Inhaltsverzeichnis
Nach dem Aufbau der Netzwerkverbindung (laut Kapitel 5, Netzwerkkonfiguration) können Sie verschiedenste Netzwerkapplikationen nutzen.
Es gibt viele Webbrowser-Pakete, um auf ferne Inhalte über das Hypertext Transfer Protocol (HTTP)-Protokoll zuzugreifen:
Tabelle 6.1. Liste der Webbrowser
Paket | Popcon | Größe | Art | Beschreibung des Webbrowsers |
---|---|---|---|---|
chromium
|
V:72, I:136 | 132498 | X | Chromium, (quelloffener Browser von Google) |
iceweasel
|
V:276, I:549 | 7066 | " | abgewandelter Mozilla Firefox |
iceape-browser
|
V:2, I:7 | 97 | " | abgewandelter Mozilla-Browser, aufgrund von Sicherheitsbedenken entfernt bug#505565 |
epiphany-browser
|
V:40, I:176 | 2307 | " | GNOME, HIG-konform, Epiphany |
konqueror
|
V:36, I:111 | 3491 | " | KDE, Konqueror |
dillo
|
V:1, I:4 | 1231 | " | Dillo, (ressourcenschonender Browser, FLTK-basiert) |
w3m
|
V:256, I:882 | 2076 | Text | w3m |
lynx
|
I:142 | 245 | " | Lynx |
elinks
|
V:18, I:40 | 1604 | " | ELinks |
links
|
V:25, I:61 | 1319 | " | Links (Nur-Text) |
links2
|
V:4, I:23 | 3246 | grafisch | Links (Konsolen-Grafik ohne X) |
Sie können möglicherweise bei einigen Browsern die folgenden speziellen URLs verwenden, um die Einstellungen zu kontrollieren:
"about:
"
"about:config
"
"about:plugins
"
Debian bietet viele Pakete mit freien Browser-Plugins im main-Bereich des Archivs, die nicht nur die Nutzung von Java (Software-Plattform) und Flash ermöglichen, sondern auch von MPEG, MPEG2, MPEG4, DivX, Windows Media Video (.wmv), QuickTime (.mov), MP3 (.mp3) und Ogg/Vorbis sowie von DVDs, VCDs usw. Debian stellt im contrib- oder non-free-Bereich des Archivs auch Hilfsprogramme zur Installation von nicht-freien Browser-Paketen bereit.
Tabelle 6.2. Liste von Browser-Plugin-Paketen
Paket | Popcon | Größe | Bereich | Beschreibung |
---|---|---|---|---|
icedtea-6-plugin
|
I:30 | 269 | main | Java-Plugin basierend auf OpenJDK und IcedTea |
mozilla-plugin-gnash
|
I:15 | 54 | main | Flash-Plugin basierend auf Gnash |
flashplugin-nonfree
|
V:23, I:228 | 178 | contrib | Flash-Plugin-Hilfsprogramm zur Installation des Adobe Flash Players (nur i386 und amd64) |
browser-plugin-vlc
|
V:13, I:21 | 202 | main | Multimedia-Plugin basierend auf dem VLC Media Player |
totem-mozilla
|
V:63, I:143 | 640 | main | Multimedia-Plugin basierend auf GNOMEs Totem Media Player |
gecko-mediaplayer
|
V:6, I:11 | 581 | main | Multimedia-Plugin basierend auf (GNOMEs) MPlayer |
![]() |
Tipp |
---|---|
Obwohl die Verwendung der oben genannten Debian-Pakete viel einfacher ist,
können Browser-Plugins auch noch manuell aktiviert werden, indem die
entsprechende "*.so"-Datei in ein Plugin-Verzeichnis
(z.B. " |
Einige Webseiten lehnen eine Verbindung aufgrund der user-agent-Angabe des
Browsers ab. Sie können diese Situation umgehen, indem Sie die user-agent-Angabe fälschen, zum
Beispiel über das Hinzufügen der folgenden Zeile in
Benutzer-Konfigurationsdateien wie
"~/.gnome2/epiphany/mozilla/epiphany/user.js
" oder
"~/.mozilla/firefox/*.default/user.js
":
user_pref{"general.useragent.override","Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"};
Alternativ können Sie diese Variable hinzufügen und zurücksetzen, indem Sie
"about:config
" in die Adresszeile eingeben und einen
Rechtsklick auf den angezeigten Inhalt ausführen.
![]() |
Achtung |
---|---|
Eine gefälschte user-agent-Angabe kann möglicherweise nachteilige Nebenwirkungen bei der Verwendung von Java haben. |
![]() |
Achtung |
---|---|
If you are to set up the mail server to exchange mail directly with the Internet, you should be better than reading this elementary document. |
![]() |
Anmerkung |
---|---|
The following configuration examples are only valid for the typical mobile workstation on consumer grade Internet connections. |
An email message consists of three components, the message envelope, the message header, and the message body.
The "To" and "From" information in the message envelope is used by the SMTP to deliver the email. (The "From" information in the message envelope is also called bounce address, From_, etc.)
The "To" and "From" information in the message header is displayed by the email client. (While it is most common for these to be the same as ones in the message envelope, such is not always the case.)
The email client needs to interpret the message header and body data using Multipurpose Internet Mail Extensions (MIME) to deal the content data type and encoding.
In order to contain spam (unwanted and unsolicited email) problems, many ISPs which provide consumer grade Internet connections are implementing counter measures.
The smarthost service for their customers to send message uses the message submission port (587) specified in rfc4409 with the password (SMTP AUTH service) specified in rfc4954.
