The best place to perform most functions is from the User Account Window

Index

1. There are seven Help Resources accompanying this software, including search (above).
2. • This Document
   • Installation, Upgrading and General Help for the Senior Admin
   • A Guide to Managing Users
   • Programme README
   • Frequently Asked Questions
   • Apache Configuration and Security Help
3. DBMA functions in three primary regimes:
   • User Administration;
   • Group Administration; and
   • Global (System-Wide) Administration
4. Adding Users
   • See also "Configuration" or "Speedups to accelerate the process of adding users."
5. Adding Aliases
   • See also User Account Window
6. Auto Replies
   • Vacation
   • Please heed warnings about mail loops.
7. Blind Copies
   • Using the "Forward" or "Edit" forwards function to create BCCs
8. Configuring DBMA
   • All configuration is done from the GUI
   • DBMA can be 'Hard-Coded' by root to restrict access to a single Group Admin.
9. Database Cleanup
   • Fix or accelerate delete status
   • Remove 'orphans'
   • Delete unattached old mail
   • Correct error's in Group Assignments of Aliases
10. DBMA MTA Admin
    • Administer Postfix, Sendmail, Exim etc. from DBMA
11. DBMA MTA Access
    • Whitelist / Blacklist in real time without restarting your MTA nor remapping hashes.
12. Deleting Aliases
    • Deleting all of a user's aliases in one action.
    • Editing, or single deletions.
13. Deleting Users
    • Removing users completely from the system
    • Removing entire Groups of Users
14. Finding Users
    • Smart search finds the user and opens a User Account Window
    • Works with user name or full address as account name
15. Forwards
    • Creating BCCs
    • Converting a forward to an alias.
    • Move an alias from one account to another
16. Forwards - Deleting or Editing
17. Forwards - Listing
    • List global mail forwards
18. Limiting List Displays
    • For larger enterprises
19. Listing Group Aliases
    • Focussing on single groups of users
20. Listing Global Aliases
    • Find: Orphans
    • Forwards
    • Display every entry in the alias table
21. Listing Group Users
    • Open a full featured administration window accessing all user accounts in a given group
22. Listing Global Users
    • Open a full-featured adminstration window listing all users on the system.
    • Limit list size for larger enterprises
23. Listing Global Notifications
    • Notify someone when new mail arrives.
24. Redirecting Aliases
    • Recycle existing aliases
    • Redirect mail to internal or external destinations
25. Sending Mail Notifications
    • Notify external or internal recipient when mail arrives on any selected account
26. Messaging users.
    • DBMA both sends and receives mail
    • Notify users of quota increases, password changes etceteras.
    • Send mail anywhere on the planet from DBMA
27. Password Encryption
    • Several tools both explain and automate password encryption in the database
    • Note: SASL Users must turn encryption off and use plaintext passwords in DbMail
28. Removing Notifcations
    • Remove mail notifications from the User Account Window or from Global Admin (Main) Window
29. Recent Logins
    • Track recent logins
    • Check for and monitor abandoned accounts
    • Monitor User IPs and POP/IMAP before SMTP security issues
30. Sending Mail
    • Send Mail GUI available from "Modify (User) Account Window or Global Admin (Main)"
31. Sharing Mail Folders (ACLs)
    • Full featured IMAP Shared Folders
    • Complete control and management of user access rights
    • #User and #Public shared mail folders
32. Speed-Up Tools
    • See also "Configuration" for a number of one-time-use automated processes for speeding up system building and migration
33. User Account Window
    • Most administration will be done from the User Account Window
      and the "Modify User Account" window
    • Creating mail notifications
    • Sharing #User Folders
    • Adding or Removing Access to #Public Shared Folders
    • Creating or Editing Aliases
    • Adding forwards
    • Adding BCCs
    • Changing Encryption Types
    • Changing Mail Quotas
    • Changing User Passwords
    • Changing User Group ID
    • Modifying or Deleting User Account
    • Monitoring qutas
    • Mail header and body search and access:
    • for finding and UNdeleting a critical message a user inadvertantly deleted;
    • troubleshooting mail headers when a delivery breaks;
    • evaluating anti-spam/virus software deployments;
    • reading your administrative mail;
    • running 'echo' mail tests....
    • providing help-phone assistance to users in the identification or removal of SPAM, 'message-jams', viruses; and so on....
34. User Mapping
    • User mapping allows a wide range of user management. Block a user's access altogether as in turning off an account. Specified users can be allowed IMAP only or POP only. Login format can be re-mapped. This is where you do that.

