SME Server User Manual

More About Ethernets

Appendix A: Introduction to the Ethernet Local Area Network (LAN), briefly explains ethernets, ethernet components and typical ethernet configuration.

If you are operating the product in "server-only" mode, you will need to review your gateway/firewall documentation and perhaps consult with your ISP regarding your configuration. For example, depending on your plans for the server, your ISP may need to publish DNS records associating your mail and/or web servers with your firewall IP address. You may also need to configure your firewall for port forwarding of services.

In server-only mode, the single Ethernet connection to the local network is "trusted" as being secure and packet filtering is disabled. For that reason, a server-only server must always be behind a local firewall. You should not directly connect such a system to the Internet via an Internet Service Provider.

Static IP addressing is preferable to dynamic IP addressing because it makes it easier for users on the Internet to connect to your services.

In the tables below, please keep the following information in mind:

1. ISPs often supply the items marked * to your server by DHCP.

2. Some ISPs block outgoing HTTP connections, forcing you to use their proxy server. This interferes in a few minor ways with your server (e.g., the test for Internet connectivity will fail erroneously). However, using the ISP's proxy server will normally work fine.

While the software includes experimental support for ISDN cards, we do not provide technical support for the use of these cards as they have not yet been tested in a wide enough variety of environments.

Some Important Notes on Service List D (Multidrop Mail)

Service list D is applied to configurations where the publication of DNS records is not practical either because your IP address changes frequently or because it is non-routable. Because there is no published address receiving incoming network connections, this configuration does not allow you to host a web page or FTP site using your SME Server.

In this case, e-mail is handled using a method called "multidrop", which involves temporarily storing all e-mail messages addressed to your domain in a POP mailbox at your ISP until your server connects and fetches them. Your POP mailbox must be large enough to hold the e-mail for your organization until it is fetched. If your primary ISP cannot supply this, you can use another ISP for your e-mail hosting.

As e-mail messages are delivered into the POP mailbox at your ISP, some of the addressee information is removed. To determine to whom the e-mail message is addressed, your server uses several heuristics. This works very well for normal person-to-person e-mail. However, messages from mailing lists (and other sources where the user's account name is not present in the headers) cannot be delivered. Any e-mail that cannot be delivered will be returned to the sender. If the e-mail cannot be returned to sender, it will be directed to the system administrator.

Some ISPs add a header to each e-mail message as it enters the POP mailbox to assist in determining the addressee. One common header tag is: "X-Delivered-To". If your ISP does this, make note of the header tag used so that you can configure your server to look for it (explained in a later section).

Because of the potential problems involved with delivery of e-mail to multidrop mailboxes, we strongly encourage you to consider other means of mail delivery before resorting to using multidrop.

Our hardware recommendations only apply to servers with up to 500 users. This is not a technical limitation, and the SME Server can provide services to more than 500 users. In that case, we suggest that you specify a custom system using our Category 4 requirements as the minimum starting point.

Because SME Server is based on Red Hat Linux version 7.3, PCI ethernet adapters that can work with Red Hat 7.3 should also work with SME Server. You can find an up-to-date searchable database at Red Hat's web site at: http://hardware.redhat.com/redhatready/cgi-bin/us/db-hcl.cgi (Choose Network Device/Controller from the "Hardware Category" menu.)

As SME Server is based on Red Hat Linux version 7.3, PCI-based SCSI adapter that can work with Red Hat Linux 7.3 should also work with SME Server. You can find an up-to-date searchable database at Red Hat's web site at: http://hardware.redhat.com/redhatready/cgi-bin/us/db-hcl.cgi (Choose Storage Device/Controller from the "Hardware Category" menu.)

In the list below the use of an 'x' symbolizes a wildcard. For example, 'AHA-29xx' indicates it applies for the 'AHA-2930' as well as the 'AHA-2940' and any other models beginning with 'AHA-29'.

If your tape drive is not listed at Red Hat's site, you can visit http://www.linuxtapecert.org/ to see if your tape drive vendor is participating with that tape drive certification effort. Be aware that some of the solutions developed to get certain tape drives to work with Linux may require kernel modifications and only be attempted by experienced developers.

The computer on which you install this software will be totally dedicated to being your SME Server. The hard drive of this computer will be erased and re-written with the Linux operating system - dramatically enhancing the reliability of your server over other operating systems. However, this means that while this computer is acting as your server, you cannot use it for any other purpose.

If you have previously installed and configured a server and are reinstalling the software, please be aware that you must use the Upgrade option in order to preserve your existing configuration and data. Simply performing a new installation will erase all previously existing user accounts, user directories, i-bay contents and web site and configuration parameters. If you have not already done so, you may wish to back up the contents of your server onto one of your desktop computers. You can do so easily by selecting "Backup or restore" from the server manager, as explained in the chapter on on-going administration of your server.

SME Server supports a software implementation of RAID Level 1, known as disk mirroring. It does not support RAID Level 0 (disk striping), as that does not provide any protection of your data whatsoever. It does not support RAID Level 5 (disk striping with parity) because of the poor performance and reliability of software implementations of RAID5. If you are seeking RAID5 support, Contribs.org recommends you consider one of the many hardware implementations which will provide both protection and performance.

Using one of the supported hardware RAID controllers, you will be able to upgrade from an earlier version of the SME Server to version 5.1 using the standard upgrade process . You should back up all your data and test carefully after installation.

It is not possible to use the Upgrade option to add software mirroring (RAID1) to an existing server.

If you previously installed software mirroring with a previous version of the software, you should be able to upgrade without any problems. However, if you want to upgrade a previous version of the software that was not installed with software mirroring to use software mirroring (RAID1) support, you should:

1. perform a backup through the server manager

2. perform a fresh install selecting the software mirroring option

3. restore the backup through the server manager

If you are configuring your system with RAID1 support, notice that your step 4 below will be slightly different. If you skipped the previous section on RAID, it would be advisable to read it before proceeding.

The installation process formats and erases all attached hard drives. If you have multiple hard drives, be sure to back them up prior to starting the installation process.

The installation (or upgrade) process rewrites the boot sector on your hard drive. This may cause machines with BIOS boot sector virus detection to not boot unattended. This detection should be disabled in your system's BIOS.

As you move through the configuration screens, you will notice that there is a "Keep" option which will allow you to keep the choices you may have made previously. Obviously, when you are configuring your system for the first time, many of these choices will not have been made, but if you later go back to re-configure the system, this option can save time.

You can use any ASCII printable characters in the administrator password. As this password gives someone total control over your server, you should choose a password that cannot be guessed easily. A good password should contain mixed upper- and lower-case letters, numbers and punctuation, yet also be easy to remember. An example might be "IwmSMES!" as in "I want my SME Server!" (Please don't use this example as your password!)

You should make the system name as unique as possible in case you someday decide to link your server to another server using an IPSEC VPN. When you do, each server will need a unique name. Using some type of theme, such as location names, may be an effective way to ensure unique names.

If you are installing servers at multiple sites within your organization, you may find it useful for later troubleshooting to use different network addresses for each site. Additionally, if you ever want to establish an IPSEC VPN between the servers, each server will need to use a different range of IP addresses. Even if you are not planning to use a VPN right now, it would be safest to use unique network addresses for each location.

Because the server "trusts" the local network to be secure in server-only mode, it must be behind a firewall of some type. Under no conditions should it be directly connected to the Internet.

If you are using two different network interface cards, you will see which driver is associated with eth0 and which is associated with eth1. This information can help you determine which card is eth0 and which is eth1. If you have two cards that use the identical driver you will see a screen such as the one above where the actual driver is not listed.

What is PPPoE?

PPPoE is the Point-to-Point Protocol over Ethernet . Essentially, it is an implementation of the popular PPP protocol used for dialup connections - only configured to run over an Ethernet connection. Many ISPs that provide ADSL connections use PPPoE as the method of connecting their customers to the Internet over ADSL.

