We've improved iRedAdmin-Pro so that you can add external user as mail list member. Add external user as mail list moderator will come soon.

As you may know, we added a new feature in LDAP solution: per-user Shadow Address.

Shadow address, hmm, a little confused. In Google App, it is called Nickname.

What does it used for?

User can have as many mail addresses as he want. He can use POP3/IMAP/SMTP services with either mail address with same password, and all mails sent to these addresses will be delivered to the same mailbox.

Let me explain the LDIF structure first:

For user www@example.com:

dn: mail=www@example.com,ou=Users,domainName=example.com,XXX
mail: www@example.com
shadowAddress: user01@example.com
shadowAddress: user02@example.com
shadowAddress: user03@example.com
userPassword: {SSHA}xxxxxxxx
storageBaseDirectory: /var/vmail/vmail01
mailMessageStore: example.com/w/ww/www/www-2009.08.26.11.16.25/

Vulnerability description

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

References

• http://web.nvd.nist.gov/view/vuln/detai … -2010-0464

• http://trac.roundcube.net/changeset/3293

Affected iRedMail versions

• iRedMail-0.4.0 (Roundcube-0.2-stable)

• iRedMail-0.5.0 (Roundcube-0.2.1)

• iRedMail-0.5.1 (Roundcube-0.2.1)

Steps to fix it

• Please confirm you are using Roundcube-0.2-stable, 0.2.1, 0.2.2 before we go further.

• Download patch for roundcube-0.2-stable,  0.2.1:

# cd /root
# wget http://iredmail.googlecode.com/hg/extra/patches/roundcube/roundcube-CVE-2010-0464.patch

• Change current directory to roundcube installation directory and use patch command with '--dry-run' option to test patch.  If command output doesn't show succeeded, please do NOT try further steps, and post a new topic in this forum.

# ---- RHEL/CentOS ----
# cd /var/www/roundcubemail/

# ---- Debian/Ubuntu ----
# cd /usr/share/apache2/roundcubemail/

# ---- Test the patch ----
# patch --dry-run -p0 < /root/roundcube-CVE-2010-0464.patch
patching file program/include/rcube_shared.inc
patching file program/steps/mail/get.inc
Hunk #1 succeeded at 43 (offset 1 line).
Hunk #2 succeeded at 59 (offset -9 lines).

• Patch it

# patch -p0 < /root/roundcube-CVE-2010-0464.patch

• (This step is NOT required but is recommended.) Restart Apache web server to make it work.

# ---- On RHEL/CentOS ----
# /etc/init.d/httpd restart

# ---- On Debian/Ubuntu ----
# /etc/init.d/apache2 restart

iRedMail-0.6.0-beta3 is available for testing (and here is 0.6.0-beta1 release note), download now:

• Download: http://code.google.com/p/iredmail/downloads/list

Major changes since 0.6.0-beta1:

• Better support for FreeBSD 7.2 & 8.0 -release with the newest ports tree, supports both i386 & x86_64/amd64. Here is installation guide.

• Use yum to install packages on RHEL/CentOS, not necessary to download all binary packages now.

• Software update:
  

  • phpLDAPadmin -> 1.2.0.5

  • iRedAPD -> 1.2.1 (Postfix policy daemon, used to restrict mail list access.)

  • iRedAdmin (Open Source Edition) -> 0.1.2 (No new features, but new translations)

Note: This is a beta version, it's NOT recommended for product use.

iRedAPD-1.2.3 is available for download now.

• Download: http://www.iredmail.org/download.html#iredapd

• Installation Guide: http://www.iredmail.org/iredapd_installation.html

This is a rewritten version, it now supports plugins.

There're two plugins available now:

• maillist_access_policy: Mail list access policy management. Enabled by default.

• block_amavisd_blacklisted_senders: Block blacklisted senders which defined in amavisd related LDAP attributes. This is a sample plugin, but it works as expected.