The SMTP port (25) connection from their internal network hosts (except ISP's own outgoing mail server) to the Internet are blocked.
The SMTP port (25) connection to the ISP's incoming mail server from some suspicious external network hosts are blocked. (The connection from hosts on the dynamic IP address range used by the dial-up and other consumer grade Internet connections are the first ones to be blocked.)
Anti-spam techniques such as DomainKeys Identified Mail (DKIM) and Sender_Policy_Framework (SPF) are widely used for the email filtering.
The DomainKeys Identified Mail service may be provided for your mail sent through the smarthost.
When configuring your mail system or resolving mail delivery problems, you must consider these new limitations.
In light of these hostile Internet situation and limitations, some independent Internet mail ISPs such as Yahoo.com and Gmail.com offer the secure mail service which can be connected from anywhere on the Internet using Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL).
![]() |
Achtung |
---|---|
It is not realistic to run SMTP server on consumer grade network to send mail directly to the remote host reliably. They are very likely to be rejected. You must use some smarthost services offered by your connection ISP or independent mail ISPs. |
For the simplicity, I assume that the smarthost is located at
"smtp.hostname.dom
", requires SMTP Authentication, and uses the message
submission port (587) with the STARTTLS in
the following text.
The most simple mail configuration is that the mail is sent to the ISP's smarthost and received from ISP's POP3 server by the MUA (see Abschnitt 6.4, „Mail user agent (MUA)“) itself. This type of configuration is popular with full featured GUI based MUA such as icedove(1), evolution(1), etc. If you need to filter mail by their types, you use MUA's filtering function. For this case, the local MTA (see Abschnitt 6.3, „Mail transport agent (MTA)“) need to do local delivery only.
The alternative mail configuration is that the mail is sent via local MTA to the ISP's smarthost and received from ISP's POP3 by the mail retriever (see Abschnitt 6.5, „The remote mail retrieval and forward utility“) to the local mailbox. If you need to filter mail by their types, you use MDA with filter (see Abschnitt 6.6, „Mail delivery agent (MDA) with filter“) to filter mail into separate mailboxes. This type of configuration is popular with simple console based MUA such as mutt(1), mew(1), etc., although this is possible with any MUAs (see Abschnitt 6.4, „Mail user agent (MUA)“). For this case, the local MTA (see Abschnitt 6.3, „Mail transport agent (MTA)“) need to do both smarthost delivery and local delivery. Since mobile workstation does not have valid FQDN, you must configure the local MTA to hide and spoof the real local mail name in outgoing mail to avoid mail delivery errors (see Abschnitt 6.3.3, „The mail address configuration“).
![]() |
Tipp |
---|---|
You may wish to configure MUA/MDA to use Maildir for storing email messages somewhere under your home directory. |
For normal workstation, the popular choice for Mail transport agent (MTA) is
either exim4-*
or postfix
packages.
It is really up to you.
Tabelle 6.3. List of basic mail transport agent related packages for workstation
Paket | Popcon | Größe | Beschreibung |
---|---|---|---|
exim4-daemon-light
|
V:617, I:728 | 1200 | Exim4 mail transport agent (MTA: Debian default) |
exim4-base
|
V:628, I:742 | 1478 | Exim4 documentation (text) and common files |
exim4-doc-html
|
I:2 | 3033 | Exim4 documentation (html) |
exim4-doc-info
|
I:1 | 554 | Exim4 documentation (info) |
postfix
|
V:152, I:170 | 3397 | Postfix mail transport agent (MTA: alternative) |
postfix-doc
|
I:14 | 3538 | Postfix documentation (html+text) |
sasl2-bin
|
V:12, I:36 | 370 | Cyrus SASL API implementation (supplement postfix for SMTP AUTH) |
cyrus-sasl2-doc
|
I:5 | 221 | Cyrus SASL - documentation |
Although the popcon vote count of exim4-*
looks several
times popular than that of postfix
, this does not mean
postfix
is not popular with Debian developers. The
Debian server system uses both exim4
and
postfix
. The mail
header analysis of mailing list postings from prominent Debian
developers also indicate both of these MTAs are as popular.
The exim4-*
packages are known to have very small memory
consumption and very flexible for its configuration. The
postfix
package is known to be compact, fast, simple, and
secure. Both come with ample documentation and are as good in quality and
license.
There are many choices for mail transport agent (MTA) packages with different capability and focus in Debian archive.
Tabelle 6.4. List of choices for mail transport agent (MTA) packages in Debian archive
Paket | Popcon | Größe | capability and focus |
---|---|---|---|
exim4-daemon-light
|
V:617, I:728 | 1200 | full |
postfix
|
V:152, I:170 | 3397 | full (security) |
exim4-daemon-heavy
|
V:10, I:11 | 1335 | full (flexible) |
sendmail-bin
|
V:13, I:14 | 1732 | full (only if you are already familiar) |
nullmailer
|
V:6, I:8 | 428 | strip down, no local mail |
ssmtp
|
V:10, I:13 | 1 | strip down, no local mail |
courier-mta
|
V:0, I:0 | 1963 | very full (web interface etc.) |
xmail
|
V:0, I:0 | 688 | light |
masqmail
|
V:0, I:0 | 337 | light |
esmtp
|
V:0, I:1 | 144 | light |
esmtp-run
|
V:0, I:0 | 57 |
light (sendmail compatibility extension to esmtp )
|
msmtp
|
V:3, I:7 | 318 | light |
msmtp-mta
|
V:1, I:1 | 86 |
light (sendmail compatibility extension to msmtp )
|
For the Internet mail via smarthost, you (re)configure
exim4-*
packages as the following.
