Two Postfix Instances in One Server

Actually this was required to me to configure a server

• to work as a mail relay for my domain say chamara.xy (External people/mail servers should send emails to someone@chamara.xy to this server)
• to work as the submission server for my clients (someone@chamara.xy should send mail to any outside domain after authenticated by the server)

There are several mechanisms to implement this and following given are some important references;
http://www.postfix.org/MULTI_INSTANCE_README.html
http://www.howtoforge.com/forums/showthread.php?t=4788

When I reading the details I found following link (http://linuxpoison.blogspot.com/2008/02/howto-make-two-instance-of-postfix.html) which was quite easy and interesting. I configured the server referring the above document. The steps I followed is as given below;

Consider the main instance of Postfix is having its configurations in /etc/postfix

• Copy the /etc/postfix directory and all files to another directory (Say /etc/postfix_smtp)
• Change the parameters in the /etc/postfix_smtp/main.cf according to the new instance of the postfix

Here the spool folder should be different and should be created.
The document says Each instance of Postfix must have it's own mail spool directory.
To avoid file conflicts, the default directory /var/spool/postfix must not be shared among instances.

• Edit the master.cf file in /etc/postfix-smtp and enable it to run on port 25

smtp inet n - n - - smtpd

• Edit the master.cf in /etc/postfix and enable the submission port for the smtpd daemon

submission inet n - n - - smtpd

• Edit the file /etc/postfix/main.cf and add the following near the bottom of the file:

alternate_config_directories = /etc/postfix-smtp

The above setting is required to inform the Postfix daemons about the second instance

Now you have 2 instances with 2 different configuration settings (i.e. /etc/postfix and /etc/postfix_smtp). You need to create startup scripts to both. One instance can run postfix in port 587 with relevant authentication configurations while other can run on port 25 as a mail relay server for your domain)

Add IPv6 route in Windows 7

In Windows XP you can add IPv6 route easily using the GUI provided at the network configuration.
Following given a good reference on how to set a IPv6 route in XP
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ip_v6_pro_rt_add.mspx?mfr=true


But for Widows7 it is not that easy.. Or I was not able to add a IPv6 route as for XP through the GUI. So, I tried the command line interface to add another route (Other than the default route which is automatically configured with the IPv6 settings)

Assume you have a network 2001:df0:12:a00::/64 and
your IP is 2001:df0:12:a00::1 and
your default gateway is 2001:df0:12:a00::ffff. 
So your default route will be
::/0 --> 2001:df0:12:a00::ffff

Assume you want to add another router to forward 64:eeb9::/96 (Which is NAT64 default network) to 2001:df0:12:a00::20 (Which is the NAT64 server of the network).

Now run the command line interface as the administrator (or a user with admin privileges)

'netsh interface ipv6 add route 64:eeb9::/64 "Local Area Connection" 2001:df0:12:a00::20' 

If the command is accepted it will display 'OK'

To check the routing entries type the following command

'netsh interface ipv6 show route'

It will display all routing related to IPv6 interface.

Please note that you have to give the interface name properly which I have given here as "Local Area Connection". It depend on the network interface that you want to use for IPv6 communication. By issuing the command ipconfig /all you can see the names of all the interfaces in your PC. 

DNSSEC without KSK

If you have not included the KSK in the zone file the latest versions of zone-singing will ended up with following error;


> dnssec-signzone: fatal: no self signed KSK's found


Not including KSK in the zone file is not the recommended way as if you not include any KSK and not provide the DS set to your DNS root, the trust anchor will not be created. Anyway if you really want to sign your zone with a self signed key (i.e. Only with a ZSK) use the switch '-P' with the zone signing command;

dnssec-signzone  -v 1 -t -P -o  xxx.abc db.xxx.abc Kxxx.abc+007+12345.key

Here -v is to set debugging level, -t is to print statics at the completion
-P to Disable post sign verification tests
The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm. This option skips these tests.

Reference

man page of dnssec-signzone http://linux.die.net/man/8/dnssec-signzone

http://www.mail-archive.com/bind-users@lists.isc.org/msg05529.html