How to Configure Sendmail

Download Sendmail1Download Sendmail[1]. You may be automatically offered a short initial message which will indicate the current release. These instructions below assume version 8.10.0 or later.
2Build and install Sendmail for your machine. In most cases, this consists of unpacking the distribution, reading the README and sendmail/README files, and typing Build in the Sendmail directory. See the INSTALL file in the distribution's top-level directory for details.

Set up Sendmail1Understand that Sendmail uses information from the Domain Name System (DNS) to figure out which IP addresses go with which mailboxes.
2Choose an available domain name. In our example, we will use yourdomain.com.
3Configure your DNS on the server. Establish two machines as primary and secondary name servers for your domain. Knowledge of how to do this is assumed; otherwise, read the O'Reilly book "DNS and BIND", 4th Edition is highly recommended. Familiarize yourself with BIND before continuing.
4Configure MX records for your domain (Note: CNAME records can not be used; see § 5.2.2 of RFC 1123 for details.) MX records are explained in the O'Reilly Sendmail book; the 2nd edition gives an overview in § 15.3 and describes how to configure them in § 21.3, whereas the third edition explains everything about them in § 9.3. You have two options for MX records:
5Determine your connection method:
If the mail server which will serve your new domain has a full-time connection to the Internet, it should be the primary MX host for your domain. In this configuration, your MX records would look like this:
yourdomain.com. IN MX 10 yourmailserver.yourdomain.com.

Otherwise, you will need to find another machine to queue mail for your domain when you are not connected. Be sure to get the machine owners' approval first. That machine must be configured to allow relaying to your domain. If it is running Sendmail, this can be as simple as adding your domain to the relay-domains file on that machine. You would then point your MX records at that machine. For example:
yourdomain.com. IN MX 10 yourmailserver.yourdomain.com.
yourdomain.com. IN MX 20 othermailserver.otherdomain.com.



6Now the name servers are setup, register your domain using one of the registries. As you register, inform the registry of the two name servers, and then the domain will point to your server.

Configure Sendmail1Read the cf/README file thoroughly. It will give you instructions on creating a .mc file in the cf/cf directory. Your mailserver.mc file will typically look something like:
divert(-1)dnl
#
# This file contains the global definitions for yourdomain.com
#
divert(0)dnl
VERSIONID(`@(#)mailserver.mc 1.0 (yourdomain.com) 5/1/97')
OSTYPE(solaris2)dnl
DOMAIN(yourdomain.com)dnl
FEATURE(`virtusertable', `dbm /etc/mail/virtusertable')dnl
MAILER(local)dnl
MAILER(smtp)dnl


Your actual OS will be substituted for solaris2.

2A typical cf/domain/yourdomain.com.m4 file that looks something like:
divert(-1)dnl
#
# This file contains the global definitions for yourdomain.com
#
divert(0)dnl
VERSIONID(`@(#)yourdomain.com.m4 1.0 (yourdomain.com) 5/1/97')
FEATURE(`use_cw_file')dnl

3It may have some other feature()'s and define()'s as well. The virtual user table is the key to all of this.
4Generate your /etc/mail/sendmail.cf file from your mailserver.mc file, so type:
cd sendmail-VERSION/cf/cf
/Build mailserver.cf
cp mailserver.cf /etc/mail/sendmail.cf

5Create the virtual user table. This is explained in detail in the Sendmail book: § 19.6.28 of the 2nd edition, or § 4.8.51 of the 3rd edition; an overview is given here. The table is a database that maps virtual addresses into real addresses. You create a text file where each line has a key/value pair, separated by a TAB. For example:
Example 1:
joe@yourdomain.com jschmoe
jane@yourdomain.com jdoe@othercompany.com
@yourdomain.com jschmoe
In this first example, the address joe@yourdomain.com will be mapped to the local user jschmoe; jane@yourdomain.com will be mapped to the remote user jdoe@othercompany.com, and anything else coming in to yourdomain.com will also go to jschmoe.




Example 2:
joe@yourdomain.com jschmoe%3
bogus@yourdomain.com &npsp; error:nouser No such user here
list@yourdomain.com yourdomain-list
@yourdomain.com %1@othercompany.com
In this second example, the address joe@yourdomain.com will be mapped to the local user jschmoe%3 (see note 3 below for an explanation of what the %3 means), the address bogus@yourdomain.com will return the indicated error, the address list@yourdomain.com will be mapped to the local user yourdomain-list (which you would use the aliases file to ultimately resolve) and every other user at yourdomain.com will be mapped to a remote user of the same name at othercompany.com.



