A private BSD laboratory

I must admit that I’m going to be convinced to rebuild all my front-end SMTP servers with FreeBSD systems running Sendmail, because of some important features still missing even in the ‘SMTP Transport’ role of the new Exchange Server 2007… 🙁  I already have such a system running in my corporate production environment, running as my secondary mail exchanger system, but before completing the migration to the BSD platform I would like to accomplish some additional steps.

One of the most relevant requirements is the ability to check the RCPT TO data and verify that the recipient is actually existing and active in every back-end Exchange organization, so I have spent some time to rebuild the RcptFilter solution, as I explained in the post before. Since then, I realized that to have the access file rebuild process running on each mail server is not just the best way to sync the GAL with Sendmail, since I should allow each mail server (both internal and Internet systems) to access all the Domain Controllers via LDAP, in order to let them obtain the global address list from the Exchange organization which rely on Active Directory Services to store its data.

Thus I decided to centralize the access file rebuild process, by scheduling the perl scripts execution onto the Windows Server 2003 R2 system built to be used by our IT Services group for their administrative, monitoring and management tasks. After the access file is rebuilt (everyday at the 12:00 AM), it is compressed and published on a web server to be accessible to all my FreeBSD systems, which simply have to fetch and unpack it, then to rebuild the access.db file and restart the Sendmail daemon.

So my centralized RcptFilter system is ready to run, now I only wish to bind a virus scanning engine to Sendamil before making it my first and unique SMTP Internet relay system!

The backup SMTP server for my public domains are running on a FreeBSD platform (it is a Sendmail daemon). Since its unique function is to relay messages to authoritative Exchange servers, it has no connection with the directory service maintaining information about active mailboxes, therefore it cannot understand if a recipient address of a message is to be managed as a valid address, even if it is sent to one of my public e-mail domains.
Obviously this behavior has always been causing the generation of many NDRs (Non-Delivery Receipts), because of the large amount of messages sent by spammers to invalid SMTP addresses. Furthermore, several NDRs cannot be delivered because also the sender SMTP address is often crafted, so generating a painful message flow and queue growth.

Since I have no time to spend in administering my Unix servers, after I tried to make Sendmail able to lookup the Active Directory at each “rcpt to” submission I took off, because it was a solution too expensive to fit my needs until some days ago, when I found a great message posted by someone who was experiencing the same concerns about the NDR message flow.

The solution is essentially build onto some perl scripts which compose the active recipient list by querying the Active Directory. Then they compile the “access” file needed by sendmail to build the relay control database “access.db”, by reading also the information contained in the “relay-domains” file under the /etc/mail directory.
I had only to write a shell script to unify all the operations (query the LDAP server, build the access and the access.db files, reload Sendmail daemon) and my Sendmail is fnally able to know if the “Rcpt to” field is a fake or valid SMTP address, without any complex MTA code change!

On the last week-end I decommissioned the Development local area network by migrating the sole machine still working in it to the Phoibos DMZ network, which is now reacheable from the Internet with an high available topology (as explained in the post “Behind an ISA 2006 Array“).

The same BSD installation is still publishing the free Phoibos weblogs collection, empowered by FreeBSD 6.1, Apache 2.2, PHP 5.6, MySQL 5.0 and WordPress 2.0… you are welcome to request your free blog activation!

The new free blogging service, published in the context of the Phoibos project, is based on a FreeBSD system, running in my corporate production network enviroment. Here is a screenshot of the console of this virtual guest machine, showing you the firsts databases containing the posts submitted by hosted users.

The experimental use of WordPress in this free hosting service will allow us to better understand the value of the services which can be empowered by this open source platform.