If you are using a dial-on-demand link to your ISP, please be aware that you can incur very steep phone charges due to dialup connection attempts to the ISP. We are aware of at least one case in which a failed modem link at the ISP resulted in several thousand connection attempts over a couple of days - and a hefty phone bill. If your telephone carrier charges you per-call or per-minute fees, we suggest that you contact your ISP and ask whether it is willing to assume responsibility if a failure at their end results in a large phone bill.

Your SME Server contains a fully functional caching DNS server and in almost all cases you will not need to enter the address here for a DNS server. However, some corporate firewalls restrict DNS queries from internal DNS servers. If that is the case, you will need to supply the address for an external DNS server.

Any time that you login to your system as the "admin" user you will see the server console. This is true even when connecting to the server remotely using a tool such as ssh (discussed later in the chapter on Remote Access).

If you are not familiar with working from the Linux prompt, you may be interested in trying a file management tool called Midnight Commander. It allows you to perform many file operations through a menu-driven interface. Simply type mc at the command prompt. Press the function key "F1" for help and "F10" to quit.

This chapter demonstrates only one of the many possible ways to configure your client computers and is provided here as an example.

All your computers must communicate on the network using the TCP/IP protocol.

In Windows you add a TCP/IP protocol. In Apple, open TCP/IP Control Panel.

We strongly recommend that you configure all clients machines using DHCP rather than manually using static IP addresses. Should you ever need to change network settings or troubleshoot your network later, you will find it much easier to work in an environment where addresses are automatically assigned.

In some rare cases, you may want to use a static IP address for a particular client machine. The typical approach is to manually enter this IP address into the network properties of the specific machine. The negative side of this approach is that you cannot easily change or alter network settings without having to go in and modify the information on the client machine. However, it is possible to provide this static IP address directly through DHCP rather than manually configuring the client computer. To do so, you will first need to determine the Ethernet address of the client computer (usually through the network properties). Next you will go to the Hostnames and addresses web panel of the server manager and enter the information there.

Only One DHCP Server

It is imperative that no other DHCP server is on your network. If a former DHCP server configured your computers, you should remove that DHCP server from your network. Leave DHCP enabled, and reboot each computer. New IP addresses, netmasks, gateway IP addresses and DNS addresses will be assigned automatically by the server DHCP server.

A word about domain names

Once you've set up your server, there's typically a delay of one or more days before your ISP publishes your domain address records (the domain name or names and the associated numerical IP address) so that the information is accessible to other computers on the Internet. Until it does, incoming mail won't be able to find you and computers elsewhere on the Internet won't be able to contact your server using your domain name (for example, www.yourdomain.xxx). However, on your local network you should be able to connect to your server using the short names of 'www' (for web access) and 'mail' (for e-mail clients).

You can access all of your new and stored e-mail from any machine connected to a network.

Because all employee e-mail is stored on the server, backup of e-mail is easily accomplished.

If you are not connected to a network, new and stored e-mail messages are not available to you.

For security reasons, you are only able to access the server manager through a web browser on the local network. Remote access is only possible using remote access tools such as ssh and PPTP.

As even one further layer of security, you can also connect to the server manager using the secure HTTPS protocol . This establishes an encrypted channel of communication between your browser and the server, even on your local network. To connect to the server manager in this manner, use a URL prefix of "https" as in the example: https://www.yourdomain.xxx/server-manager.

ssh (secure shell)

ssh (secure shell) provides a secure, encrypted way to login to a remote machine across a network or to copy files from a local machine to a server. Many people do not realize that many programs such as telnet and ftp transmit your password in plain, unencrypted text across your network or the Internet. ssh and its companion program scp provide a secure way to login or copy files. The ssh protocol was originally invented by SSH Communications Security which sells commercial ssh servers, clients, and other related products. The protocol itself has two versions - SSH1 and SSH2 - both of which are supported by most clients and servers today. For more information about SSH Communications Security and its commercial products, visit http://www.ssh.com/.

OpenSSH, included with the SME Server, is a free version of the ssh tools and protocol. The server provides the ssh client programs as well as an ssh server daemon and supports both the SSH1 and SSH2 protocols. For more information about OpenSSH, visit http://www.openssh.com/.

By default, only two user names can be used to login remotely to the server: admin (to access the server console) and root (to use the Linux shell). Regular users are not permitted to login to the server itself. If you give another user the ability to login remotely to the server, you will need to access the underlying Linux operating system and manually change the user's shell in /etc/passwd.

Your connection to the Internet needs to be established first before you initiate the PPTP connection. This may involve double-clicking one Dial-Up Networking icon to start your Internet connection, then double-clicking a second icon to start the PPTP connection. To shut down, disconnect your PPTP connection first, then disconnect from your ISP.

To protect your network, the SME Server enforces the use of 128-bit encryption for PPTP connections, rather than the 40-bit encryption provided in earlier versions of Microsoft's PPTP software. If you are unable to establish a PPTP connection to your server, you should visit http://windowsupdate.microsoft.com/ and download the appropriate update. Due to the dynamic nature of Microsoft's web site, the page may appear differently depending upon the version of Windows you are using. In most cases, you will want to look or search for Virtual Private Networking or a Dial Up Networking 128-bit encryption update. You may need to install the 40-bit encryption update first, and then install the 128-bit encryption update. Note that with Microsoft's ActiveUpdate process, if you are not presented with the choice for this update, it is most likely already installed in your system.

Because telnet has been and continues to be widely used to date, we are providing the ability to use telnet for remote access. However, as ssh usage increases, it is our intention to remove telnet access from future releases of the server.

Because of these security concerns, we do not allow administrative command line access (connecting as 'root') using telnet. Please use ssh instead.

After you start using a network time server, you should NOT set the time or date manually. If you do so, the network time synchronization will no longer function.

In order to make sure the network time server is set to your timezone, you should go through this screen once and manually set the time to be correct and with the correct timezone. After doing that, go back to this panel and set the server to use a network time server.

If you have a Windows NT server or Windows 2000 server on your network that is functioning as a network server, you should most likely answer "no" because that other server will act as the domain master.

  \\servername\NETLOGON\

For maximum flexibility in making changes later, we suggest that you enter the hostname for a network printer here and enter the IP address of the printer through the Hostnames and addresses panel of the server manager. This allows you to have one central location listing IP addresses and allowing you to make changes. Note that many modern network printers can be configured automatically. To do so, enter their hostname, IP address and Ethernet address in the Hostnames and addresses panel.

Using the Hostnames Panel

Throughout the screens linked to from the Hostnames panel, you will find the text "Publish globally?" with a checkbox next to it.

Suppose, for example, your company's web site was hosted at some other location, such as on your ISP's web servers. If you wanted "www.mycompany.xxx" to point to your ISP's server, you would modify the entry here by clicking the "Modify..." link next to "www". The image below shows the screen in which you would perform the task:

You would first change the location to "Remote" and then enter the IP address of your ISP's server in the field marked "Global IP".

Creating new hostnames simply involves selecting one of the links at the top of the Hostnames and addresses panel and filling out the appropriate fields.

Note that if your system is configured with any virtual domains, you will have the choice of the domain in which you want to create the hostname. This allows you, for instance, to have "www.tofu-dog.com" pointing to one IP address and "www.mycompany.xxx" pointing to a completely separate IP address.

The hostnames you can create on this panel fall into three categories:

Additional names for your server: For instance, you might want to set up "intranet.mycompany.xxx" to point to your server. All you do here is enter the hostname and, if appropriate, choose the domain for the hostname.

Remote hosts: As mentioned in the example earlier, you might want to point a hostname such as "www" to a remote system. While "www" is created by default, you can create other names such as "home", "research", or any other appropriate name. In the form, you simply enter the hostname, choose the domain, and enter the remote IP address.

Local hosts: This screen is a bit more complicated because you have more options. At a basic level, you can create a hostname in a domain that points to another computer on your local network. To do this, just type in the hostname and enter the IP address in the "Local IP" field. For instance, you might want "research" to point to a computer system inside your network.