$ sudo /etc/init.d/exim4 stop $ sudo dpkg-reconfigure exim4-config
Select "mail sent by smarthost; received via SMTP or fetchmail" for "General type of mail configuration".
Set "System mail name:" to its default as the FQDN (see Abschnitt 5.1.1, „Die Auflösung des Rechnernamens“).
Set "IP-addresses to listen on for incoming SMTP connections:" to its default as "127.0.0.1 ; ::1".
Unset contents of "Other destinations for which mail is accepted:".
Unset contents of "Machines to relay mail for:".
Set "IP address or host name of the outgoing smarthost:" to "smtp.hostname.dom:587".
Select "<No>" for "Hide local mail name in outgoing mail?". (Use
"/etc/email-addresses
" as in Abschnitt 6.3.3, „The mail address configuration“, instead.)
Reply to "Keep number of DNS-queries minimal (Dial-on-Demand)?" as one of the following.
"No" if the system is connected to the Internet while booting.
"Yes" if the system is not connected to the Internet while booting.
Set "Delivery method for local mail:" to "mbox format in /var/mail/".
Select "<Yes>" for "Split configuration into small files?:".
Create password entries for the smarthost by editing
"/etc/exim4/passwd.client
".
$ sudo vim /etc/exim4/passwd.client ... $ cat /etc/exim4/passwd.client ^smtp.*\.hostname\.dom:username@hostname.dom:password
Start exim4
by the following.
$ sudo /etc/init.d/exim4 start
The host name in "/etc/exim4/passwd.client
" should not be
the alias. You check the real host name with the following.
$ host smtp.hostname.dom smtp.hostname.dom is an alias for smtp99.hostname.dom. smtp99.hostname.dom has address 123.234.123.89
I use regex in "/etc/exim4/passwd.client
" to work around
the alias issue. SMTP AUTH probably works even if the ISP moves host
pointed by the alias.
You can manually updating exim4
configuration by the
following:
Update exim4
configuration files in
"/etc/exim4/
".
creating "/etc/exim4/exim4.conf.localmacros
" to set
MACROs and editing
"/etc/exim4/exim4.conf.template
". (non-split
configuration)
creating new files or editing existing files in the
"/etc/exim4/exim4.conf.d
" subdirectories. (split
configuration)
Run "invoke-rc.d exim4 reload
".
Please read the official guide at:
"/usr/share/doc/exim4-base/README.Debian.gz
" and
update-exim4.conf(8).
![]() |
Achtung |
---|---|
Starting |
![]() |
Warnung |
---|---|
It is insecure to use plain text password without encryption even if your ISP allows it. |
![]() |
Tipp |
---|---|
Although use of SMTP with STARTTLS on port 587 is recommended, some ISPs still use deprecated SMTPS (SSL on port 465). Exim4 after 4.77 supports this deprecated SMTPS protocol for both as client and as server. |
![]() |
Tipp |
---|---|
If you are looking for a light weight MTA that respects
" |
For the Internet mail via smarthost, you should first read postfix documentation and key manual pages.
Tabelle 6.5. List of important postfix manual pages
Befehl | Funktion |
---|---|
postfix(1) | Postfix control program |
postconf(1) | Postfix configuration utility |
postconf(5) | Postfix configuration parameters |
postmap(1) | Postfix lookup table maintenance |
postalias(1) | Postfix alias database maintenance |
You (re)configure postfix
and
sasl2-bin
packages as follows.
$ sudo /etc/init.d/postfix stop $ sudo dpkg-reconfigure postfix
Chose "Internet with smarthost".
Set "SMTP relay host (blank for none):" to
"[smtp.hostname.dom]:587
" and configure it by the
following.
$ sudo postconf -e 'smtp_sender_dependent_authentication = yes' $ sudo postconf -e 'smtp_sasl_auth_enable = yes' $ sudo postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd' $ sudo postconf -e 'smtp_sasl_type = cyrus' $ sudo vim /etc/postfix/sasl_passwd
Create password entries for the smarthost.
$ cat /etc/postfix/sasl_passwd [smtp.hostname.dom]:587 username:password $ sudo postmap hush:/etc/postfix/sasl_passwd
Start the postfix
by the following.
$ sudo /etc/init.d/postfix start
Here the use of "[
" and "]
" in the
dpkg-reconfigure
dialog and
"/etc/postfix/sasl_passwd
" ensures not to check MX record
but directly use exact hostname specified. See "Enabling SASL
authentication in the Postfix SMTP client" in
"/usr/share/doc/postfix/html/SASL_README.html
".
There are a few mail address configuration files for mail transport, delivery and user agents.
Tabelle 6.6. List of mail address related configuration files
Datei | Funktion | application |
---|---|---|
/etc/mailname
|
default host name for (outgoing) mail | Debian specific, mailname(5) |
/etc/email-addresses
|
host name spoofing for outgoing mail | exim(8) specific, exim4-config_files(5) |
/etc/postfix/generic
|
host name spoofing for outgoing mail | postfix(1) specific, activated after postmap(1) command execution. |
/etc/aliases
|
account name alias for incoming mail | general, activated after newaliases(1) command execution. |
The mailname in the
"/etc/mailname
" file is usually a fully qualified domain
name (FQDN) that resolves to one of the host's IP addresses. For the mobile
workstation which does not have a hostname with resolvable IP address, set
this mailname to the value of
"hostname -f
". (This is safe choice and works for both
exim4-*
and postfix
.)
![]() |
Tipp |
---|---|
The contents of " |
![]() |
Tipp |
---|---|
The |
When setting the mailname to
"hostname -f
", the spoofing of the source mail address
via MTA can be realized by the following.