DBMA User Search

Here is an important note about editing forwards. This is the real pay-off for reading the help files. Any place you see "edit" or "forward" beside an email address, you have the opportunity to send mail for that address anywhere you like. You can even convert the forward back to an alias for any account. Make sure that you have the "From" address correctly entered -- DBMA validates on the basis of the alias ID number and will send you back to the start if there is no match on the system. Next, you can enter a username, a user ID number or an email address as the recipient ("Forward to:"). DBMA will check if the user number or name exists on the system and give you a final option to edit your entry before commiting. Lets say you have a mail forward for "webmaster" delivering mail to [email protected]. Bobby is heading out for vacation and you now want to redirect mail back to the webmaster's account. You simply type "webmaster" in the "Forward to:" text box and DBMA will convert the forward back to an email alias for 'Webmaster'.

Beside every alias listing in the Modify User Account Window, is a button labelled "Forward". That also means EDIT. If you want to move an alias over to another account, select "Forward" and instead of typing an email address in the deliver to box, enter the user name of the account you wish re-assign that alias to.

1) First DBMA will match aliases to users and fix client_idnr (GroupID) where the alias has the wrong client_idnr (GroupID).

2) Through a serious of SQL queries and commands, DBMA sets message status 003 for all mail marked for deletion. That will escalate the deletion process. Status for messages flagged for deletion in some cases could be 000, 001,or 002 depending on the DbMail version you are using. As well as clearing up some previous issues with older DbMail versions this tool accelerates the cleanup process nicely.

3) DBMA also marks for deletion any completely orphaned messages having no mailbox nor owner. These orphans can occur due to vagaries in the database or the DBMS and the type of database you are using. Broken or incomplete indexes or cascading routines can cause this to happen as well as administrative errors. This tool allows you to manually perform the function of a schedules crontab utilities run. Note: If DBMA finds some orphaned messages it will first set their status to 001. Your command line (crontab) utility will then escalate them to 002 then 003 then delete them. You can speed that up by selecting 'Database Cleanup' a second time, and any orphaned messages marked 001 will be escalated to 003 and deleted from the database on the next Utility/Maintenance run. This two staged approach takes into consideration that this is a very rare occurrence; is likely caused by manually 'messing with the database'; and the fact that you may have by other means deleted a user, giving you time to manually recreate that user at the proper user_idnr. In future versions, DBMA will fully delete these immediately after reporting what if any exist .

4) DBMA deletes all unattached (orphaned) mailboxes.

5) For MySQL only, DBMA runs a defragmentation on the following tables by performing a 'null' alter table operation:

            dbmail_aliases
            dbmail_users
            dbmail_mailboxes
            dbmail_messages
            dbmail_messageblks
            dbmail_physmessage
            dbmail_subscription

It should also be noted that within DBMA, the only person able to actually see full ACL permissions is the the global administrator with the ACList function.

Remember that once you have created the infrastructure and assigned some administrative rights (SETACL) to key trusted users, your Shared Folder Forest under #Users is likely to grow fast. #Public folders can be controlled exclusively by you, the Mail System Administrator, or you can give Administrative Access Rights to #Public/folders to trusted users or Group Admins.

How to Start Sharing Folders
Select "ACL" from the main screen. Type the name of the folder you wish to create and press "Create Shared Folder." DBMA will do the rest. DBMA will assign limited user access rights to "anyone". If "anyone or __public__ does not exist on your system, DBMA will create them for you.

The Global function screen for ACLs also has an Access Rights tool for manually adding a folder to a users ACL or updating any user for any shared folder. Be careful how you use this as it is a powerful and highly flexible tool.