Where this gets complicated is when you want "research.mycompany.xxx" to be accessible both inside and outside your local network. The challenge is that your local IP addresses are only accessible inside your network. For that reason, the target computer system will need to have two network interface cards - one connected to the internal network and one connected to the external network. You would then enter both IP addresses in this screen in the "Local IP" and "Global IP" fields.

	The "Ethernet address" field when creating a hostname pointing to a local host is only used for reserving IP addresses through DHCP as mentioned in the next section.

Another task you can perform through this panel is to reserve an IP address for a given system based on its Ethernet address. For instance, you might have another intranet web server within your company that you want to always have the same IP address. One method of assigning that address is to manually configure the client machine to have a static IP address. The negative aspect of doing this is that if you later want to change the network settings for that machine, you must manually go and configure that machine. An example would be if one of your DNS servers changed its IP address. Additionally, you have to keep track somewhere of the fact that you have assigned a specific IP address to that machine.

Rather than configuring the machine manually, you can reserve an IP address from the DHCP server for that specific machine. This has the same result as manually configuring a static IP address, but offers two benefits. First, you have one location to keep track of all assigned static address. Second, through the DHCP server you will provide network settings. If you wish to change those settings, the change can be simply done on your server. All DHCP clients will then receive those updated changes when they renew their DHCP-provided addresses.

To reserve an IP address, you must first determine the Ethernet address of your client system. Windows NT/2000 users can type the command ipconfig /all. Windows 95/98 users can run the command winipcfg. Linux/UNIX users can type ifconfig.

Once you have determined the client's Ethernet address, click on the link to create a new hostname for a local host. Add the hostname of the target system, the Ethernet address along with the desired IP address into the web panel. From this point on specified IP address will only be provided to a client system with the matching Ethernet address.

As shown below, this section of the server manager allows you to specify the protocol used to retrieve e-mail from your ISP and configure other settings regarding the retrieval of e-mail.

Your choice of e-mail retrieval mode will depend on the arrangements you made with your Internet service provider:

• If you have a dedicated connection, set E-mail retrieval mode to "Standard".

• If you arranged "ETRN" support with your ISP, choose that setting and then scroll down to the field that asks for the IP address or hostname of your ISP's secondary mail server. This secondary mail server will provide temporary e-mail storage when your server is not connected to the Internet.

• If you arranged "multidrop" mail service from your ISP, choose "multidrop" and then scroll down to the field that asks for the IP address or hostname of your ISP's secondary mail server. This secondary mail server will receive all e-mail for your domain and store it in a single POP mailbox. Further down the screen, you will need to specify the user account and password assigned by your ISP for this POP mailbox. Your server will periodically fetch this mail and distribute it to individual POP mailboxes on the server. (Note that due to problems receiving mail for mailing lists, we strongly encourage people to NOT use multi-drop e-mail.)

If you want to forward e-mail to another mail server for processing, enter the mail server IP address in the box marked Delegate mail server. A common use for this is if your server is receiving inbound e-mail from the Internet, but you would like to pass that mail to a different mail server on your internal network.

If you have a dialup connection, the server allows you to control how frequently it fetches e-mail from your ISP. This is particularly useful in situations where you incur phone or Internet charges each time your system contacts your ISP. The default settings are every 15 minutes during standard office hours and every hour outside normal office hours on weekdays or on weekends. The fields allow you to customize those settings.

Finally, if you have "multidrop" mail service you need to select the sort method used by the server to decide which user each message should be delivered to. Your server has a default method for this (it examines various headers such as "To" and "Resent-To") which works in most circumstances but is not suitable for certain purposes such as mailing list messages. Some ISPs add a header to each e-mail message which can help your server determine the correct recipient. If your ISP does not add a header to multidrop e-mail, select the "Default" sort method and ignore the "select sort header" field. If your ISP does add a header to multidrop e-mail, then select "Specify below" and enter the header tag provided by your ISP. Because you will experience problems with mailing-lists when using multi-drop e-mail, we strongly recommend that you work with your ISP to have a special header added to each message. The "Default" sort method should be only used as a last resort.

This screen presents you with additional options for controlling how your system handles e-mail.

• Forwarding address for administrative notices: The default address for administrative notices (i.e. undeliverable mail, backup notifications and other status/error messages) is "admin". If you'd like those messages to be sent elsewhere, enter the address here.

  Note

  	Be aware that all messages sent to postmaster, root or mailer-daemon at your domain are sent to either admin or the address that you enter in this field.

• E-mail to unknown users: This field allows you to choose whether incoming messages to unknown users are bounced back to the sender or forwarded to the system administrator. Some users prefer the latter setting because it allows them to catch and reroute e-mail that was incorrectly addressed.

  Note

  	If you choose to have messages forwarded to the system administrator, they will be sent to either "admin" or the e-mail address specified in the forwarding address field mentioned above.

• Internet provider's SMTP server: Normally the server will send outgoing messages directly to their intended destination. If, however, you have an unreliable connection or are using a residential Internet service, it may be advisable to route e-mail via your provider's SMTP server. In that case, you should enter the SMTP server's hostname or IP address here.

  In fact, if you have a temporary dial-up connection to the Internet, you may find that you need to use your ISP's mail server in order to deliver mail to some locations. As a reaction to the huge volume of unsolicited commercial e-mail ("spam"), many Internet sites are refusing direct SMTP connections from IP addresses that are known to be temporary dial-up accounts. For this reason, you may need to use your ISP's mail server since it will have a permanent connection to the Internet.

• POP and IMAP server access: The options are "Private" and "Public". The former allows access only from your local network. The latter allows access from anywhere on the Internet. Think about this carefully. On the positive side, choosing "Public" access allows any of your users to retrieve their e-mail via POP/IMAP from anywhere on the Internet. The negative side is that when you do this, you are reducing your level of security, as you will now have two more services (POP and IMAP) that are listening for connections across the Internet. Both protocols also involve transmitting your password across the Internet in plain, unencrypted text, opening up the possibility that someone could intercept the packets and learn your username and password. Allowing such access can be a great convenience to your users, but if security is a concern you should consider using encrypted webmail instead.

  IMPORTANT

  Even with POP and IMAP configured for public access, users outside your local network are not able to send e-mail using your server as their SMTP host. Allowing this would open your server to abuse by spammers as a mail relay. Users who are travelling should either: a) use the STMP server of their local ISP; b) use PPTP to connect to your internal network; or c) use webmail to read their mail. Webmail provides your users with secure access to both read and send mail via your server.

• Enable/Disable Webmail: With this option you can enable or disable the webmail component of your server. More information can be found in the Webmail chapter.

This section of the server manager summarizes how your server is configured. This is the data that you entered during the installation process and possibly changed later through the server console or the server manager. As you can see from the screen below, this is essentially a report that you can print out for your records. You do not have the ability to make changes from this screen.

Table of Contents

User accounts should be set up for each person in your organization. A user account includes separate, password-protected e-mail and file storage areas.

If this is the first time you are setting up user accounts for your organization, you will need to establish what your naming convention will be. Let's assume you've decided that the account name should consist of first initial and last name. So, if you have an employee named Fred Frog, Fred's user account would be "ffrog". Assuming your domain name is tofu-dog.com, Fred's e-mail address would be "ffrog@tofu-dog.com". Fred's file directory on the server would also be named "ffrog". There are some basic rules built into the server as to what constitutes a valid account name. The account name must contain only lower-case letters and numbers and should start with a lower-case letter (not a number).

User account names are limited to twelve characters to maintain consistency with various versions of Windows. Longer names can be created for e-mail through the Pseudonyms panel. For your information, pseudonyms of "firstname.lastname" and "firstname_lastname" are automatically created for each account.

In the "User Accounts" section of the server manager, you will see a list of your current accounts. If you haven't already created any accounts, select "Click here" and fill in the requested information - the account name (the part of the e-mail address that comes before "@"), the person's name, address, department, company and phone number. As a convenience, the defaults that you entered in the "Directory" section of the server manager appear each time you create a new account. You can, if necessary, modify the information for each user as you create the account.