"/etc/email-addresses
" file for
exim4(8)
as explained in the
exim4-config_files(5)
"/etc/postfix/generic
" file for
postfix(1)
as explained in the
generic(5)
For postfix
, the following extra steps are needed.
# postmap hash:/etc/postfix/generic # postconf -e 'smtp_generic_maps = hash:/etc/postfix/generic' # postfix reload
You can test mail address configuration using the following.
exim(8)
with -brw, -bf, -bF, -bV, …
options
postmap(1)
with -q
option.
![]() |
Tipp |
---|---|
Exim comes with several utility programs such as
exiqgrep(8)
and
exipick(8).
See " |
There are several basic MTA operations. Some may be performed via sendmail(1) compatibility interface.
Tabelle 6.7. List of basic MTA operation
exim command | postfix command | Beschreibung |
---|---|---|
sendmail
|
sendmail
|
read mails from standard input and arrange for delivery
(-bm )
|
mailq
|
mailq
|
list the mail queue with status and queue ID (-bp )
|
newaliases
|
newaliases
|
initialize alias database (-I )
|
exim4 -q
|
postqueue -f
|
flush waiting mails (-q )
|
exim4 -qf
|
postsuper -r ALL deferred; postqueue -f
|
flush all mails |
exim4 -qff
|
postsuper -r ALL; postqueue -f
|
flush even frozen mails |
exim4 -Mg queue_id
|
postsuper -h queue_id
|
freeze one message by its queue ID |
exim4 -Mrm queue_id
|
postsuper -d queue_id
|
remove one message by its queue ID |
Nicht verfügbar |
postsuper -d ALL
|
remove all messages |
![]() |
Tipp |
---|---|
It may be a good idea to flush all mails by a script in
" |
If you subscribe to Debian related mailing list, it may be a good idea to
use such MUA as mutt
and mew
which are
the de facto standard for the participant and known to behave as expected.
Tabelle 6.8. List of mail user agent (MUA)
Paket | Popcon | Größe | Art |
---|---|---|---|
evolution
|
V:74, I:401 | 453 | X GUI program (GNOME3, groupware suite) |
icedove
|
V:65, I:127 | 46144 | X GUI program (GNOME2, unbranded Mozilla Thunderbird) |
kmail
|
V:24, I:90 | 5296 | X GUI program (KDE) |
mutt
|
V:194, I:879 | 5757 |
character terminal program probably used with vim
|
mew
|
V:0, I:0 | 2346 |
character terminal program under (x)emacs
|
Customize "~/.muttrc
" as the following to use
mutt
as the mail user agent (MUA) in combination with
vim
.
# # User configuration file to override /etc/Muttrc # # spoof source mail address set use_from set hostname=example.dom set from="Name Surname <username@example.dom>" set signature="~/.signature" # vim: "gq" to reformat quotes set editor="vim -c 'set tw=72 et ft=mail'" # "mutt" goes to Inbox, while "mutt -y" lists mailboxes set mbox_type=Maildir # use qmail Maildir format for creating mbox set mbox=~/Mail # keep all mail boxes in $HOME/Mail/ set spoolfile=+Inbox # mail delivered to $HOME/Mail/Inbox set record=+Outbox # save fcc mail to $HOME/Mail/Outbox set postponed=+Postponed # keep postponed in $HOME/Mail/postponed set move=no # do not move Inbox items to mbox set quit=ask-yes # do not quit by "q" only set delete=yes # always delete w/o asking while exiting set fcc_clear # store fcc as non encrypted # Mailboxes in Maildir (automatic update) mailboxes `cd ~/Mail; /bin/ls -1|sed -e 's/^/+/' | tr "\n" " "` unmailboxes Maillog *.ev-summary ## Default #set index_format="%4C %Z %{%b %d} %-15.15L (%4l) %s" ## Thread index with senders (collapse) set index_format="%4C %Z %{%b %d} %-15.15n %?M?(#%03M)&(%4l)? %s" ## Default #set folder_format="%2C %t %N %F %2l %-8.8u %-8.8g %8s %d %f" ## just folder names set folder_format="%2C %t %N %f"
Add the following to "/etc/mailcap
" or
"~/.mailcap
" to display HTML mail and MS Word attachments
inline.
text/html; lynx -force_html %s; needsterminal; application/msword; /usr/bin/antiword '%s'; copiousoutput; description="Microsoft Word Text"; nametemplate=%s.doc
![]() |
Tipp |
---|---|
Mutt can be used as the IMAP client and the
mailbox format converter. You can tag messages with " |
Although
fetchmail(1)
has been de facto standard for the remote mail retrieval on GNU/Linux, the
author likes
getmail(1)
now. If you want to reject mail before downloading to save bandwidth,
mailfilter
or mpop
may be useful.
Whichever mail retriever utilities are used, it is a good idea to configure
system to deliver retrieved mails to MDA, such as
maildrop
, via pipe.
Tabelle 6.9. List of remote mail retrieval and forward utilities
Paket | Popcon | Größe | Beschreibung |
---|---|---|---|
fetchmail
|
V:12, I:32 | 2568 | mail retriever (POP3, APOP, IMAP) (old) |
getmail4
|
V:2, I:12 | 585 | mail retriever (POP3, IMAP4, and SDPS) (simple, secure, and reliable) |
mailfilter
|
V:0, I:0 | 270 | mail retriever (POP3) with with regex filtering capability |
mpop
|
V:0, I:0 | 275 | mail retriever (POP3) and MDA with filtering capability |
getmail(1) configuration is described in getmail documentation. Here is my set up to access multiple POP3 accounts as user.