6If you have a local user, say sam, and there is no key for sam@yourdomain.com and no catch-all key for @yourdomain.com, then Sendmail will fall back to the local user sam when resolving sam@yourdomain.com. To prevent this, you must use either a catch-all key or an explicit key for sam@yourdomain.com; the error:nouser example above may be useful in this instance.
7If you want a virtual address to resolve to more than one real address, you need to do it indirectly. Have the virtual address resolve to a local alias, then have the local alias resolve to the desired set of addresses. For example, in the virtual user table:
joe@yourdomain.com localjoe


then in the aliases file:

localjoe: joe@othercompany.com, jane@othercompany.com
In the above example:
joe@yourdomain.com jschmoe%3



8The %3 is the preservation of the optional +detail part of the original address. In general, +detail means that when Sendmail gets an address like user+detail@domain, then if domain is in class w (see step 7 below), sendmail checks to see if user+detail can be resolved, then falls back to just plain user if not. Thus all of:
joe@yourdomain.com
joe+foo@yourdomain.com
joe+reallylongextrapart@yourdomain.com


would all match the above entry, with %3 preserving the +detail part of nothing, +foo and +reallylongextrapart respectively.

Multiple domains are allowed, and virtual addresses in each domain are independent. So for example, you could have:
joe@yourdomain1.com localjoe
joe@yourdomain2.com joe@othercompany.com
joe@yourdomain3.com localjoe
joe@yourdomain4.com error:nouser No such user here


9For people administering multiple domains, it may be easier to keep each domain's list in a separate file, then write a short script to concatenate all such files together into a master virtual user table. But we're getting ahead of ourselves; that's the next step...

Build the Sendmail User Table1Build the virtual user table. If the above virtual user table text file is located at sourcefile, and you are using the dbm database type, then use the command:
makemap dbm /etc/mail/virtusertable < sourcefile
Note: if you built Sendmail with NEWDB instead of NDBM, then use hash instead of dbm in the above line.
This creates one or more non-text files (typically /etc/mail/virtusertable.dir and /etc/mail/virtusertable.pag, or /etc/mail/virtusertable.db), but does not actually change /etc/mail/virtusertable itself, so this is the recommended location for sourcefile.
If you would like to reverse-map local users for out-bound mail, you will need to add support for the generics table to your .mc file:
FEATURE(`genericstable', `dbm /etc/mail/genericstable')dnl
GENERICS_DOMAIN_FILE(`/etc/mail/generics-domains')dnl

And you will need to create /etc/mail/genericstable which is like /etc/mail/virtusertable above except the columns are reversed:
jschmoe joe@yourdomain.com



Add your domain names to Sendmail1Add each new domain name to sendmail's class w. This is typically done by adding a line to /etc/mail/local-host-names (known as /etc/sendmail.cw prior to version 8.10) with the value of each domain name. Likewise, if you are using the genericstable, you should add any domains you wish to reverse-map to /etc/mail/generics-domains.
2Restart or SIGHUP sendmail.
3You do not need to restart sendmail when changing the virtual user or generics tables, only when changing /etc/mail/sendmail.cf or class files such as /etc/mail/local-host-names.
An extra step is required for hosts not connected full-time. As noted in the MX configuration section, if you use another host to queue your mail until you connect, you will have to force delivery of mail queued on the secondary mail server. To accomplish this, when your primary server connects, you should run the script etrn.pl which comes in the contrib directory of the sendmail distribution:
etrn.pl secondary-mx-host yourdomain.com
It may be advisable to put this at the end of the Sendmail start-up script on any primary MX. It would be especially useful as a follow-up to whatever script initiates the connection on primary MXs without full-time connections.
At this point, you should be set, and people should be able to send e-mail to addresses @yourdomain.com.

Configure SSH on your Cisco router

Most IT pros realize that using Telnet to manage routers, switches, and firewalls is insecure. Transmitted in clear text across a network, Telnet traffic basically publicizes any login usernames and passwords to any attackers out there listening—who can take advantage of that information to access a device as the network administrator.

The standard alternative to Telnet's lack of security is Secure Shell (SSH). Like Telnet, you can use SSH to enter IOS commands over a network or to copy files over the network to a device. But with SSH, which uses encryption and digital certificates, you don't have nearly as many security concerns.

There are two versions of Secure Shell: SSH1 and SSH2. Cisco IOS 12.1(3)T was the first version to support SSH1; however, it does require the Data Encryption Standard (DES) or triple DES (3DES) IPSec encryption version of the IOS.

Certain versions of IOS 12.3—12.3(4)T, 12.2(25)S, and 12.3(7)JA or later—were the first to support SSH2, which requires a version of the IOS that supports 3DES. IOS versions that support 3DES have k9 in the name of the file.

It's important to note that SSH1 and SSH2 are two entirely different protocols. SSH2 offers much more security, and I recommend using it whenever possible. However, even SSH1 is better than Telnet. It will protect you from the casual hacker who's trying to sniff passwords from your network.

The Cisco IOS offers both an SSH server and an SSH client. So you can connect to your router's SSH server from an SSH client, or you can connect your router's SSH client to another device that has an SSH server.

Let's start with how to configure SSH on a Cisco IOS router. This configuration process is also very similar on Cisco switches and firewalls. Before you begin, make sure you have the proper image that includes IPSec DES or 3DES encryption to make sure using SSH is possible.

For our example, I'm using a 2611 router running IOS version 12.2(15)T9 that includes 3DES encryption. The exact filename is c2600-ik9o3s3-mz.122-15.T9.bin.