Summary

iRedAPD is designed to work in conjunction with Postfix as an Access Policy Delegation daemon, with plugin support. Currently, it works with only OpenLDAP, but is easy to make it support MySQL with plugins.

Requirements

• iRedMail >= 0.5.0, OpenLDAP backend.

• Python >= 2.4, core programming language.

• Python-LDAP >= 2.3.7. An object-oriented API to access LDAP directory servers from Python programs.

Available access policy levels
There're four default policy rules for mail list:

• Public. Email is unrestricted, which means everyone can mail to this mail list.

• Domain Wide. Email is restricted to users under same domain.

• Members. Email is restricted to list members only.

• Announcement. Email is restricted to moderators only.

Demo is available in our demo site: http://www.iredmail.org/admin_demo.html
Note:

• Please choose 'iRedAdmin Full-Featured Edition (Development version)'.

• Domain 'demo.iredmail.org' has correct MX setting, you can use it to test mail list restrictions.

Screenshots:

Manage mail list access policy level:

Manage mail list members:

Manage mail list moderators:

iRedAdmin-Pro-1.1.0 released.

• Users purchased before will received an email which contains source code for upgrading. Here is upgrade tutorial (Need privilege to access our private forum).

• New users can purchase it at $99 per server.

We want to hear from you, feedback is the key to our serving you and to our making this admin panel better. Reply this topic or mail us.

Major changes since iRedAdmin-1.0.2

• Fixed: Don't allow to add invalid domain name (top-level domain name longer than 4 characters).

• New: Ability to set per-domain and per-user relay settings. Screenshot, Screenshot

• New: Ability to manage mail list access policy level and moderators. Screenshot

• New: Log most of admin operations in SQL database and allow to view log filtered by event type, domain name, admin name. Screenshot

• New: It now will check new version after Global Admin login success. Screenshot

• New: Allow to switch language in login page. Screenshot

• New: Ability to manage per-domain disclaimer. Screenshot

• New: Ability to change user maildir. Screenshot

• New: Starting amavisd-new integration. Add 'objectClass=amavisAccount' in mail user by default.

• New translations:
  

  • de_DE (Deutsch) in work. Thanks Bronko (caparcona <at> web.de).

  • hu_HU (Hungarian). Thanks zolikusz@gmail.

  • zh_TW translation. Converted from zh_CN directly.

  • es_ES translation. Thanks yrjc2004@gmail.

TODO list in iRedAdmin-1.2.0

Below is MUST implemented features, of course we will add other cool new features in v1.2.0. Don't forget to feedback.

• Ability to add external email addresses as mail list member or moderator.

• Aassign new user to a specified mail list automatically. This will be a per-domain setting, each domain can specify its own 'all@' mail address.

As you may know, iRedAdmin-1.1.0 is coming, and we need your help to translate it, so that you can use iRedAdmin in your local language.

PO file is available for download here: http://iredmail.googlecode.com/hg/extra/iredadmin-i18n/

You need to translate items in iredadmin-i18n/iredmail.po for a new language, or edit exist PO files to update them. Save them in UTF-8 and mail them to me (michaelbibby <at> gmail.com).

Big thanks for your contribution.

Just want to let you know, iRedAPD now supports plugins.

• Related code changeset: http://code.google.com/p/iredmail/sourc … po=iredapd

There're two plugins available now:

• maillist_access_policy: Mail list access policy management. Enabled by default.

• block_amavisd_blacklisted_senders: Block blacklisted senders which defined in amavisd related LDAP attributes. This is a sample plugin, but it works as expected.

Try to read python source code of these two plugins, and then you will find that it's easy to write a plugin for iRedAPD.

Enjoy

Abstract:
- There will be a file permission error if you enable below crontab job (it's disabled by default) of vmail user:

#1   5   *   *   *   find /var/virusmails -ctime +30 | xargs rm -rf {}

We'd like to thank jbou for his report.