Create "/usr/local/bin/getmails
" as the following.
#!/bin/sh set -e if [ -f $HOME/.getmail/running ]; then echo "getmail is already running ... (if not, remove $HOME/.getmail/running)" >&2 pgrep -l "getmai[l]" exit 1 else echo "getmail has not been running ... " >&2 fi if [ -f $HOME/.getmail/stop ]; then echo "do not run getmail ... (if not, remove $HOME/.getmail/stop)" >&2 exit fi if [ "x$1" = "x-l" ]; then exit fi rcfiles="/usr/bin/getmail" for file in $HOME/.getmail/config/* ; do rcfiles="$rcfiles --rcfile $file" done date -u > $HOME/.getmail/running eval "$rcfiles $@" rm $HOME/.getmail/running
Configure it as the following.
$ sudo chmod 755 /usr/local/bin/getmails $ mkdir -m 0700 $HOME/.getmail $ mkdir -m 0700 $HOME/.getmail/config $ mkdir -m 0700 $HOME/.getmail/log
Create configuration files
"$HOME/.getmail/config/pop3_name
" for each POP3 accounts
as the following.
[retriever] type = SimplePOP3SSLRetriever server = pop.example.com username = pop3_name@example.com password = secret [destination] type = MDA_external path = /usr/bin/maildrop unixfrom = True [options] verbose = 0 delete = True delivered_to = False message_log = ~/.getmail/log/pop3_name.log
Configure it as the following.
$ chmod 0600 $HOME/.getmail/config/*
Schedule "/usr/local/bin/getmails
" to run every 15
minutes with
cron(8)
by executing "sudo crontab -e -u <user_name>
" and
adding following to user's cron entry.
5,20,35,50 * * * * /usr/local/bin/getmails --quiet
![]() |
Tipp |
---|---|
Problems of POP3 access may not come from |
Most MTA programs, such as postfix
and
exim4
, function as MDA (mail delivery agent). There are
specialized MDA with filtering capabilities.
Although procmail(1) has been de facto standard for MDA with filter on GNU/Linux, author likes maildrop(1) now. Whichever filtering utilities are used, it is a good idea to configure system to deliver filtered mails to a qmail-style Maildir.
maildrop(1)
configuration is described in maildropfilter documentation.
Here is a configuration example for "$HOME/.mailfilter
".
# Local configuration MAILROOT="$HOME/Mail" # set this to /etc/mailname contents MAILHOST="example.dom" logfile $HOME/.maildroplog # rules are made to override the earlier value by the later one. # mailing list mails ? if ( /^Precedence:.*list/:h || /^Precedence:.*bulk/:h ) { # rules for mailing list mails # default mailbox for mails from mailing list MAILBOX="Inbox-list" # default mailbox for mails from debian.org if ( /^(Sender|Resent-From|Resent-Sender): .*debian.org/:h ) { MAILBOX="service.debian.org" } # default mailbox for mails from bugs.debian.org (BTS) if ( /^(Sender|Resent-From|Resent-sender): .*@bugs.debian.org/:h ) { MAILBOX="bugs.debian.org" } # mailbox for each properly maintained mailing list with "List-Id: foo" or "List-Id: ...<foo.bar>" if ( /^List-Id: ([^<]*<)?([^<>]*)>?/:h ) { MAILBOX="$MATCH2" } } else { # rules for non-mailing list mails # default incoming box MAILBOX="Inbox-unusual" # local mails if ( /Envelope-to: .*@$MAILHOST/:h ) { MAILBOX="Inbox-local" } # html mails (99% spams) if ( /DOCTYPE html/:b ||\ /^Content-Type: text\/html/ ) { MAILBOX="Inbox-html" } # blacklist rule for spams if ( /^X-Advertisement/:h ||\ /^Subject:.*BUSINESS PROPOSAL/:h ||\ /^Subject:.*URGENT.*ASISSTANCE/:h ||\ /^Subject: *I NEED YOUR ASSISTANCE/:h ) { MAILBOX="Inbox-trash" } # whitelist rule for normal mails if ( /^From: .*@debian.org/:h ||\ /^(Sender|Resent-From|Resent-Sender): .*debian.org/:h ||\ /^Subject: .*(debian|bug|PATCH)/:h ) { MAILBOX="Inbox" } # whiltelist rule for BTS related mails if ( /^Subject: .*Bug#.*/:h ||\ /^(To|Cc): .*@bugs.debian.org/:h ) { MAILBOX="bugs.debian.org" } # whitelist rule for getmails cron mails if ( /^Subject: Cron .*getmails/:h ) { MAILBOX="Inbox-getmails" } } # check existance of $MAILBOX `test -d $MAILROOT/$MAILBOX` if ( $RETURNCODE == 1 ) { # create maildir mailbox for $MAILBOX `maildirmake $MAILROOT/$MAILBOX` } # deliver to maildir $MAILBOX to "$MAILROOT/$MAILBOX/" exit
![]() |
Warnung |
---|---|
Unlike |
Here is a similar configuration with "$HOME/.procmailrc
"
for
procmail(1).
