Lecture 23

Email &c

Having a functioning email system on your network is 100% necessary to the success of your mission as a system administrator.
The four components of a mail system are:
- Mail User Agent (MUA), the user interface to mail that lets users read and send mail
- Mail Transport (or Transfer) Agent (MTA), that routes messages from one machine to another
- Mail Delivery Agent (MDA), that delivers received mail to the appropriate location on the local machine
- Access Agent (that connects the user agent to the message store (POP or IMAP)

Popular MUAs include those found in the Nemeth feature table:

User Agent	Sys prefs	User prefs	Mime	POP	IMAP	SMTP
`/bin/mail`	-	-
`/usr/ucb/mail`	Mail.rc	.mailrc
`mh`	-	.mh_profile .mh_delivery	*	*		*
`pine`	pine.conf	.pinerc	*	*	*	*
`elm`	/lib/elm.rc	.elm/elmrc	*	*	*
`mutt`	Muttrc	.muttrc	*	*	*
Netscape	-	-	*	*	*	*
Eudora	-	-	*	*	*	*
Pegasus	-	-	*	*	*	*
Outlook Express	-	-	*	*	*	*

Don't let your users use /bin/mail, /usr/ucb/mail or any other MUA as obviously featureless as the table above shows.
An MTA accepts mail from an MUA, decodes the recipient's addresses, and transfers the mail to the right MTA to effect local delivery of the mail. It looks like sendmail is still the most popular MTA, though Postfix and qmail have been gaining ground in recent years.
An MDA delivers mail into a file on a machine (whether a mail server or a local machine that runs a simple MUA).
The most common mail delivery agent on Unix machines is /bin/mail, although many machines use mail.local. Of more value is an MDA like procmail that can filter messages by content and place them in specific mail folders for AAs that supot that capability.
The message store, where messages for users are normally held until (or even after) read is typically in /var/spool/mail or /var/mail. Old style mbox format stores all messages in a single file. The mh style stores each message in a separate file.
Mail submission agents preprocess mail to check for correct headers and addresses, see that all hostnames in a message are fully qualified, and so forth, before sending it to an MTA.
A mail message comprises the following parts:
- envelope
- header
- body
The envelope lists the sender and recipients of the message
The headers specify various properties of the message. They are arranged in Name: value pairs. They are separated from the body by a blank line.
The body is the actual content of the meessage that should be sent. It may be encoded using MIME (Multipurpose Internet Mail Extensions), an extension on RFC 822 which described how to represent text messages for transfer on the internet.
Mail addresses are almost universally of the form:
```
user@host.domain
```
Back in the old days, other addressing techniques were used including UUCP (with lots of exclamation points) and several types of route-based addresses using at-signs or percent-signs. Some of sendmail's complexity deals with understanding these completely outmoded addresses.
Headers get manipulated by each MTA that touches your mail as it gets delivered from one place to another. They add (in turn) a Received line that shows which machine received the message, from which machine it was received, and when. These are added at the top, so the most recent one is first.
Each message contains a unique ID.
AAs (Access Agents) will support one of a variety of ways of providing information to MUAs.
POP (post office protocol) allows an MUA to receive stored mail from a post office machine. The mail is delivered in a batch when it is requested. The mail can either be stored on the server when downloaded, or deleted. If the user employs folders to organize the mail, these folders are stored on the machine that runs the MUA client.
IMAP (Internet Message Access Protocol) provides the same general capabilities as POP, but instead of requiring the user to store the mail after downloading, IMAP maintains the mail files on a host that keeps the user's mail folders organized. Also, instead of downloading all messages at a time, IMAP will download headers, and deliver messages one at a time. This reduces network traffic.
There are a variety of issues at play in deciding between the use of POP and IMAP.
- Do your users log in from many different machines and still want to see their mailboxes at each machine?
- Do you have the necessary disk infrastructure to store all the mail your users maintain?
- Will your users want to minimize their connection time or their download bandwidth?
It appears that the most popular access agent is courier. Courier also provides an MTA, however, this is not nearly as popular as other discussed below.
Mailing lists: programs such as Majordomo, Mailman, ListProc, Smartlist, and LISTSERV can be used to create and maintain mailing lists.
Sendmail is the original and perhaps stil the most used MTA. Several other popular alternatives to sendmail are postfix, qmail, and exim.
We will not discuss the details of sendmail. I will ask you to install Postfix instead.
Sendmail is discussed on ppg. ???-??? of Nemeth and Postfix is discussed on ppg. ???-???. The volume of reporting is dictated by the complexity of administering each system. If you want to learn about sendmail, you are welcome to do so on your own.
Furthermore, we used our Rocks/Sux meter (googling for "XXX rocks", "XXX rox", "XXX sucks" and "XXX sux") to evaluate MTAs.

sendmail postfix qmail exim

26/366 (0.1) 233/81 (2.9) 285*/111 (2.6) 39/38 (1)

* Due to the existence of the web site qmailrocks.org (a blatant attempt to affect rox/sux scores), we changed our rox search to
qmail rocks -qmailrocks -"site qmail rocks" -"qmail rocks site"
If not for this change, qmail's rox/sux index would be 344/111 (3.1).
Look at the following mail I received:
This (old) mail was relayed by a unix-ippd host to mail.cise.ufl.edu from hawk.cise.ufl.edu. It was created by talking directly to port 25 on an AIX host. Those machines like many had a sendmail SMTP server running on port 25. The SMTP protocol is very easy to learn and use. It is incredibly easy to forge mail, and you should *never* forge mail to any *except yourself*. Doing otherwise is fraud and can be considered identity theft and can be punishable by law.
he mail above was created by specifying the following sequence of commands:
```
HELO hawk.cise.ufl.edu
MAIL From: george@whitehouse.gov
RCPT To: jnw@cise.ufl.edu
DATA
etc., etc.
.
QUIT
```
The biggest problem that allowed me to forge this mail is that the host merlin.unix-ippd allowed relaying of information to any machine on the internet. This is considered poor form. It is no longer tolerated by the network community.
RBLs (Realtime Blackhole Lists provide one way of dealing with problems like this. An RBL is a list of IP addresses whose owners will transmit spam. RBL subscribers will block addresss on the RBL from acceptance by their MDA. This is also commonly referred to as whitelisting.
Graylisting is another approach to eliminating spam. The graylisting strategy involves having a whitelist of known valid senders in the MDA. Anyone not in the whitelist is in the graylist. If mail is received for delivery from an address not in the whitelist, it is temporarily rejected. Most spammers use bulkmail programs that will not store rejected messages for futrre delivery. Real mailers will resend temporarily rejected mail. When the mail is received the second time, the sender address is stored in the whitelist. If the resend never happens, at some point, the sender may be put into a blacklist, however, that is not necessary fo the strategy to work.
In a very near-term future assignment, you will be required to install Postfix on one your machines.
Even as late as 2002, spam was not the wretched evil that it has become today. Using a spam filtering tool is critical. The popular one for unix systems is spamassassin (produced by apache.org). When used in concert with a tool like postfix (which is primarily used to filter mail for a mail delivery agent, it can dramatically cut down on junk mail.
One typically uses spamasassin to tag mail headers, then filters those messages with an MDA like procmail.