Affected versions:

- iRedMail-0.5.1
- iRedMail-0.5.0
- iRedOS-0.5.0

Steps to fix it:

• Add same cron job of amavis user.

# ---- Run below command in terminal ----
# sudo crontab -e -u amavis

# ---- RHEL/CentOS ----
1   5   *   *   *   find /var/virusmails -ctime +30 | xargs rm -rf {}

# ---- Debian/Ubuntu ----
1   5   *   *   *   find /var/lib/amavis/virusmails -ctime +30 | xargs rm -rf {}

If you don't want to enable it, just prepend '#' in this line to comment it.

• Comment out or delete this cron job of vmail user.

# ---- Run below command in terminal ----
# sudo crontab -e -u vmail

Just want to let you know, we can VIEW status of mail related services in iRedAdmin now.
But no plan to control (start/stop/restart) these services in iRedAdmin yet. What's your opinion? Please let me know.

-----
Update:
- 2009-12-31: This feature is disabled now, because Debian/Ubuntu's RC scripts don't support 'status'.
-----

Screenshot:

================= UPDATE ==================

- 2010-01-11 ClamAV fixed this issue in clamav database, so running 'freshclam' to update clamav database should
             fix this issue too. But it's still strong recommend to update ClamAV to the lastest version.
- 2010-01-09 Fix incorrect apt-get command. Sorry :(

Hi, all.

As you may already met, ClamAV will mark most of mails which composed in HTML format as 'Exploit.PDF-9669' virus, this is an issue in ClamAV old version, it can be solved by update ClamAV to the lastest 0.95.3 version. So we suggest you update it AS SOON AS POSSIBLE.

All RHEL/CentOS users can update it via below command with iRedMail yum repository:

# yum update clamav clamav-db clamd

Debian/Ubuntu users can update it via apt-get (if no new version available, please push the package maintainers):

# apt-get update
# apt-get upgrade clamav-freshclam clamav-daemon

Big thanks to forum user hoho for his remind

iRedAPD-1.1 is available for download now.

• Download: http://www.iredmail.org/download.html#iredapd

• Installation Guide: http://www.iredmail.org/iredapd_installation.html

This is a bug fix version, and i've deployed it on a product server, works as expected.

Major changes since v1.0:

    - Fixed: return moderator list instead of the first one.
    - Fixed: remove accountStatus and enabledService in filter.
      mail list doesn't use it.
    - LDAP related attribute names and filters are now configureable.

Summary

iRedAPD is a mailing list access manager which uses LDAP to check for user's rights to post messages to mail list. It's designed to work in conjunction with Postfix as an Access Policy Delegation daemon.

Requirements

• iRedMail >= 0.5.0, OpenLDAP backend.

• Python >= 2.4, core programming language.

• Python-LDAP >= 2.3.7. An object-oriented API to access LDAP directory servers from Python programs.

Available access policy levels
There're four default policy rules for mail list:

• Public. Email is unrestricted, which means everyone can mail to this mail list.

• Domain Wide. Email is restricted to users under same domain.

• Members. Email is restricted to list members only.

• Announcement. Email is restricted to moderators only.

Demo is available in our demo site: http://www.iredmail.org/admin_demo.html
Note:

• Please choose 'iRedAdmin Full-Featured Edition (Development version)'.

• Domain 'demo.iredmail.org' has correct MX setting, you can use it to test mail list restrictions.

Screenshots:

Manage mail list access policy level:

Manage mail list members:

Manage mail list moderators:

iRedMail-0.6.0-beta1 is available for testing, download now:

• Download: http://code.google.com/p/iredmail/downloads/list

Major changes since 0.5.1 stable release:

• Works on FreeBSD 7.2 & 8.0 -release now, supports both i386 & x86_64/amd64. Here is installation guide.

• Domain alias support in MySQL backend.

• Software update:
  

  • Dovecot -> 1.1.20

  • PostfixAdmin -> 2.3, supports domain alias.

  • phpMyAdmin -> 2.11.9.6

  • Roundcube webmail -> 0.3.1. Plus managesieve, change password plugins.