MAILDIR=$HOME/Maildir DEFAULT=$MAILDIR/Inbox/ LOGFILE=$MAILDIR/Maillog # clearly bad looking mails: drop them into X-trash and exit :0 * 1^0 ^X-Advertisement * 1^0 ^Subject:.*BUSINESS PROPOSAL * 1^0 ^Subject:.*URGENT.*ASISSTANCE * 1^0 ^Subject: *I NEED YOUR ASSISTANCE X-trash/ # Delivering mailinglist messages :0 * 1^0 ^Precedence:.*list * 1^0 ^Precedence:.*bulk * 1^0 ^List- * 1^0 ^X-Distribution:.*bulk { :0 * 1^0 ^Return-path:.*debian-devel-admin@debian.or.jp jp-debian-devel/ :0 * ^Resent-Sender.*debian-user-request@lists.debian.org debian-user/ :0 * ^Resent-Sender.*debian-devel-request@lists.debian.org debian-devel/ :0 * ^Resent-Sender.*debian-announce-request@lists.debian.org debian-announce :0 mailing-list/ } :0 Inbox/
You need to manually deliver mails to the sorted mailboxes in your home
directory from "/var/mail/<username>
" if your home
directory became full and
procmail(1)
failed. After making disk space in the home directory, run the following.
# /etc/init.d/${MAILDAEMON} stop # formail -s procmail </var/mail/<username> # /etc/init.d/${MAILDAEMON} start
If you are to run a private server on LAN, you may consider to run POP3 / IMAP4 server for delivering mail to LAN clients.
Tabelle 6.11. List of POP3/IMAP4 servers
Paket | Popcon | Größe | Art | Beschreibung |
---|---|---|---|---|
courier-pop
|
V:8, I:11 | 200 | POP3 | Courier mail server - POP3 server (maildir format only) |
cyrus-pop3d
|
I:0 | 21 | POP3 | Cyrus mail system (POP3 support) |
xmail
|
V:0, I:0 | 688 | POP3 | ESMTP/POP3 mail server |
courier-imap
|
V:14, I:17 | 631 | IMAP | Courier mail server - IMAP server (maildir format only) |
cyrus-imapd
|
V:0, I:0 | 21 | IMAP | Cyrus mail system (IMAP support) |
In the old Unix-like system, the BSD Line printer daemon was the standard. Since the standard print out format of the free software is PostScript on the Unix like system, some filter system was used along with Ghostscript to enable printing to the non-PostScript printer.
Recently, Common UNIX Printing System (CUPS) is the new de facto standard. The CUPS uses Internet Printing Protocol (IPP). The IPP is now supported by other OSs such as Windows XP and Mac OS X and has became new cross-platform de facto standard for remote printing with bi-directional communication capability.
The standard printable data format for the application on the Debian system is the PostScript (PS) which is a page description language. The data in PS format is fed into the Ghostscript PostScript interpreter to produce the printable data specific to the printer. See Abschnitt 11.4.1, „Ghostscript“.
Thanks to the file format dependent auto-conversion feature of the CUPS
system, simply feeding any data to the lpr
command should
generate the expected print output. (In CUPS, lpr
can be
enabled by installing the cups-bsd
package.)
The Debian system has some notable packages for the print servers and utilities.
Tabelle 6.12. List of print servers and utilities
Paket | Popcon | Größe | Port | Beschreibung |
---|---|---|---|---|
lpr
|
V:19, I:23 | 460 | printer (515) | BSD lpr/lpd (Line printer daemon) |
lprng
|
V:2, I:3 | 2769 | " | , , (Enhanced) |
cups
|
V:336, I:507 | 736 | IPP (631) | Internet Printing CUPS server |
cups-client
|
V:113, I:538 | 588 | " | System V printer commands for CUPS: lp(1), lpstat(1), lpoptions(1), cancel(1), lpmove(8), lpinfo(8), lpadmin(8), … |
cups-bsd
|
V:59, I:446 | 77 | " | BSD printer commands for CUPS: lpr(1), lpq(1), lprm(1), lpc(8) |
cups-driver-gutenprint
|
V:11, I:176 | 21 | Not applicable | printer drivers for CUPS |
![]() |
Tipp |
---|---|
You can configure CUPS system by pointing your web browser to "http://localhost:631/" . |
The Secure SHell (SSH) is the secure way to connect over the Internet. A free
version of SSH called OpenSSH is available as
openssh-client
and openssh-server
packages in Debian.
Tabelle 6.13. List of remote access server and utilities
Paket | Popcon | Größe | tool | Beschreibung |
---|---|---|---|---|
openssh-client
|
V:550, I:995 | 2357 | ssh(1) | Secure shell client |
openssh-server
|
V:634, I:796 | 747 | sshd(8) | Secure shell server |
ssh-askpass-fullscreen
|
V:0, I:1 | 24 | ssh-askpass-fullscreen(1) | asks user for a pass phrase for ssh-add (GNOME2) |
ssh-askpass
|
V:6, I:53 | 156 | ssh-askpass(1) | asks user for a pass phrase for ssh-add (plain X) |
![]() |
Achtung |
---|---|
See Abschnitt 4.7.3, „Zusätzliche Sicherheitsmaßnahmen für das Internet“ if your SSH is accessible from the Internet. |
![]() |
Tipp |
---|---|
Please use the screen(1) program to enable remote shell process to survive the interrupted connection (see Abschnitt 9.1, „The screen program“). |
![]() |
Warnung |
---|---|
" |
SSH has two authentication protocols.
