple of
years.
> I want to up the ante and send mail remotely - that is, from random
> computers located randomly on the internet. No, not spam: normal, user
> driven email.
Do you want JAMES to act as MX server for your domain? Or do you simply
want to enable an Authenticated-users only mail submission service?
The first is the default for JAMES Server, so simply revert changes you
did to remove the receiving part.
Unfortunately as soon as you'll accept mail for a domain you will also
receive spam. You can try enabling online blacklists and bayes filters,
but this will only help a bit.
Stefano
> What is the most secure / safest way to do this? I know can simply allow
> SMTP access via the conf file. But is this not opening a can of worms by
> doing that?
>
> Thanks in advance!
>
> Renen.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Opening SMTP
Posted by Stefano Bagnara <ap...@bago.org>.
Renen Watermeyer ha scritto:
> Hello,
>
> I have been sending mail locally from a James server for a couple of years.
> I want to up the ante and send mail remotely - that is, from random
> computers located randomly on the internet. No, not spam: normal, user
> driven email.
Do you want JAMES to act as MX server for your domain? Or do you simply
want to enable an Authenticated-users only mail submission service?
The first is the default for JAMES Server, so simply revert changes you
did to remove the receiving part.
Unfortunately as soon as you'll accept mail for a domain you will also
receive spam. You can try enabling online blacklists and bayes filters,
but this will only help a bit.
Stefano
> What is the most secure / safest way to do this? I know can simply allow
> SMTP access via the conf file. But is this not opening a can of worms by
> doing that?
>
> Thanks in advance!
>
> Renen.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by John Saxton <th...@hotmail.com>.
Hi,
Thanks for your assistance so far, however, I'm still unsure as to some
details.
I'm currently trying to work out how to do different things with James.
The scenario I'm considering is: -
Two computers running James
Each computer has a mail server, but the user mailboxes are split up between
the two boxes (I'd be using a db repository).
I believe that you're suggesting that I write a custom matcher/mailet pair
to pull out any non-local users & send it over to the other.
I guess for the extra spool I'd need to just have another mail table
created, I've not yet looked into how this is done.
"In this case you have a custom remotedelivery (with its
> >> own spool, separated from the outgoin) that deliver mails to the other
> >> JAMES server (you can use the gateway configuration)"
How were you envisining the mail being sent to the other computer in this
scenario?
I'll start looking in to this further, but will probably have a lot more
questions on configuration. The xml files aren't always self explanatory.
Thanks,
John
> >> Then before the HostIsLocal+LocalDelivery you use
> >> RecipientIsRegex+RemoteDelivery to check if the recipient is for the
> >> other server. In this case you have a custom remotedelivery (with its
> >> own spool, separated from the outgoin) that deliver mails to the other
> >> JAMES server (you can use the gateway configuration).
> >>
> >> The same thing can be done in the other server.
> >>
> >> Otherwise you can also use the ToRepository to place mails in a given
> >> repository instead of using the RemoteDelivery and move the mail via
> >> SMTP.
>
>John Saxton ha scritto:
> > Hi,
> >
> > I think you lost some of your explanation I'm afraid..
>
>Right. I probably deleted an introduction sentece by mistake.
>Btw after thr "Then" there is an explanation of what to do.
>
>Otherwise give us the details of what you want to do and what you expect
>from each server.
>
>Stefano
>
> >> John Saxton ha scritto:
> >> >> > I looked through the posting archives, but couldn't find an
> >> answer to
> >> >> > the following question - is it possible to have multiple James
> >> >> instances
> >> >> > running & have each instance responsible for a predetermined
> >> clump of
> >> >> > users?
> >> >>
> >> >> users or domains?
> >> >> Try explaining better what you expect/you're trying to achieve and
> >> I'll
> >> >> try to give you an hint.
> >> >
> >> > Is it possible to have multiple james instance servicing one domain,
> >> > with the users divided between the James instances? I suspect it is,
> >> but
> >> > not sure whether this is immediately configurable.
> >> > What approach would you take to get this configuration running?
> >>
> >> This is not supported. Depending on the details it can be done via
> >> configuration or programmatically.
> >>
> >> E.g:
> >>
> >> Then before the HostIsLocal+LocalDelivery you use
> >> RecipientIsRegex+RemoteDelivery to check if the recipient is for the
> >> other server. In this case you have a custom remotedelivery (with its
> >> own spool, separated from the outgoin) that deliver mails to the other
> >> JAMES server (you can use the gateway configuration).
> >>
> >> The same thing can be done in the other server.
> >>
> >> Otherwise you can also use the ToRepository to place mails in a given
> >> repository instead of using the RemoteDelivery and move the mail via
> >> SMTP.
> >>
> >>
> >> Stefano
>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
_________________________________________________________________
Tell MSN about your most memorable emails! http://www.emailbritain.co.uk/
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by Stefano Bagnara <ap...@bago.org>.