From the list of user accounts, you can easily modify or remove a user account (by clicking on "modify" or "remove" next to the user name) or set the user's password. User accounts are locked out and cannot be used until you set the initial password for each account. As a reminder of this, user accounts appear in red until the password is changed. (In the example shown here, the administrator has not yet changed the password for user "Sally Salmon").

If you want someone to have an e-mail address at your company, but want the messages forwarded to another external e-mail address, you can create the user account but set the e-mail delivery option in the user account to Forward to address below and enter the external address. If you leave the user account locked out, the user will not be able to access services on your server, but the e-mail will be delivered to the external e-mail address.

There may be times when you do not wish to delete a user account but instead merely want to disable it. For instance, when an employee leaves the company, you may want to immediately remove their access to the server, but still keep their files or e-mail address active until the information can be examined. To disable any user account on your server, just click on the Lock Account link on the User Accounts web panel. As soon as you click the link, the account will be locked out. The user will no longer be able to retrieve e-mail or connect to any files or other resources on the server.

When an account is disabled, e-mail will still be received for that user name, but the user will be unable to retrieve the e-mail. As noted above, if a user account is set to forward e-mail to an external e-mail address, the e-mail will be forwarded to that external address. To prevent this, you will need to modify the properties for that user account.

To re-enable the user account, you need to reset the password using the link on the User Accounts web panel.

Once they have an active account, your users can set their own passwords by accessing the user-password URL. They do this through their web browsers by visiting the URL www.yourdomain.xxx/user-password (where "www.yourdomain.xxx" is the web server name you entered into the server console). The staff at The Pagan Vegan would visit the URL www.tofu-dog.com/user-password.

To make the change, a user would enter his or her account name (the characters before "@"), the old password and the new password (to ensure accuracy, the screen asks for the new password twice). Note that changing the password for a user in the server manager overrides any previous password entered by your user. Therefore, when a user forgets his password, simply reset it in the server manager.

	There is no way for the administrator to recover a forgotten password for a user. All they can do is set a new password for the user.

By default, there is no size limit on the files a user may store on the server or the amount of e-mail he or she may receive. However, if you wish to limit the disk space a particular user account can use, you may do so on the "Quota management" panel in the server manager. As shown in the image below, you will see a list of user accounts, the actual disk space they are using and the quotas, if any, set for that user account.

	Note that the quotas apply to all files that a user stores on the server. This includes not just their home directory, but also all files that they may put into any of the i-bays.

There are two quotas that can be applied to each user account:

• Limit with grace period - when a user's disk usage exceeds this limit, an e-mail warning message will be sent to the user account each night until the disk usage is brought back under the limit.

• Absolute limit - when a user's disk usage hits this limit, the user will no longer be able to save files to the server or receive e-mail.

Note that if the user account exceeds the "Limit with grace period" for seven consecutive days, the account will be treated as if it exceeded the absolute limit and will no longer be able to save files or receive e-mail.

	E-mail for the user account is not lost! It is held in the delivery queue and will be delivered to the user when their disk usage drops back below their absolute limit (or the "limit with grace period" if they were locked out due to seven days above that limit).

By selecting "Modify..." you are able to set a quota (in Megabytes) for a particular user account. Note that you do not have to set both limits for a user account and can choose to set only one of the limits.

If you set a limit and later wish to disable the quota for a given user account, all you need to do is set the limit to "0".

This screen allows you to create, remove or change user groups, which are simply lists of people with a shared interest - for example, they work in the same department or are collaborating on a project. The user group function serves two purposes in the SME Server: it permits e-mail to be sent conveniently to a group of users, and it allows the system administrator to associate groups of users with a single information bay (i-bay).

Creating a new group is a simple three-step process. You enter the group name (as with account names, these should begin with a lower-case letter and consist only of lower-case letters and numbers), followed by a brief description. Finally, check the boxes next to the names of the users who should be associated with that group.

	When you create a group, you are required to assign at least one user to that group. If you fail to do so, the group will not be created and you will receive an error message.

After you add (or remove) a user account from a group, the user must log out and log back in for those changes to take effect. Until the user does so, he or she will still have their old group membership information. For instance, say that you create a new group "sales" and assign user "ffrog" (Fred Frog) to that group. You then create a new i-bay called "salesinfo" that only the "sales" group can access. Fred Frog is still logged into a Windows PC and now tries to connect to the new i-bay through Windows Explorer. He will receive a permission-denied error. He must log out of windows (he does not need to shut down or reboot, just log out) and login again. Now he should be able to go through Windows Explorer and access the "salesinfo" i-bay without any problem.

Any user who has an account on your SME Server will be able to receive e-mail sent to that user ID. For instance, if you have a user named Fred Frog with the user account "ffrog", his primary e-mail address will be "ffrog@mycompany.xxx".

Likewise, when you create a group account, that group account name functions as an e-mail alias, so that messages addressed to the group ID will be sent to all members of the group. If, for example, you create a group called "sales", messages to "sales@mycompany.xxx" will be distributed automatically to all members of that group. As you add and remove members to the group, your server automatically updates the e-mail alias.

In addition to user and group accounts, however, your server also automatically creates several pseudonyms . For instance, for each user account, the server creates two separate pseudonyms using the first and last names of the user. These two pseudonyms are in the form of "firstname.lastname" and "firstname_lastname". Hence, when you create the user account "ffrog" for a user with the name Fred Frog, he will also be able to receive e-mail sent to "fred.frog@mycompany.xxx" and "fred_frog@mycompany.xxx".

Additionally, your server creates a special pseudonym called "everyone" that includes all user accounts on the system. Two other pseudonyms, "postmaster" and "mailer-daemon" are created pointing to the "admin" user.

If you wish to modify or remove any of these pseudonyms, or create new ones, you can use the web panel found under the "Collaboration" section, as shown below.

	The special pseudonyms of "everyone", "postmaster" and "mailer-daemon" will only be visible after you have either added a user account to the system or have added a custom pseudonym. Until that time, these three pseudonyms are there, but will not be visible on the Pseudonyms web panel.

As noted on the screen below, there are some restrictions on the text content of the names. Pseudonyms can be linked to existing user or group accounts. In the example shown, a pseudonym for webmaster is being set to point to ffrog.

The i-bay (information bay) feature of the SME Server is a simple, very flexible and powerful way for you to share information with others. It is a rich enough feature that we've devoted an entire upcoming chapter to discussing i-bays.

When you are supporting multiple domains on a single server, each domain being served is referred to as a virtual domain. (The strict definition of virtual domain is when a single IP address is shared between multiple domains.) When you create a virtual domain using this section of the server manager, your SME Server will be able to receive e-mail for that domain and will be able to host a web site for that domain.

To create a virtual domain, fill in the domain name and a description of the site. You then tell the server where to find the content for that domain - it can be the same as your primary web site, or you can create a new set of web pages and store them in one of your i-bays. Clicking the arrow in the "Content" field will show you a list of your current i-bays and allow you to make a selection. This feature allows you to host multiple web sites from a single server.

Be aware that you can point the virtual domain to either the primary web site or to one of the i-bays. You cannot point a virtual domain to a subdirectory that you simply create inside of the primary web site file area. You need to use an i-bay instead.

	When you are entering the name for the virtual domain, you should supply the fully-qualified domain name. This is the full name of the domain, including any extensions like ".com", but without any prefixes like "www" or "ftp". For instance, you can create a virtual domain by entering "tofu-bird.com", but not by entering "tofu-bird" or "www.tofu-bird.com".

Once you have created a virtual domain, your server will be automatically configured to answer to web requests for www.domainname.xxx and will accept e-mail for your virtual domain as well.

While the server is prepared to offer web and e-mail services for this virtual domain, there is one more step that must occur. In order for users on the Internet to successfully connect to your machine using the virtual domain, you will need to work with your ISP or whoever controls the DNS entries for your virtual domain to have the appropriate DNS entries pointed to the IP address of your server. For instance, your ISP will need to configure an MX record for the domain in order for you to receive inbound e-mail to that domain.

