schlitt.info - php, photography and private stuff

Moving

No, not myself, but my server. Until now I ow a 1und1 Root Server L, which I bought more than 2 years ago. Now that 1und1 offers a new generation of servers, I decided to switch to a 64-bit machine. My old server had a Celeron processor, 256 MB RAM and 20 GB HD, which could not really handle my spam protection anymore. The new one is an Athlon 64 3000+, has 1 GB RAM and 2 80 GB SATA discs, which I run as a soft raid.

While migrating all of my stuff (28 domains, which I host for myself and friends) to the new server, I decided to switch the platform, I'm running, completely. While I still claimed a few weeks ago, that Debian is my favorite system for servers, I now have Gentoo running. I know, this is a system most people would never use for something else but desktops, but for one major reason it's better for me than Debian in this place: I'm more familiar with it! While I used Debian constantly more than 2 years on all of my machines, I got much too used to the Gentoo style of doing things in the past month and always tried stuff like "$ eix spamassassin" or "$ emerge -pv apache". Gentoo is simply cleaner and I have a much better overview on what my system has installed and what should be running.

When switching the system itself, I decided to go for other server software, too. While Postfix is a cool MTA, it's still hard to configure (naturally easier than Sendmail, but still hard) and it took me 2 weeks to figure out how stuff has to work. Since there is a very nice Gentoo-Howto for Qmail and it looked like this one is capable of everything I basically need for my personal playground, I went this way. Believe me or not, setting up my whole mail stuff (including virtual domains and accounts, spam and virii protection, mailing lists,...) took me 2 man days. Qmail, qmail-scanner, vpopmail, ezmlm, qmailadmin and maildrop give you a fantastically clean interface, to realize even complex architectures easily.

Beside my migration from Postfix to Qmail, I started (influenced by Kore) to use Lighttpd as my web server. Lighttpd is developed by Jan Kneschke and is a lighweight, easy to configure and secure web server. Most convenient, it uses the FCGI interface to address PHP, which is almost as fast as using Apache with mod_php, but gives you a huge bunch of flexibility. For instance I run 2 versions of PHP (4.4 and 5.1) in parallel inside 1 server, being able to define on a host or filename basis, which version to choose.

The migration is now almost complete and I'm very satisfied with the results. So long, thanks Qmail and Lighttpd! See some more info on my setup in the extended body of this entry.

Howto Qmail and Lighttpd on Gentoo

First of all, the term "Howto" might be a bit misleading. I will refer to multiple howtos I used during setup here and will try to share a general overview on how I got my setup working. So this is not really a howto in itself, but a howto collection with some enhancements.

Qmail

The Qmail installation on Gentoo is quite easy, if you follow this great howto from the Gentoo website. The Gentoo-Wiki also provides information here.

After that, you should have Qmail up and running for your system, including Vpopmail, which takes the need of having a system user for each mailbox you create from you. Beside that, you might have running Hordes IMP, a very convenient web mail tool. For IMAP/POP access I use Courier-IMAP, as suggested in the howto, if you already setup a web server.

When you migrate from another system, you may run into the pitfall of having to migrate from the Mbox format to Maildir. Mbox generally stores all mails of a mailbox in 1 single file, while Maildir uses a unique file for each message. The advantages of Maildir are obvious here: It's damn fast. Nevertheless, you have to convert your mail boxes. I used this tool and some bash magic to move my mailboxes. Also I had some worries to run a script on my whole mail archive (around 1 GB now), it worked perfectly fine.

For spam protection I use Spamassassin (is there really an alternative?) in combination with qmail-scanner. The latter script hooks into Qmail and replaces it's usual queuing mechanism to allow attaching of filters. Beware: qmail-scanner does not really work with emerge, it tries guessing your system components (without listening to USE flags) and adds only available components to itself. This means, that you have Spamassassin up and running before installing qmail-scanner and your Spamassassin must manipulate the headers of a spam mail, else qmail-scanner will not recognize it correctly! Additionally you can install ClamAV before emerging qmail-scanner and the latter one will automatically integrate both.

Before we finalize Qmail, let's setup Lighttpd.

Lighttpd

Basically you need to follow this howto from the Gentoo wiki. While this assumes that you emerge PHP, I still tend to compile it on my own. To get multiple versions of PHP running, I simply changed the Gentoo config file under /etc/lighttpd/mod_fastcgi.conf to not load PHP at all, but only the FCGI module. Now I can define Fast CGI configurations for every VHost I'm creating. This looks basically like that:

As you can see, you can define all necessary options per VHost. I have a VHost file for each of my running domains, which specifies, which PHP version to use and so on. The suphp-5.1.sh simply changes to the user the PHP should run with (basically my user) and runs PHP. This has the benefit, that uploaded files are owned by they should be owned and therfore no hazards occur, if you grant someone FTP/SCP access.

That's basically everything you need for your Lighttpd ground installation.

Qmail II

What was still missing for Qmail/Vpopmail is the very convenient user interface QmailAdmin. This is a CGI binary, which allows you to manage your complete virtual mail setup through the web. Since it runs CGI, you have to activate this module in your Lighttpd (most howtos assume you have Apache). Then edit the mod_cgi.conf and assign qmailadmin to run on it's own (without an interpreter):

Note: You need to run QmailAdmin with setuid, because it has to access the vpopmail scripts and the data of it stored on the HD and in MySQL. For more security, I recommend to restrict the access to this script on IP basis or add an additional authentication (e.g. basic auth).

If you installed Ezmlm before installing QmailAdmin, you have also support for managing mailinglists in it. QmailAdmin allows you to login on a per-domain basis and allows the administrator of a domain to create and modify mailboxes, forwards, aliases, autoresponders and mailinglists.

Maildrop is the last component I needed for my setup. What Procmail is in the sendmail world, is Maildrop for the Qmail world. At a first glance both do the same: Matching parts of a mail with regex and delivering the mail according to defined rules. On a second look, Maildrop seems more powerful to me. At least it is more convenient to code your rules, since it has a kind of programming language to do so. E.g. I wrote a simple script which takes spam mails that have been discovered by Spamassasin, looks if the user to deliver the mail to already has a spam mailbox. If not, it creates one for him and subscribes him to the new mailbox:

The script has to go to the global maildroprc (/etc) and Maildrop has to be activated in the users .qmail file. Thats all. :)