John Saxton ha scritto:
> Hi,
>
> I think you lost some of your explanation I'm afraid..
Right. I probably deleted an introduction sentece by mistake.
Btw after thr "Then" there is an explanation of what to do.
Otherwise give us the details of what you want to do and what you expect
from each server.
Stefano
>> John Saxton ha scritto:
>> >> > I looked through the posting archives, but couldn't find an
>> answer to
>> >> > the following question - is it possible to have multiple James
>> >> instances
>> >> > running & have each instance responsible for a predetermined
>> clump of
>> >> > users?
>> >>
>> >> users or domains?
>> >> Try explaining better what you expect/you're trying to achieve and
>> I'll
>> >> try to give you an hint.
>> >
>> > Is it possible to have multiple james instance servicing one domain,
>> > with the users divided between the James instances? I suspect it is,
>> but
>> > not sure whether this is immediately configurable.
>> > What approach would you take to get this configuration running?
>>
>> This is not supported. Depending on the details it can be done via
>> configuration or programmatically.
>>
>> E.g:
>>
>> Then before the HostIsLocal+LocalDelivery you use
>> RecipientIsRegex+RemoteDelivery to check if the recipient is for the
>> other server. In this case you have a custom remotedelivery (with its
>> own spool, separated from the outgoin) that deliver mails to the other
>> JAMES server (you can use the gateway configuration).
>>
>> The same thing can be done in the other server.
>>
>> Otherwise you can also use the ToRepository to place mails in a given
>> repository instead of using the RemoteDelivery and move the mail via
>> SMTP.
>>
>>
>> Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by John Saxton <th...@hotmail.com>.
Hi,
I think you lost some of your explanation I'm afraid..
>
>John Saxton ha scritto:
> >> > I looked through the posting archives, but couldn't find an answer to
> >> > the following question - is it possible to have multiple James
> >> instances
> >> > running & have each instance responsible for a predetermined clump of
> >> > users?
> >>
> >> users or domains?
> >> Try explaining better what you expect/you're trying to achieve and I'll
> >> try to give you an hint.
> >
> > Is it possible to have multiple james instance servicing one domain,
> > with the users divided between the James instances? I suspect it is, but
> > not sure whether this is immediately configurable.
> > What approach would you take to get this configuration running?
>
>This is not supported. Depending on the details it can be done via
>configuration or programmatically.
>
>E.g:
>
>Then before the HostIsLocal+LocalDelivery you use
>RecipientIsRegex+RemoteDelivery to check if the recipient is for the
>other server. In this case you have a custom remotedelivery (with its
>own spool, separated from the outgoin) that deliver mails to the other
>JAMES server (you can use the gateway configuration).
>
>The same thing can be done in the other server.
>
>Otherwise you can also use the ToRepository to place mails in a given
>repository instead of using the RemoteDelivery and move the mail via SMTP.
>
>
>Stefano
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
_________________________________________________________________
Tell MSN about your most memorable emails! http://www.emailbritain.co.uk/
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by Stefano Bagnara <ap...@bago.org>.
John Saxton ha scritto:
>> > I looked through the posting archives, but couldn't find an answer to
>> > the following question - is it possible to have multiple James
>> instances
>> > running & have each instance responsible for a predetermined clump of
>> > users?
>>
>> users or domains?
>> Try explaining better what you expect/you're trying to achieve and I'll
>> try to give you an hint.
>
> Is it possible to have multiple james instance servicing one domain,
> with the users divided between the James instances? I suspect it is, but
> not sure whether this is immediately configurable.
> What approach would you take to get this configuration running?
This is not supported. Depending on the details it can be done via
configuration or programmatically.
E.g:
Then before the HostIsLocal+LocalDelivery you use
RecipientIsRegex+RemoteDelivery to check if the recipient is for the
other server. In this case you have a custom remotedelivery (with its
own spool, separated from the outgoin) that deliver mails to the other
JAMES server (you can use the gateway configuration).
The same thing can be done in the other server.
Otherwise you can also use the ToRepository to place mails in a given
repository instead of using the RemoteDelivery and move the mail via SMTP.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by John Saxton <th...@hotmail.com>.
>John Saxton ha scritto:
> > Hi,
> >
> > I've recently downloaded James binary & source & am trying to get myself
> > acquainted with it.
> >
> > Although there is some good documentation around, I can't seem to find
> > answers to some of my questions (apologies if I haven't looked hard
> > enough/spent enough time reading up on general ideas)
> >
> > So,
> >
> > Is there a general overview of how the different services work together
> > - the process of receiving mail, putting it onto spools & subsequent
> > processing?
>
>Unfortunately no.
>
>But I can give you some hint:
>
>1) SMTPServer: receives messages and send them to the spool.
> 1b) FetchMail: similar to SMTPServer, but it is scheduled and read
>messages from another POP3 server.
>2) SpoolManager: manage messages in the spool, reading the new one and
>executing processors.
>3) RemoteDelivery is a special mailet: it manage its own delivery spool
>and do the actual delivery.