Tabelle 6.14. List of SSH authentication protocols and methods
SSH protocol | SSH method | Beschreibung |
---|---|---|
SSH-1 |
"RSAAuthentication "
|
RSA identity key based user authentication |
" |
"RhostsAuthentication "
|
".rhosts " based host authentication (insecure, disabled)
|
" |
"RhostsRSAAuthentication "
|
".rhosts " based host authentication combined with RSA
host key (disabled)
|
" |
"ChallengeResponseAuthentication "
|
RSA challenge-response authentication |
" |
"PasswordAuthentication "
|
password based authentication |
SSH-2 |
"PubkeyAuthentication "
|
public key based user authentication |
" |
"HostbasedAuthentication "
|
"~/.rhosts " or "/etc/hosts.equiv "
based host authentication combined with public key client host
authentication (disabled)
|
" |
"ChallengeResponseAuthentication "
|
challenge-response authentication |
" |
"PasswordAuthentication "
|
password based authentication |
![]() |
Achtung |
---|---|
Be careful about these differences if you are using a non-Debian system. |
See "/usr/share/doc/ssh/README.Debian.gz
",
ssh(1),
sshd(8),
ssh-agent(1),
and
ssh-keygen(1)
for details.
Following are the key configuration files.
Tabelle 6.15. List of SSH configuration files
Konfigurationsdatei | description of configuration file |
---|---|
/etc/ssh/ssh_config
|
SSH client defaults, see ssh_config(5) |
/etc/ssh/sshd_config
|
SSH server defaults, see sshd_config(5) |
~/.ssh/authorized_keys
|
default public SSH keys that clients use to connect to this account on this SSH server |
~/.ssh/identity
|
secret SSH-1 RSA key of the user |
~/.ssh/id_rsa
|
secret SSH-2 RSA key of the user |
~/.ssh/id_dsa
|
secret SSH-2 DSA key of the user |
![]() |
Tipp |
---|---|
See ssh-keygen(1), ssh-add(1) and ssh-agent(1) for how to use public and secret SSH keys. |
![]() |
Tipp |
---|---|
Make sure to verify settings by testing the connection. In case of any
problem, use " |
![]() |
Tipp |
---|---|
You can change the pass phrase to encrypt local secret SSH keys later with
" |
![]() |
Tipp |
---|---|
You can add options to the entries in
" |
The following starts an ssh(1) connection from a client.
Tabelle 6.16. List of SSH client startup examples
Befehl | Beschreibung |
---|---|
ssh username@hostname.domain.ext
|
connect with default mode |
ssh -v username@hostname.domain.ext
|
connect with default mode with debugging messages |
ssh -1 username@hostname.domain.ext
|
force to connect with SSH version 1 |
ssh -1 -o RSAAuthentication=no -l username
hostname.domain.ext
|
force to use password with SSH version 1 |
ssh -o PreferredAuthentications=password -l username
hostname.domain.ext
|
force to use password with SSH version 2 |
If you use the same user name on the local and the remote host, you can
eliminate typing "username@
". Even if you use different
user name on the local and the remote host, you can eliminate it using
"~/.ssh/config
". For Debian Alioth service with account name
"foo-guest
", you set "~/.ssh/config
"
to contain the following.
Host alioth.debian.org svn.debian.org git.debian.org User foo-guest
For the user,
ssh(1)
functions as a smarter and more secure
telnet(1).
Unlike telnet
command, ssh
command
does not bomb on the telnet
escape character (initial
default CTRL-]).
To establish a pipe to connect to port 25 of
remote-server
from port 4025 of
localhost
, and to port 110 of
remote-server
from port 4110 of
localhost
through ssh
, execute on the
local host as the following.
# ssh -q -L 4025:remote-server:25 4110:remote-server:110 username@remote-server
This is a secure way to make connections to SMTP/POP3 servers over the
Internet. Set the "AllowTcpForwarding
" entry to
"yes
" in "/etc/ssh/sshd_config
" of the
remote host.
One can avoid having to remember passwords for remote systems by using
"RSAAuthentication
" (SSH-1 protocol) or
"PubkeyAuthentication
" (SSH-2 protocol).
On the remote system, set the respective entries,
"RSAAuthentication yes
" or "PubkeyAuthentication
yes
", in "/etc/ssh/sshd_config
".
Generate authentication keys locally and install the public key on the remote system by the following.
"RSAAuthentication
": RSA key for SSH-1 (deprecated
because it is superseded.)
$ ssh-keygen $ cat .ssh/identity.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
"PubkeyAuthentication
": RSA key for SSH-2
$ ssh-keygen -t rsa $ cat .ssh/id_rsa.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
"PubkeyAuthentication
": DSA key for SSH-2 (deprecated
because it is slow.)
$ ssh-keygen -t dsa $ cat .ssh/id_dsa.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
![]() |
Tipp |
---|---|
Use of DSA key for SSH-2 is deprecated because key is smaller and slow. There are no more reasons to work around RSA patent using DSA since it has been expired. DSA stands for Digital Signature Algorithm and slow. Also see DSA-1571-1. |
![]() |
Anmerkung |
---|---|
For " |
There are some free SSH clients available for other platforms.
Tabelle 6.17. List of free SSH clients for other platforms
environment | free SSH program |
---|---|
Windows | puTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/) (GPL) |
Windows (cygwin) | SSH in cygwin (http://www.cygwin.com/) (GPL) |
Macintosh Classic | macSSH (http://www.macssh.com/) (GPL) |
Mac OS X |
OpenSSH; use ssh in the Terminal application (GPL)
|
It is safer to protect your SSH authentication secret keys with a pass
phrase. If a pass phrase was not set, use "ssh-keygen
-p
" to set it.
Place your public SSH key (e.g. "~/.ssh/id_rsa.pub
")
into "~/.ssh/authorized_keys
" on a remote host using a
password-based connection to the remote host as described above.
$ ssh-agent bash $ ssh-add ~/.ssh/id_rsa Enter passphrase for /home/<username>/.ssh/id_rsa: Identity added: /home/<username>/.ssh/id_rsa (/home/<username>/.ssh/id_rsa)
No remote password needed from here on for the next command.