Any User Account Window provides a means to manage specific user access rights to shared folders. You can permit users to have higher privileged access rights or even administration rights. To understand these rights, hold your cursor over the text block at the bottom which corresponds to the item for which you seek help. Or click help.

Once you have your shared folders set up and appropriate user rights assigned (for anyone), you will want to get your email client configured to subscribe to these folders. The internet is abound with opinions on what is the best email MUA (Mail User Agent - Email Client). If you are using Thunderbird or a fairly new Mozilla Mail, you are in luck. These MUAs will "subscribe" to the shared folders in a flash. You can drag and drop or copy to, move to or whatever you like in these folders.

Here is a usage example of IMAP4 Shared Folders. Let's say you have some pictures you want to show many people on your mail server. Create a folder or use what you have and create a message containing your pictures and save it in your drafts folder with a subject line "Pictures of me Winning The Lottery" or whatever. Next, select the email in your drafts folder and copy it to your "Common Shared Folder". Now 'anyone' has access. Hopefully your target audience is not using one of the ACL Shared Folders 'unfriendly' MUAs. You perhaps can share the following advice.

With Microsoft's Outlook Express and Outlook you will need to do a little coaxing. Select the account and click on "IMAP4 Folders". Don't try to first subscribe to #Public after you "Reset List". Instead, select just the sub folders of #Public and subscribe to them. Close the "Folders" window. Reset the list of folders. Next open "IMAP4 Folders" again and select #Public. Close. This two-step process of subscribing to the subfolders first and then later subscribing to the root #Public seems to work. You should be in business.

Sharing a Users' Folders
This is normally done with an ACL-friendly MUA but DBMA can help you create much of what the user can do from their MUA if it is easier to do it for them than explain how; or in the event that your user has made a mistake and you are on a repair mission.
In the drop-down display of available ACL-eligible folders in the User Account Window you will see all of the "#Public" folders plus all of the users folders. They are all eligible for sharing. Example for User Account Window for: Bob

#Public/common
bob/INBOX
bob/Trash
bob/Sent
bob/shared

If you select and add a set of Access Rights to "bob/shared", it will be available across the system under #Users but no one will be able to share it unless you assign Access Rights to additional users; or allow bob SETACL (Admin) rights for that folder and he can do it all for you.

You manage individual user rights from the User Account Window and manage #Public and #User rights from the global Access Control List Tools (select ACL on the Main Screen).
Assigning rights to #Users/folder can be done with the DBMA Access Control List Tools after the #User/folder has been shared from the User Account Window. The first step is to go to the User Account Window, create the shared folder by assigning the owner full Access Rights. Next you return to the DBMA ACL Tools and select the new shared #User/folder you created and one after another add the users needing access rights on this folder.

ACL Permissions set to 1-On or 0-Off
lookup: mailbox is visible to LIST/LSUB commands
read: SELECT the mailbox, perform CHECK, FETCH, PARTIAL SEARCH, COPY from mailbox
seen: keep seen/unseen information across session
write: STORE flags other than SEEN and DELETED
insert: perform APPEND, COPY into mailbox
post: send mail to submission address for mailbox
create: CREATE new sub-mailboxes in any implementation defined hierarchy
delete: STORE DELETED flag perform EXPUNGE
administer: perform SETACL

This Compares to the RFC 2086 - IMAP4 ACL extension definition
The ACL extension is present in any IMAP4 implementation which returns "ACL" as one of the supported capabilities to the CAPABILITY command. This is something DbMail does very well. It may be one of the best. An access control list is a set of identifier,rights pairs. Identifier is a US-ASCII string. The identifier anyone is reserved to refer to the universal identity (all authentications, including anonymous). All user name strings accepted by the LOGIN or AUTHENTICATE commands to authenticate to the IMAP4 server are reserved as identifiers for the corresponding user. Identifiers starting with a dash ("-") are reserved for "negative rights", described below. All other identifier strings are interpreted in an implementation- defined manner.
Rights is a string listing a (possibly empty) set of alphanumeric characters, each character listing a set of operations which is being controlled. Letters are reserved for ``standard'' rights, listed below. The set of standard rights may only be extended by a standards-track document. Digits are reserved for implementation or site defined rights. The currently defined standard rights are:
l - lookup (mailbox is visible to LIST/LSUB commands)
r - read (SELECT the mailbox, perform CHECK, FETCH, PARTIAL, SEARCH, COPY from mailbox)
s - keep seen/unseen information across sessions (STORE SEEN flag)
w - write (STORE flags other than SEEN and DELETED)
i - insert (perform APPEND, COPY into mailbox)
p - post (send mail to submission address for mailbox, not enforced by IMAP4 itself)
c - create (CREATE new sub-mailboxes in any implementation-defined hierarchy)
d - delete (STORE DELETED flag, perform EXPUNGE)
a - administer (perform SETACL)