  • ClamAV -> 0.95.3

Note: This is a beta version, it's NOT recommended for product use.

As we promised, iRedAPD-1.0 released now.

• Download: http://www.iredmail.org/download.html#iredapd

• Installation Guide: http://www.iredmail.org/iredapd_installation.html

Summary

iRedAPD is a mailing list access manager which uses LDAP to check for user's rights to post messages to mail list. It's designed to work in conjunction with Postfix as an Access Policy Delegation daemon.

Requirements

• iRedMail >= 0.5.0, OpenLDAP backend.

• Python >= 2.4, core programming language.

• Python-LDAP >= 2.3.7. An object-oriented API to access LDAP directory servers from Python programs.

Available access policy levels
There're four default policy rules for mail list:

• Public. Email is unrestricted, which means everyone can mail to this mail list.

• Domain Wide. Email is restricted to users under same domain.

• Members. Email is restricted to list members only.

• Announcement. Email is restricted to moderators only.

Demo is available in our demo site: http://www.iredmail.org/admin_demo.html
Note:

• Please choose 'iRedAdmin Full-Featured Edition (Development version)'.

• Domain 'demo.iredmail.org' has correct MX setting, you can use it to test mail list restrictions.

Screenshots:

Manage mail list access policy level:

Manage mail list members:

Manage mail list moderators:

Today (2009-11-01) is iRedMail birthday, it's 2 years old.

And I'm pround to announce that iRedMail-0.5.1 is available for download now.

We hope iRedMail users can donate us or buy iRedAdmin for LDAP backend to support
iRedMail project, make it continue exist and keep moving.

• Download iRedMail: http://code.google.com/p/iredmail/downloads/list

• iRedAdmin - the official web-based admin panel - is available for purchase and download too: http://www.iredmail.org/forum/topic380.html

• Upgrade tutorial is available too: http://www.iredmail.org/upgrade_050_051.html

• iRedOS-0.5.1 will be available for download later.

Major changes since 0.5.0:

Fixed issues

• Fix per-user sieve setting in dovecot. Thanks Emidio Reggiani and Caliban @forum.

• Fix incorrect postfix setting which will cause mail forwarding and bcc invalid after upgrade to 2.5.

• Fix incorrect syslog setting on Ubuntu 8.04 with OpenLDAP backend.

• Add missing pkg: altermime for RHEL/CentOS (i386). Thanks to sdaniel@bbs.

• Add missing service control in postfix ldap lookup table.

For more detail, please refer to hotfix page:
- http://www.iredmail.org/hotfix-050.html

New features

• iRedAdmin integration (v0.1.1). It's easy to have yet another web-based admin panel now, optional component.

• Add domain alias support with new ldap attribute: domainAliasName.

• Ability to restrict POP3S & IMAPS now.

• Add script (tools/clear_iredmail.sh) to remove main components installed by iRedMail.

• Add per-user shadow address support in LDAP backend, and it's allowed to login with shadow address.

• Add external user support in build-in mail list, LDAP backend only.

Improvements

• Performance improvement. Use postfix proxymap(8) to reduce server load under high load.

• Increase ldap server-side sizelimit to 1000.

• Enable mod_deflate in apache by default.

• Remove three dialog pages in installation wizard. Installation is easier and more clear now.

• Use random password for ldap admin dn: cn=vmailadmin.

• Allow to use multiple identities.

• Make iRedMail easier to be deployed on VPS without acl package.

Packages update/remove

• Update dovecot to 1.1.19 on RHEL/CentOS.

• Update dovecot to 1.1.16 on Debian 5, patched to fix security holes in CMU Sieve plugin. Reference: http://marc.info/?l=dovecot&m=12528 … 79&w=2 Thanks to lidaobing@gmail for binary package.

• Update postfix to 2.5.9.

• Remove php-eaccelerator. it will abort installation process when php-5.2+ already installed.