$ scp foo <username>@remote.host:foo
Press ^D to terminating ssh-agent session.
For the X server, the normal Debian startup script executes
ssh-agent
as the parent process. So you only need to
execute ssh-add
once. For more, read
ssh-agent(1)and
ssh-add(1).
You need to protect the process doing "shutdown -h now
"
(see Abschnitt 1.1.8, „Wie Sie das System herunterfahren“) from the termination of
SSH using the
at(1)
command (see Abschnitt 9.3.13, „Scheduling tasks once“) by the following.
# echo "shutdown -h now" | at now
Running "shutdown -h now
" in
screen(1)
(see Abschnitt 9.1, „The screen program“) session is another way to do the
same.
If you have problems, check the permissions of configuration files and run
ssh
with the "-v
" option.
Use the "-P
" option if you are root and have trouble with
a firewall; this avoids the use of server ports 1 — 1023.
If ssh
connections to a remote site suddenly stop
working, it may be the result of tinkering by the sysadmin, most likely a
change in "host_key
" during system maintenance. After
making sure this is the case and nobody is trying to fake the remote host by
some clever hack, one can regain a connection by removing the
"host_key
" entry from
"~/.ssh/known_hosts
" on the local host.
Here are other network application servers.
Tabelle 6.18. List of other network application servers
Paket | Popcon | Größe | protocol | Beschreibung |
---|---|---|---|---|
telnetd
|
V:1, I:5 | 156 | TELNET | TELNET server |
telnetd-ssl
|
V:0, I:1 | 220 | " | , , (SSL support) |
nfs-kernel-server
|
V:78, I:180 | 502 | NFS | Unix file sharing |
samba
|
V:155, I:247 | 9659 | SMB | Windows file and printer sharing |
netatalk
|
V:8, I:19 | 3763 | ATP | Apple/Mac file and printer sharing (AppleTalk) |
proftpd-basic
|
V:42, I:53 | 4431 | FTP | General file download |
apache2-mpm-prefork
|
V:268, I:303 | 22 | HTTP | General web server |
apache2-mpm-worker
|
V:73, I:95 | 22 | " | " |
squid
|
V:31, I:36 | 1869 | " | General web proxy server |
squid3
|
V:15, I:18 | 5848 | " | " |
slpd
|
V:0, I:1 | 183 | SLP | OpenSLP Server as LDAP server |
bind9
|
V:73, I:135 | 774 | DNS | IP address for other hosts |
isc-dhcp-server
|
V:32, I:60 | 2027 | DHCP | IP address of client itself |
Common Internet File System Protocol (CIFS) is the same protocol as Server Message Block (SMB) and is used widely by Microsoft Windows.
![]() |
Tipp |
---|---|
See Abschnitt 4.5.2, „Modernes zentralisiertes Systemmanagement“ for integration of server systems. |
![]() |
Tipp |
---|---|
The hostname resolution is usually provided by the DNS server. For the host IP address dynamically
assigned by DHCP, Dynamic DNS can be set up for the hostname
resolution using |
![]() |
Tipp |
---|---|
Use of proxy server such as |
Here are other network application clients.
Tabelle 6.19. List of network application clients
Paket | Popcon | Größe | protocol | Beschreibung |
---|---|---|---|---|
netcat
|
I:74 | 32 | TCP/IP | TCP/IP swiss army knife |
openssl
|
V:754, I:981 | 1077 | SSL | Secure Socket Layer (SSL) binary and related cryptographic tools |
stunnel4
|
V:5, I:22 | 461 | " | universal SSL Wrapper |
telnet
|
V:100, I:914 | 200 | TELNET | TELNET client |
telnet-ssl
|
V:1, I:11 | 260 | " | , , (SSL support) |
nfs-common
|
V:485, I:852 | 685 | NFS | Unix file sharing |
smbclient
|
V:60, I:541 | 828 | SMB | MS Windows file and printer sharing client |
cifs-utils
|
V:40, I:189 | 254 | " | mount and umount commands for remote MS Windows file |
ftp
|
V:68, I:882 | 144 | FTP | FTP client |
lftp
|
V:8, I:50 | 1782 | " | " |
ncftp
|
V:7, I:43 | 1233 | " | full screen FTP client |
wget
|
V:328, I:999 | 2324 | HTTP and FTP | web downloader |
curl
|
V:76, I:309 | 304 | " | " |
axel
|
V:1, I:6 | 212 | " | accelerated downloader |
aria2
|
V:1, I:8 | 4358 | " | accelerated downloader with BitTorrent and Metalink supports |
bind9-host
|
V:473, I:952 | 138 | DNS | host(1)
from bind9, "Priority: standard "
|
dnsutils
|
V:116, I:930 | 333 | " | dig(1)
from bind, "Priority: standard "
|
isc-dhcp-client
|
V:495, I:893 | 1765 | DHCP | obtain IP address |
ldap-utils
|
V:14, I:70 | 671 | LDAP | obtain data from LDAP server |
The telnet
program enables manual connection to the
system daemons and its diagnosis.
For testing plain POP3 service, try the following
$ telnet mail.ispname.net pop3
For testing the TLS/SSL enabled POP3 service by some ISPs, you need TLS/SSL enabled
telnet
client by the telnet-ssl
or
openssl
packages.
$ telnet -z ssl pop.gmail.com 995
$ openssl s_client -connect pop.gmail.com:995
The following RFCs provide required knowledge to each system daemon.
The port usage is described in "/etc/services
".