Table of Contents

You can easily back up the contents of your SME Server using one of two methods. Both are controlled through the web panel shown below.

You have four actions you can perform, each of which is described in the following sections.

The first type of backup allows you to save a snapshot of your server configuration onto your desktop computer. This will save all user accounts, user directories, i-bay contents and web content, as well as the configuration parameters entered using the server console and the server manager. The web panel shows you the size of the backup file so that you can verify whether sufficient space exists on your desktop machine.

When you choose Backup to desktop, a browser window will appear that will allow you to name the file and select the location on your desktop where the file will be saved.

If you ever need to restore the original configuration and files to your server, simply select Restore from desktop and a browser window will prompt you to select the backup file from your desktop. Restoration of the information is automatic.

	Ideally you should use Restore from desktop on a freshly installed server. Therefore, if you are planning to do a restore, you should first re-install the SME Server software and then perform the "Restore from desktop" command.

This option allows you to verify that the backup to disk was completed successfully. In rare cases we have found that users ran out of disk space on their client PC while doing the backup to desktop. This options allows you to verify whether or not the backup did in fact complete successfully.

The second type of backup involves configuring your system to perform a daily full system backup to a tape drive using a software package called flexbackup. If you wish to activate this option, check the box next to Enable Tape Backup and then specify the time at which you wish the backup to occur and the time at which reminder notices should be sent.

Be aware that you must use a supported tape drive and that a tape must be inserted in the drive for the backup to work.

	Reminder e-mail messages for tape backups are automatically sent to the e-mail address that is configured to receive administrative notices. This is normally the user admin, but you can change this by going to the Other e-mail settings screen in the server manager.

If you are performing regular backups, you can also restore user data and configuration settings by using the Restore From Tape option. After you press the Perform button, the system will read the files from tape and overwrite any currently existing files. You must reboot your system after the restore for the changes to take effect. Note that in order to restore data from tape, you must have first checked off Enable Tape Backup and scheduled nightly backups. If you have not done this, you will not be able to restore from tape using the server manager.

	Note that this restore procedure only restores user data and configuration information. It does not restore system files. If you experienced a serious system crash, you should first re-install the SME Server software and then perform a restore from tape.

Using this section of the server manager, you can create a reinstallation diskette which will aid in the recovery process in the unlikely event that you encounter a system failure and are required to reinstall the software. The reinstallation diskette will record system and network configuration data for your current system so that you will not need to re-enter that information when you reinstall.

	Each time you alter your system configuration, you MUST make a new reinstallation disk (or overwrite your old one). Otherwise, your existing reinstallation disk will not contain your updated configuration data - which means that after reinstalling the software, you will not automatically see your most recent data.

	Be aware that when you are performing this task, the diskette must be in the server diskette drive, NOT the diskette drive of your local desktop computer.

Note that this reinstallation disk serves a different purpose than the "emergency boot disk" you created as part of the original software installation process. The emergency boot disk allows you to boot your server if you are unable to boot from the hard disk for some reason. For instance, this could occur due to a hardware error or through a mis-configuration of the LILO boot loader during an advanced customization procedure. The emergency boot diskette does not change your software or make any other adjustments to your system.

The reinstallation disk, on the other hand, will boot your system directly into the software installation process and will completely reinstall the SME Server software. It will, however, save you the steps of entering all the network configuration data and allow you to simply move through the configuration screens using the "Keep" option.

If you are using your SME Server to send and receive e-mail, there are now a number of reports available that can help you analyze your system's performance. While the default setting provides basic statistics, if you pop up the menu, you will see a range of other options. If you suspect that there is a problem with the delivery of your e-mail, you can use these reports to see how your system is operating. The information can also help you decide how best to optimize your system.

This panel allows you to view the system log files on you server. As shown in the image below, you select the log file that you want to view and press the "View Log File" button. Without any filter options, you will see the entire log file.

You will probably find the log file of most interest to be messages where most of the system services write log messages. If you enter any text in the "Filter Pattern" box, only lines of the log file containing that text will be displayed. If you enter any text in the "Highlight Pattern" box, that text will be shown in bold. Both options can be used together. Be aware that the filter is case-sensitive.

As an example, if you were interested in messages relating to DHCP, you could examine the log file messages with a filter pattern of DHCP. This will show you all DHCP-related messages. If you further add a highlight pattern of DHCPACK, the messages relating to DHCP acknowledgements will appear in bold.

If you need to shut down or reboot your server, using this screen will ensure that the shutdown sequence occurs gracefully, preserving all configuration and information on your server. There is a similar function in the server console as well. Note that this screen initiates the shutdown or reboot immediately after you click the "Perform" button.

Table of Contents

This link will take you directly from the server manager to the online user guide available at http://wiki.contribs.org/. Note that you must be connected to the Internet to read the online user guide.

If you already have a customized web site, you should not use this section, since it will overwrite your index.htm file.

If you do not have a customized web site and wish to create your starter home page, simply fill out the appropriate fields. This will create a basic home page that you can visit by entering your domain name for your site, http://www.yourdomain.xxx, in your web browser. Note that, as previously explained, there is typically a delay of one or more days before your ISP publishes your domain address records. On your local network, you can use "http://www/" to view your starter web site.

At any point in the future, you can replace or revise your starter web page by replacing or revising the files in the html directory on your server. The html directory for your web site can be accessed using Windows file sharing. Ensure you are logged onto your network using the admin name and password and then use file sharing to go to the server. Select the "primary" share and then select the "html" directory.

Accessing administrative areas of your server via Windows file sharing: To access administrative areas of your server using Windows file sharing, you must be logged into your network as "admin" with the server system password. This applies particularly to the NETLOGON share (where you can edit the netlogon.bat file), the Primary share (where the main web site is stored) and any i-bays that are writable only by the user admin.

Table of Contents

Information bays, or i-bays, are a unique feature built into your SME Server. i-bays are a powerful, simple, flexible mechanism for creating distinct information-sharing sites. The network administrator can define several characteristics for each new i-bay they create:

• write access: the administrator can control access to the i-bay by associating the i-bay with a group. All groups previously created in the groups section of the server manager will appear in the drop-down menu under "group" in this section. In addition, two default groups will always appear - "administrator" and "everyone" (meaning all users, whether on the local network or on the Internet).

• user access via file-sharing or FTP: The administrator can also control who has the ability to save a file into or modify the contents of the files in the i-bay (write access) and who has the ability to view the contents of the i-bay (read access). The administrator can specify whether the entire group can write to the i-bay or whether the administrator alone has the power to save files to the i-bay. Similarly, the administrator can control whether group members only can read the contents of the i-bay or whether the contents can be read by anyone.

• password protection: the administrator can specify whether a password is required to access an i-bay from the Internet and what that password will be.

If you select Password Required, users who connect to the i-bay via FTP or HTTP will be prompted to supply that particular i-bay's username and password. The user name is always the name of the i-bay and the password is whatever the administrator assigns to that i-bay - not the individual user's password. Note that, as with user accounts, i-bay accounts are locked out by default. If a password is required, users will not be able to access the i-bay until the administrator sets the password.

i-bays are simple to create and manage. The "Information bays" section of the server manager shows all current i-bays, the name of each i-bay and a description of its contents. In this section, you can delete an i-bay (which will delete all contents of the i-bay directory) and, if the i-bay requires a password, you can set it here. As with your user account directory, any i-bay that requires a password will appear in red until that password has been changed from "default" (the i-bay for Samson's Farms in the following image is an example of this).

When you create an i-bay, the name may be up to 12 characters long[4] and may contain only lower-case letters, numbers, periods and underscores. The i-bay name should also start with a lower-case letter. For example, johnson, sales and client3.prj8 are all valid names, while 3associates, John Smith and Bus-Partner are not. Finally, an i-bay cannot use the same name as an existing user or group account. It must be unique. Note that there are two special names, primary and public, which are in use by the system and cannot be used for an i-bay name.