>4) LocalDelivery is a special mailet: it store the message in the inboxes.
>5) POP3Server read the messages from the inboxes.
>
Thanks, I had taken a look through the code before you replied & it is
generally quite simple to understand.
> > I looked through the posting archives, but couldn't find an answer to
> > the following question - is it possible to have multiple James instances
> > running & have each instance responsible for a predetermined clump of
> > users?
>
>users or domains?
>Try explaining better what you expect/you're trying to achieve and I'll
>try to give you an hint.
>
Is it possible to have multiple james instance servicing one domain, with
the users divided between the James instances? I suspect it is, but not sure
whether this is immediately configurable.
What approach would you take to get this configuration running?
> > Is there accessible documentation on Phoenix? Since Avalon is closed, I
> > couldn't find a source of information on it.
>
>Unfortunately no. Phoenix/Avalon are not difficult, but documentation is
>really lacking. I remember it took a lot to me to find out what exactly
>happens under the hood.
>
>Btw the key part to understand what are the componens and how they
>interact is looking at the assembly.xml descriptor (james-assembly.xml
>in the source tree). This show you what components are used and what are
>their dependencies. The initialize/configure/service methods from the
>components main classes will explain what exactly happens then.
>
> > I'm looking to try & get James up & running locally in a usable manner
> > (Only got it running in a test configuration so far) and possibly to
> > work on the code. The above requested information would help me greatly
> > in this.
> >
> > Thanks,
> >
> > John
>
>Unfortunately you only get the javadocs for JAMES Server, some docs in
>the website and some page (maybe outdated) in the WIKI. Not too much,
>but please ask specific questions and I'll try to reply.
>
>Stefano
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
Thanks.
_________________________________________________________________
Tell MSN about your most memorable emails! http://www.emailbritain.co.uk/
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: documentation & configuration
Posted by Stefano Bagnara <ap...@bago.org>.
John Saxton ha scritto:
> Hi,
>
> I've recently downloaded James binary & source & am trying to get myself
> acquainted with it.
>
> Although there is some good documentation around, I can't seem to find
> answers to some of my questions (apologies if I haven't looked hard
> enough/spent enough time reading up on general ideas)
>
> So,
>
> Is there a general overview of how the different services work together
> - the process of receiving mail, putting it onto spools & subsequent
> processing?
Unfortunately no.
But I can give you some hint:
1) SMTPServer: receives messages and send them to the spool.
1b) FetchMail: similar to SMTPServer, but it is scheduled and read
messages from another POP3 server.
2) SpoolManager: manage messages in the spool, reading the new one and
executing processors.
3) RemoteDelivery is a special mailet: it manage its own delivery spool
and do the actual delivery.
4) LocalDelivery is a special mailet: it store the message in the inboxes.
5) POP3Server read the messages from the inboxes.
> I looked through the posting archives, but couldn't find an answer to
> the following question - is it possible to have multiple James instances
> running & have each instance responsible for a predetermined clump of
> users?
users or domains?
Try explaining better what you expect/you're trying to achieve and I'll
try to give you an hint.
> Is there accessible documentation on Phoenix? Since Avalon is closed, I
> couldn't find a source of information on it.
Unfortunately no. Phoenix/Avalon are not difficult, but documentation is
really lacking. I remember it took a lot to me to find out what exactly
happens under the hood.
Btw the key part to understand what are the componens and how they
interact is looking at the assembly.xml descriptor (james-assembly.xml
in the source tree). This show you what components are used and what are
their dependencies. The initialize/configure/service methods from the
components main classes will explain what exactly happens then.
> I'm looking to try & get James up & running locally in a usable manner
> (Only got it running in a test configuration so far) and possibly to
> work on the code. The above requested information would help me greatly
> in this.
>
> Thanks,
>
> John
Unfortunately you only get the javadocs for JAMES Server, some docs in
the website and some page (maybe outdated) in the WIKI. Not too much,
but please ask specific questions and I'll try to reply.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
documentation & configuration
Posted by John Saxton <th...@hotmail.com>.
Hi,
I've recently downloaded James binary & source & am trying to get myself
acquainted with it.
Although there is some good documentation around, I can't seem to find
answers to some of my questions (apologies if I haven't looked hard
enough/spent enough time reading up on general ideas)
So,
Is there a general overview of how the different services work together -
the process of receiving mail, putting it onto spools & subsequent
processing?
I looked through the posting archives, but couldn't find an answer to the
following question - is it possible to have multiple James instances running
& have each instance responsible for a predetermined clump of users?
Is there accessible documentation on Phoenix? Since Avalon is closed, I
couldn't find a source of information on it.
I'm looking to try & get James up & running locally in a usable manner (Only
got it running in a test configuration so far) and possibly to work on the
code. The above requested information would help me greatly in this.
Thanks,
John
_________________________________________________________________
The next generation of Hotmail is here! http://www.newhotmail.co.uk
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org