First, make sure your router has a hostname by using the hostname command. Here's an example:

Router(config)# hostname TR-Router
TR-Router(config)#Next, configure a domain name on your router using the ip domain-name command. Here's an example:

TR-Router(config)# ip domain-name TechRepublic.com
TR-Router(config)#Then, create an RSA encryption key pair for the router to use for authentication and encryption of the SSH data. One of the questions you must answer during this process is the modulus size of the key. Make sure the key modulus is at least 768 bits. Here's an example:

TR-Router(config)# crypto key generate rsa
The name for the keys will be: TR-Router.TechRepublic.com
Choose the size of the key modulus in the range of 360 to 2048for your General Purpose Keys. Choosing a key modulus greater than512 may take a few minutes.
How many bits in the modulus [512]: 768
% Generating 768 bit RSA keys ...[OK]
TR-Router(config)#
*Mar 1 00:17:13.337: %SSH-5-ENABLED: SSH 1.5 has been enabled
TR-Router(config)#As you can see from this example, after the system generates the key, you'll receive a message that it has automatically enabled SSH 1.5 on the router. To clarify, SSH 1.5 is Cisco's way of saying this router is running SSH1. If the system has enabled support for both SSH1 and SSH2, this message would say SSH 1.99. If the system has only enabled support for SSH2, the message would say SSH 2.0.

You can also configure SSH settings if you choose. To do so, use the ip ssh command with whichever parameters you choose to set. (Different IOS versions have different options because they support different versions of SSH.) Here's an example:

TR-Router(config)# ip ssh ?
authentication-retries Specify number of authentication retries
Port Starting (or only) port number to listen
on
Rsa Configure RSA keypair name for SSH
source-interface Specify interface for source address in SSH
connections
time-out Specify SSH time-out interval

TR-Router(config)# ip sshConfiguring optional SSH settings completes the process of configuring SSH on the router. Now, let's take a look at showing the SSH status.

To view the status of SSH, you can use the following commands:

Use show ip ssh to view SSH settings.
Use show ssh to view SSH connections.
Here's an example:

TR-Router# show ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 3
TR-Router# show ssh
%No SSH server connections running.
TR-Router#SSH debug commands are also available by using the debug ip ssh command.

You can use a device's built-in SSH client to connect to other SSH servers. The Privileged Mode command is ssh. Here's an example:

TR-Router# ssh ? -c Select encryption algorithm -l Log in using this username -o Specify options -p Connect to this port WORD IP address or hostname of a remote system

TR-Router# sshOne word of caution: In May 2005, researchers discovered vulnerabilities in a number of Cisco IOS versions with SSH capabilities. For more information—and to make sure the IOS version you're using isn't vulnerable—check out "Cisco Security Advisory: Vulnerabilities in Cisco IOS Secure Shell Server."

Earlier in the article, I mentioned that you can also use SSH's secure functionality to copy files over your network. While space constraints keep me from delving further into the topic, check out Cisco's Secure Copy documentation for more information. For more information about configuring SSH on your router, check out Cisco's Configuring Secure Shell documentation and its Secure Shell Version 2 Support documentation.

Miss a column?
Check out the Cisco Routers and Switches Archive, and catch up on David Davis' most recent columns.

Want to learn more about router and switch management? Automatically sign up for our free Cisco Routers and Switches newsletter, delivered each Friday!

David Davis has worked in the IT industry for 12 years and holds several certifications, including CCIE, MCSE+I, CISSP, CCNA, CCDA, and CCNP. He currently manages a group of systems/network administrators for a privately owned retail company and performs networking/systems consulting on a part-time basis.

Linux Hard Disk Format Command

Q. I've installed a new 250GB SATA hard disk on our office CentOS Linux server. How do I format a hard disk under Linux operating system from a shell prompt?

A.. There are total 4 steps involved for hard disk upgrade and installation procedure:

Step #1 : Partition the new disk using fdisk command
Following command will list all detected hard disks:
# fdisk -l | grep '^Disk'
Output:

Disk /dev/sda: 251.0 GB, 251000193024 bytes
Disk /dev/sdb: 251.0 GB, 251000193024 bytesA device name refers to the entire hard disk. For more information see Linux partition naming convention and IDE drive mappings.
To partition the disk - /dev/sdb, enter:
# fdisk /dev/sdb
The basic fdisk commands you need are:

m - print help
p - print the partition table
n - create a new partition
d - delete a partition
q - quit without saving changes
w - write the new partition table and exit
Step#2 : Format the new disk using mkfs.ext3 command
To format Linux partitions using ext2fs on the new disk:
# mkfs.ext3 /dev/sdb1
Step#3 : Mount the new disk using mount command
First create a mount point /disk1 and use mount command to mount /dev/sdb1, enter:
# mkdir /disk1
# mount /dev/sdb1 /disk1
# df -H
Step#4 : Update /etc/fstab file
Open /etc/fstab file, enter:
# vi /etc/fstab
Append as follows:

/dev/sdb1 /disk1 ext3 defaults 1 2Save and close the file.

Task: Label the partition
You can label the partition using e2label. For example, if you want to label the new partition /backup, enter
# e2label /dev/sdb1 /backup
You can use label name insted of partition name to mount disk using /etc/fstab:
LABEL=/backup /disk1 ext3 defaults 1 2