14.1. i-bay Directories

Each i-bay has three directories - html, files and cgi-bin. Each directory is briefly outlined below:

• cgi-bin: This directory is set aside to hold "CGI scripts" used for that i-bay's web pages. CGI scripts are tools used in advanced web site creation and are not discussed here.

• files: This directory holds files that can be accessed either locally only or publicly. It can be used for such things as a company download site, a company-wide file sharing server, or a document sharing site for a specific customer. When someone connects to the i-bay using FTP, they will see the files in this directory.

• html: When an i-bay is accessed using a web browser (via http), the user will enter the html directory and the web browser will automatically open the index file (usually index.html or index.htm) in that i-bay. In other words, it will display the web page associated with that i-bay. This means you can have different web sites running on your server, each associated with a specific i-bay. This can be very powerful and useful, as you will see in the upcoming examples.

Generally, you can think of the html directory as the place to put all files, images and documents that you would like to be accessible through the web. The files directory is for all files that you want people to access through FTP or regular file sharing. Note that you can have as many subdirectories as you wish underneath either html or files but you cannot create additional directories at the top level of the i-bay.

If an i-bay is set for no public access via web or anonymous ftp, users connecting to the i-bay through Windows or Macintosh file sharing will see only the contents of the files directory. However, if the i-bay settings are later changed to allow public access through web or anonymous ftp, users will then see the top-level directory of the i-bay with the three subdirectories of html, files and cgi-bin. The items they were used to seeing before will now be found in the files directory.

You can access the contents of an i-bay using a web browser, Windows file sharing / AppleTalk, or FTP.

• accessing an i-bay using a web browser (via http): To view an i-bay using a browser, enter "www.yourdomain.xxx/i-bayname". For example, the URL for Samson's Farms i-bay is "www.tofu-dog.com/samfarms". Assuming you are entitled to access this i-bay, you will see the index.html page in the html directory in the Samson's Farms i-bay. If a password is required to see the contents of the i-bay, a password dialog box will appear before the contents of the i-bay are served to the web browser.

• accessing an i-bay via Windows file sharing and AppleTalk: To access the i-bay using Windows file sharing or AppleTalk, simply navigate to the server over your network browser (in Windows, this would be via "Network Neighborhood") and select the i-bay you want to enter from those appearing. You can only access an i-bay in this way if you are on the local network.

• accessing an i-bay via the FTP server: To access the i-bay using FTP, you use your FTP client to connect to your server and use the i-bay name as the login id. If the i-bay requires a password, you will need to enter the i-bay password as well. If you are using a command-line or graphical FTP client, you will usually be prompted for the login username and password. If you are using a web browser, you will need to enter a FTP URL. This will be in one of the following forms, depending on whether or not a password is required:

  ftp://ibayname@ftp.domainname ftp://ibayname:password@ftp.domainname

  Warning

  	Be aware that FTP transmits all passwords in the clear without encryption and can therefore be a security risk. If you are concerned about security, we suggest you consider the scp "secure copy" command associated with ssh as an alternative to FTP.

  Note that users accessing the i-bay via FTP in this manner are not able to upload files to the i-bay. They can only download files from the i-bay to their client.

  It is possible to upload files using FTP, but to do so you must login to the server with a valid user name, not the i-bay name. That user account must be a member of the group that has been given write permission for the i-bay (configured on the i-bay screen). You would then change to the i-bay directory (using the ftp command "cd ../../ibays/ibayname"). You will now be able to upload files from your FTP client to the appropriate directories.

In the next few sections, we will take a look at some examples of i-bays that have been created by our hypothetical catering and event-planning company, The Pagan Vegan, to demonstrate their capabilities.

No matter how you are going to use an i-bay, the process of creating an i-bay starts by clicking on the "Click here" link at the top of the Information Bays panel in the server manager. You will be presented with the form shown in the image below.

You now need to fill out the form providing the information and making the choices described below. Note that the ftp access described below can be overridden by the FTP access limits setting on the Remote access panel of the server manager. If you choose to "Disable public FTP access" there, ftp access for individual i-bays will not be allowed, even though you will appear to be able to enable it from the i-bay configuration screen.

• Information bay name: This is the short name of the i-bay (subject to the 12-character length restriction mentioned earlier). The i-bay name will be what users will enter in the URL after the hostname to access the i-bay from the web. For instance, if public access is enabled, an i-bay named 'intranet' can be accessed by the Pagan Vegan staff at 'http://www.tofu-dog.com/intranet/'.

• Brief description: This text will appear in various administrative screens and can be a useful reminder of the i-bay content.

• Group: Ownership of the i-bay content is assigned to an existing group. The group ownership plays a role in the next setting for user access.

• User access: You need to decide who will be able to add and modify content in the i-bay and who will be able to read the content.

• Public access: Here you set what type of public access you wish to have for the i-bay. If the i-bay is just to be used by a small group of users, you can leave public access set to the default of None. If you want others to be able to access the i-bay via web or anonymous ftp, you can choose to allow access to just the local network or the wider Internet. You also can choose whether or not you wish to require a password.

  Note

  	If you choose one of the modes of Public access via web or anonymous ftp that requires a password, public access will not be available until you set the i-bay password from the main information bay panel in the server manager. Once you do so, users can access the i-bay through their web browser or ftp by using the i-bay name and i-bay password, rather than their own user name and password.

• Execution of CGI scripts: If you want to use CGI scripts to add functionality to your web site, you can execute those scripts from the cgi-bin directory of your i-bay. However, for security reasons you must first choose enabled here to allow such scripts to be executed.

Once done filling out the form, click the Create button and the server manager will create your i-bay. If you wish to change these settings at any later point, you can click on Modify... next to the i-bay name in the information bays panel of the server manager.

At any point in time you can modify the attributes of an i-bay (except for its name) by clicking on the "Modify..." link next to the i-bay name on the "Information bays" panel of the server manager. For instance, you can easily change the description, group ownership, and access methods.

There are, however, a few items to be aware of when modifying i-bays:

• If an i-bay is set for no public access via web or anonymous ftp, users connecting to the i-bay through Windows or Macintosh file sharing will see only the contents of the files directory. However, if the i-bay settings are later changed to allow public access through web or anonymous ftp, users connecting through file sharing will then see the top-level directory of the i-bay with the three subdirectories of html, files and cgi-bin. The items they were used to seeing before will now be found in the files directory. This may disrupt Windows shortcuts and configuration settings. (The good news is that simply changing the public access setting back to "None" will return i-bay file sharing access to its previous configuration.)

• After an i-bay is modified, all Macintosh users will be disconnected from the i-bay and will need to reconnect. All Macintosh users will receive an alert stating that they will be disconnected in 5 minutes.

Outside of those concerns, you can modify the i-bay as often as you wish. If you wish to change the actual name of the i-bay, you will need to remove the i-bay and create it again. (Note that this will delete the contents of the i-bay, so make sure you have backed up the i-bay data before you remove it.)

"The Pagan Vegan" (TPV) has found that customers like having access to a customized web page which summarizes all of the information pertaining to their particular event. The company finds it reduces the risk of miscommunication and improves its image and reputation. The ".html" files in the i-bay's html directory are based on a template that TPV uses for each customer. Creating each web site is a straightforward, fill-in-the-blanks process.

TPV has chosen a naming convention for i-bays that customers can easily remember - first initial, last name. Because it contains important customer information, only the site administrator can save files into this i-bay. To prevent others from accessing the customer's i-bay, a password is required to enter the site. (TPV created individual passwords and securely provided them to their customers.)

Miles Gabriel has contacted The Pagan Vegan to cater an art exposition. The Pagan Vegan has created an i-bay specifically for Mr. Gabriel's account called "mgabriel". Mr. Gabriel accesses the site with the URL www.tofu-dog.com/mgabriel. As you can see, Mr. Gabriel has access to a summary of his event information. He can check at any time to ensure the arrangements are correct. For example, at midnight tonight he can access his i-bay to show his spouse the design used for his invitations!