'User Account Window' with all features turned on. If you are not using features, turn them off in the Configuration Window to reduce the clutter.

1. Open a User Account Window for the mail user wanting an auto-reply.
2. Check what if any aliases it may have.
3. If it has institutional or pseudo-accounts aliased to it, move those aliases to point back to their own mailboxes. (For example, if webmaster was aliased to "Harry", delete that alias in "Harry"'s account and then open webmaster's account which heretofore had no email addresses or aliases and create the alias for "webmaster" in "webmaster's account".)
4. Once all the aliases except 'mailuser @ yourdomain.tld' are removed, go to the DBMA Main Screen and select "List all Forwards".
5. Delete the forwards for this account.
6. This is somewhat redundant but you should do it anyway. Double check everything by selecting "all Aliases in this Group" for this user's group number. The only way something would appear there for this user is if it is old, stale, junk pointing to the user's ID number; some alias was once misspelled and ever since has been overlooked. Those can come back to haunt you.
7. Now open a User Account Window for the user and complete the auto reply form. First select and remove the instructional text, typing in the message, then set the start date / stop date (DBMA automatically sets both dates to the current moment); and now press the "AutoReply" button.
8. The User Account Window will return showing the new setting. Check that it is what you intended.
9. To run a test: click the "Modify 'user' Account" button and when the Modify User Account Window opens, click on "Send 'user' A Message". A new window will open with preformatted text which you will alter to have your address as the from address and text to explain what you have just done. Press "Send" and a new window will open saying "OK.. message sent etc": You need to remember to turn off this Auto Reply at some date and time so put that information in the subject line. Send it again, this time to yourself.
10. Now check your mail box for both an Auto Reply message and the one you sent to yourself. Send another message from your MUA to the account and make sure you get an Auto Reply.