Having a shared network drive can be very helpful as a way of storing and sharing documents company-wide. TPV uses an i-bay for a company-wide network drive to hold documents to which all employees should have access. All employees can read and write files to this directory.

The i-bay is accessed via Windows file sharing, AppleTalk or FTP. To access using file sharing, simply access the server over the network (via Network Neighborhood) and open the appropriate i-bay . You will see the files located in the files directory and can then open them or copy them to your system.

This is only true if the i-bay has been set to allow public access via web or anonymous ftp. If an i-bay is set for no public access via web or anonymous ftp, users connecting to the i-bay through Windows or Macintosh file sharing will simply see the contents of the files directory. However, if the i-bay settings are later changed to allow public access through web or anonymous ftp, users will then see the top-level directory of the i-bay with the three subdirectories of html, files and cgi-bin. The items they were used to seeing before will now be found in the files directory.

As an example, when the staff of The Pagan Vegan goes into their Network Neighborhood, they double-click on "E-smith-server" as shown in:

They will then see a list of i-bays accessible through Windows file sharing. When they click on one of them called "sharedfiles", they see the three folders inside of the i-bay:

When they go inside of files, they will then see the list of documents provided there:

As you can see in this example, The Pagan Vegan has several files in this directory for company use. Providing a centralized location for company documents (such as expense report templates) ensures that everyone always has access to these documents and uses the most up-to-date version.

The Pagan Vegan has created an i-bay for its company newsletter / intranet. The company has found this to be a good way for employees to express themselves and share information.

In keeping with TPV's culture, the newsletter is very casual. The company has a high degree of trust in its employees, and, as a result, employees are given full access to the contents of the intranet so anyone on staff can revise it. A more typical company might want the intranet to be created by a particular staff member and "checked in" by the administrator (write access "administrator only").

The intranet is, of course, viewable only from the internal network. No password is required. To access the intranet, TPV employees use their web browsers to access the URL www.tofu-dog.com/intranet.

This particular newsletter was created using a desktop office application called StarOffice (similar to Microsoft Office). The files were created as typical word processing documents, saved into ".html" format and then transferred into the html directory of the "intranet" i-bay using Windows file sharing. Starting with just a blank document, it took only about an hour to create the main page and the other pages that make up this newsletter.

Samson's Organic Farms delivers fresh produce to The Pagan Vegan every week. Samson's and TPV use an i-bay to improve the ordering and delivery process. TPV has created an i-bay for Samson's called "samfarms". It is accessible to the external Internet but password-protected so that only staff at TPV and Samson's Farms can read it. Anyone on TPV's local network can write to it.

Here's how the process works:

• Each week, Mr. Samson updates his online order sheet to include only produce that will be ripe and ready for the next delivery date. He saves it in ".html" format and e-mails it to The Pagan Vegan's administrator.

• Upon receiving the e-mail, TPV's administrator saves the file directly into the html directory of the "samfarms" i-bay.

• The chef accesses the samfarms i-bay, reviews what produce will be available, and plans menus.

• The chef's assistant then reviews the menus, checks against existing inventory and determines what should be ordered. The assistant enters TPV's order directly onto the order sheet in the samfarms i-bay using an HTML editor.

• The day before delivery, the chef reviews his assistant's order (as shown in the image below) using a web browser and makes any last minute adjustments.

  

• On the day of delivery, Samson's shipping staff accesses the i-bay over the Internet, prints out TPV's order from the samfarms i-bay, and fills it.

When customers hire The Pagan Vegan to plan events, they need to review a great deal of information - menu options, catalogues from various vendors for event stationary, table-setting rentals, etc. Often customers want several days to review it all. TPV has only a limited number of catalogues for loan, so it decided to provide customers with access to this information online. To accomplish this, TPV created a download i-bay, called "menus", where customers can download the catalogue files themselves and view the contents on their desktop machines.

TPV set the i-bay for Administrator-only write access, viewable over the entire Internet, with no password required. A customer accesses the site using the FTP client in their web browser to login as the i-bay user name by entering the URL ftp://menus@ftp.tofu-dog.com. This is what the customer sees:

When the cursor is placed over a file name, the full name of the file appears. To download a particular file, the customer simply clicks on the file name. A browser window allows the customer to select a destination directory for the file on his or her local hard drive.

[4] This 12-character restriction ensures that the i-bay can be shared correctly to all Windows machines.

Table of Contents

When you create a user account on your server, this not only creates an e-mail account but also a file directory for that user. This directory is set aside for files that the user would like to store on the server hard drive. It can only be accessed by the user. To access the directory, the user would naviagate to the server via Windows file sharing or AppleTalk.

For example, in Windows the user would open "Network Neighborhood". In the Network directory, you will see all machines accessible to you on your network. The server should be one of them. If it isn't viewable, you may not be logged onto your network under the correct name/password (see the section below on this) or your machine may not be in the same workgroup as the server.

When you click on the server, you will see all i-bays and directories available to you. You will also see the Primary directory (which houses the company web page information). In the example below, Kate Hedges is logged onto her local network as khedges (her account name) with her correct password. When she enters the server, she can see all the i-bays (mgabriel, samfarms, sharedfiles, menus and intranet), as well as her own user directory.

By clicking on her own user directory, "khedges", she can see all of the work and personal files she has chosen to store on the server, as shown in the image below.

To use file sharing from a Macintosh computer, you will need to be set up to use AppleTalk over Ethernet, and to communicate using TCP/IP over Ethernet.

The first step is to choose your Ethernet adapter (usually "Built-in Ethernet" or just "Ethernet") from the AppleTalk Control Panel. If everything is plugged in correctly, the panel should quickly say that no zones were found. If this takes a while, the network cable or network card may not be working properly, and you should see an Apple technician.

To use AppleTalk over TCP/IP it is best that your Mac's network settings are configured via DHCP. The server provides this service, but it must be enabled via the server manager. To enable it on your Mac, choose "DHCP Server" in the TCP/IP control panel. If the control panel asks for a Client ID, simply type in any unique title, such as "Design G4" or "Reception".

	AppleTalk will work without TCP/IP, but will be slower than AppleTalk over TCP/IP.

The next step is to choose a server to connect to via AppleTalk. Click on the Chooser icon in your Apple Menu to bring up a list of file servers to connect to.

Double clicking on the server will bring up a list of all the volumes available for you to connect to, whether or not you have sufficient privileges to use them. Your screen should now look like the following picture.

The "Primary" volume is your default area set up by your server for sharing files and the company web site, while "Home directory" points to the specific user's own space on the server, viewable only by that user. While other i-bays may appear, you may not be able to use them, as you must be a member of the group owning that i-bay to use it.

The highlighted volumes are those you wish to connect to. Any ticked volumes will attempt to mount every time you boot your Mac. If you wish to save passwords in a keychain (Mac OS 9.0 or above), you should read the tutorial available from the help menu on your Mac.

Once you have chosen your volumes to mount, whether or not they are ticked, a dialog box will appear to allow you to log in.

Use your server user name and password to connect. This screen will pop up only once, as the information typed in will be used for every subsequent login. This includes clicking on the Chooser, your server, and then other volumes to mount them as well.

Your desktop should now have icons for each successful volume, such as the icons below:

MacOS 8.5 or above

MacOS 7.5 to 8.1

Notice the wire at the bottom of the icon, denoting a network volume.

Clicking on one of these icons should show you a window similar to the one below. While you should not be able to add files or folders to this window, you may do so in the files, html or cgi-bin folders (permissions allowing).

	Some programs may not work well if run from the server. Programs such as MYOB (multi-user accounting software) rely on certain specific nuances to share the same file with multiple other Macs. Test your applications with multiple users before relying on them in this situation.

Table of Contents

If you wish, you can configure your SME Server so that users can access their e-mail via a web interface. Once webmail is enabled, users will be able to access their e-mail from the local network or anywhere in the world via the Internet using any standard web browser (provided it supports Javascript and tables, which almost all browsers do).