User Maps
	myname	inet:10.0.0.2:143		myname
In the illustrated case above for "myname" where a user "myname" is given the "allow" sockaddr of "inet:10.0.0.2:143 -- myname's account access is set as IMAP and the dbmail clienthandlers will know to use the imap socket:inet:10.0.0.2:143 for "myname" logins. User Mapping This feature is available in DBMail Version 2.2 and later. User mapping has a diverse range of applications including IP, domain and username maps. Usermapping in this case works on the basis of establishing a per-user sockaddr (example: inet:10.0.0.1:143) and passing it to the dbmail clienthandlers. DbMailAdministrator allows you to configure user mapping in any manner and for any purpose you choose from the User's Account Window. Below are are just a few examples of how you might do this. DBMA allows any ASCII character to be entered so any configuration you can make work can be implemented with this tool. It is strongly suggested you be very specific about entering sockets and be wary of routed solutions where an outside IP is NAT'd to a LAN IP. In that case the socket on the LAN mail host is its LAN address, not the routed address and your socket would be something like inet:172.16.1.1:143 where routable IP xxx.xxx.xxx.xxx translated is 172.16.1.1 If myname is the account name (dbmail_users.userid) and you want the user to be able to login uniquely as [email protected] you would change the first (dbmail_usermap.login) name to [email protected] which tells dbmail clienthandlers " When [email protected] logs in, use dbmail_users.userid=myname and socket inet:10.0.0.2:143. LOCK User Account In the case where a user has been temporarily banned from using the system for fetching or managing their mail, select "LOCK" and press the "User Maps" button and they are locked out. CLEAR User Maps If you have made a mistake or wish to reverse an account lock you can clear the usermap settings to a one to one mapping (default) by selecting "CLEAR" and pressing "User Maps". Example where there are multiple users wishing to have the same local name and where mail is delivered to mailboxes on the basis of an alias lookup. In this case it is fairly clear what the admin is doing. All of these "John"'s are on the same server, but different domains. User Mapping is helping this system do virtual domain mail in some of it's potentially trickiest parts.
	Login	Socket Deny	Socket Deny	Account Name
	[email protected]	inet:172.20.21.16:143		johnanderson
	[email protected]	inet:172.20.21.16:110		johnfrustaglio
	[email protected]	inet:172.20.21.16:110		john_reynolds
	[email protected]	inet:172.20.21.16:143		john_petrowalla
col names:	login	sock_allow	sock_deny	userid
	ANY	inet:10.0.0.2:143		%[email protected]
1: Maps logins on single IP to an expanded form forcing first_part@domain logins even if first_part only is the stored username
	ANY		inet:223.223.223.1:110	%s
2: No users on IP 223.223.223.1 will be allowed access on port 110 (POP3)
	ANY		inet:223.223.223.29:143	%[email protected]
3: No users on IP 223.223.223.20 at domain.tld will be allowed access on port 143 (IMAP)
	UserA			UserA
4: For UserA above this provides one to one mapping regardless of IP address and port. "CLEAR" usermap results in this.
	UserB	inet:127.0.0.1:143	inet:10.1.1.1:110	UserB
5: UserB above will be able to logon to the specified IP address on port 143 (IMAP) but will be denied access on port 110 (POP3)
	UserC		inet:0.0.0.0:0	UserC
6: UserC above is denied all access. Selecting "LOCK" and pressing "User Maps" automatically sets these parameters for you.

DBMA MTA Admin

DBMA MTA Domains and per-domain Transport Management

DBMA MTA ACCESS - A Powerful 'Whitelist / Blacklist Tool'

The 'sender' field in any case would contain the domain or IP address requiring action.

The 'action' directive could be one of at least three directives: a.) REJECT, b.) OK, c.) reject_unverified_sender with the option of using any text string your MTA understands (i.e.: error code plus message) in the latter.

In simple terms this is your global white-list/black-list resource. How you use it is is a matter of your preference. The following examples for Postfix may make this decision clear for you right away as you compare what follows to your current configuration:

in Postfix's main.cf
===================
smtpd_recipient_restrictions =
.../
check_client_access mysql:/etc/postfix/DBMA_MTA_Access.cf,
check_sender_access mysql:/etc/postfix/DBMA_MTA_Access.cf,
\...

DBMA_MTA_Access.cf
================
user=dbmail
password=dbmail
dbname=dbmail
hosts=127.0.0.1
table=DBMA_MTA_ACCESS
select_field=action
where_field=sender

Checking this is easy with Postfix. From the command line type the following substituting a "sender" domain you know to be in the database, or enter one first using DBMA MTA Admin.

The command line:
% postmap -q evilhackers.com mysql:/etc/postfix/DBMA_MTA_Access.cf
will return:
% REJECT

FREE.STEALTH.MAILER@            550 We don't accept mail from spammers
another.source.of.spam          REJECT                      
okay.cyberspammer.com           OK                          
128.32                          RELAY                                

CREATE TABLE  DBMA_MTA_Access  (
myid  int(5) NOT NULL auto_increment,
sender  varchar(128) NOT NULL default '',
action  varchar(25) NOT NULL default 'REJECT',
PRIMARY KEY  (myid),
UNIQUE KEY  sender  (sender)
) TYPE=MyISAM COMMENT='MTA acces table' AUTO_INCREMENT=1 ;
+--------+--------------+------+-----+---------+----------------+
| Field  | Type         | Null | Key | Default | Extra          |
+--------+--------------+------+-----+---------+----------------+
| myid   | int(5)       |      | PRI | NULL    | auto_increment |
| sender | varchar(128) |      | UNI |         |                |
| action | varchar(25)  |      |     | REJECT  |                |
+--------+--------------+------+-----+---------+----------------+