For added security, the server supports the use of Secure Socket Layer (SSL) connections. When your users connect using SSL, all communication between their browser and your web server is securely encrypted to prevent eavesdropping.

	The specific program we use for webmail is the Internet Messaging Program (IMP). If you would like more information about IMP, you can visit the project web site at: http://www.horde.org/imp/

If you intend to enable webmail, you should consider whether your users will use webmail exclusively or will use webmail part of the time (for example, when travelling) and a regular e-mail client the rest of the time. If they plan to use webmail and another client, they should make sure that the other client uses the IMAP protocol. If they use POP3, their e-mail messages will be pulled down from the server into their local e-mail client and will therefore not be visible when the user logs into webmail. If IMAP is enabled on the local client, the messages will remain on the server and will be visible both from the local client and via webmail. (For more information on IMAP and POP3, read the earlier section in Chapter 7.)

A second issue is that using webmail will affect the performance of your server. We recommend that you evaluate your server hardware if you plan to use webmail. (Note that webmail can always be disabled later if you find that your system is not performing well.)

Because the use of webmail can be resource-intensive, the server ships with webmail disabled by default. To enable the use of webmail, perform the following steps:

1. Connect to the server manager and login as the admin user.

2. Click on Other e-mail settings and scroll down to the section where you have the option to Enable/Disable Webmail. You now have two options:

   • Enabled (secure HTTPS access only) - Allows users to connect only through a secure SSL connection. This is strongly recommended because a regular HTTP connection transmits your mail account password across the network (or Internet) in plain, unencrypted text.

   • Enabled (HTTP or HTTPS) - Allows your users to connect through a secure or an insecure web connection.

After you perform these steps, your users should be able to connect and use webmail.

To use webmail, a user first needs a valid user account and password on your server. Next, the user opens up a web browser and points it to your server using an address resembling the following URL:

     https://www.tofu-dog.com/webmail/

The https in the URL indicates this connection uses SSL encryption and provides a secure communication session.

The exact address used in the URL will depend on how you have configured your server. In the example above, www.tofu-dog.com points to the server located at The Pagan Vegan and https indicates that they are using secure communication using SSL encryption. If you choose to provide insecure access, which we do not recommend, the URL would begin with http instead of https. You will need to provide your users with whatever URL will get them to your server.

Note that if your server is behind another firewall, that firewall will need to allow traffic through on TCP port 443 in order for SSL connections to take place.

Once connected, a user will immediately be confronted with a login screen similar to that shown in the screen below. From this screen you can read the help menu (by clicking on the link for New User Introduction at the top of the page) or login with your normal network user ID and password. Note that IMP supports a wide variety of languages for users for whom English is not their native language. (Or who have some desire to have menus in a different language!)

Once logged in, you will see your inbox, as shown in screen below.

Let's take a quick tour of the Inbox window.

In the top left corner is a pop-up menu that shows the list of your available mail folders. In your first webmail session, the only folder choice will be INBOX. As soon as you send an e-mail message, a folder called sent-mail will be created and available in the menu. You can also create additional mail folders at any time.

In the top center portion of the window is a status message indicating the folder you are in and the number of new or recent messages in that folder.

On the left side is a navigation menu allowing you to compose new messages, modify contacts, create folders, modify preferences or logout of the webmail system.

In the main part of the window are the actual messages. Each message has an icon denoting its status at the far left, the date/time of the message, who it is from, the subject and the size. Messages may be sorted by clicking on the column heading. You can read a message simply by clicking on the subject or sender of a specific message. The envelope/arrow icon that you can see in the status area of the second message in the image above indicates that this message is new.

We will describe the various functions in greater detail later in this chapter, but this should be enough to get you started.

Before we discuss the features of webmail, it is important to emphasize that you must always click on the Logout menu item when you are finished using webmail. If you do not do so, anyone else who uses your web browser on your computer (until you exit your web browser or logout of/shutdown your computer) will be able to read your messages and send messages from your account. After a successful logout, you will see the webmail login screen with a message at the top of the screen indicating that your logout was successful.

To compose a new message, click on Compose in the menu on the left. You should see a screen similar to that below.

At the top of the compose screen, your available options include the ability to spell-check the message in your language of choice, or to cancel, save a draft or send the message.

If you choose to save a draft, your message will be saved in a folder called drafts . You may later retrieve this message by using the popup menu in the upper left corner to switch to the "drafts" folder.

Below that are the familiar e-mail fields for you to fill out. At the bottom of the page, the menu of commands is repeated for your convenience.

To read a message, click on the From or Subject fields of the message. You should see a screen similar to the one below.

You now have several options. You can:

• Delete the message.

• Reply only to the sender.

• Reply to all of the original recipients.

• Forward the message to someone else.

• Bounce the message to another person (similar to "Forward" but without providing you the opportunity to comment). [5]

• Save As - save the message to a text file.

By clicking on the Reply button, you will be able to enter a reply window such as that shown below. Notice that the original message text is "quoted" with a ">" character in front of it. At this point, you can type more text or edit existing text, add or delete recipients, spell-check the message and do anything else that you could do in a normal compose window. Again, you can choose to cancel the message, save a draft or send the message.

You can delete a message while reading it, as mentioned previously, or you can delete a message - or a group of messages - from the Inbox view.

To do so, check the box next to each message you wish to delete. After that, press the Delete text button directly above or below the list of messages on the left side. You will now see a trash icon next to the checkbox and a line through the messages.

As an example, in the image above, our user (ffrog) wants to delete the second and third messages. He can click on the checkbox next to each message and then click Delete . This will produce a screen such as that below.

If you do not want to see the deleted messages, you have two choices. If you click on the Hide Deleted text button on the right side, the messages will be hidden from view, but will still be there and could be recovered with the Undelete button. If you choose Expunge, the messages will be permanently deleted.

The server webmail system provides two means of keeping track of e-mail addresses. First, you can have your own Contacts list. Second, you can easily access the company directory that lists all users and groups that have been created.

You can view and edit your contacts through two menu choices. From the left menu you can choose Contacts . This allows you to view or edit contacts, but does not allow you to add a contact to an e-mail list. To add a contact, you must open the Contacts window from the "Contacts" link in a Compose window, as highlighted in the image below.

In either case, you will find yourself viewing a window that looks like the one below.

If this is the first time you have entered the Contacts window, you will not see anything next to the "Select" button. Normally, though, you will see a pop-up menu with all of your contacts in it (as seen in the window above where "bob <bbass@e-smith.com>" appears). To enter a new contact, simply type the e-mail address, a "nickname" that will appear in the Contacts list, and the full name of the person. You must fill out all three fields. Then click Add Contact.

To update a contact's information, select the user's name/address from the contacts pop-up menu. The information should automatically appear in the fields. (If it does not, after selecting the entry from the pop-up menu, press the Select button next to the menu.) Enter the new information and click Update Contact . In a similar fashion you can delete a contact by selecting the contact from the pop-up menu and pressing the Delete Contact button.

As mentioned earlier, if you entered the Contacts window from the link in the Compose window, the three buttons - Insert into To:, Insert into Cc:, and Insert into Bcc: - will allow you to transfer the contact information directly into the Compose window.

To search the company directory, use the lower section of the Contacts window labeled LDAP Search[6]. You have the ability to search either the entire name field or just the surname. Enter the text you are searching for in the entry box and choose how you want to compare the text against the directory. The default is to search for entries where the name is the text you enter, which requires an exact match. You may find it more useful to search for entries where the name contains the search text. A search with "contains" will find names where the search text appears somewhere in the name.

After entering your text and choosing your search options, press the Start Search button to query the directory. As shown in the screen below, your results will be returned in a new LDAP Results section of the same Contacts window. As with the section at the top of the screen, you choose your entry from the pop-up menu (or press the Select button if your entry is displayed already) and the information should appear in the entry box below. Assuming you entered Contacts from the link in the Compose window, you can now insert this information into the To, Cc or Bcc lines of the Compose window.

Note that you also have the option of inserting this entry directly into your Contacts list. If you have a large company directory, you may find this a useful way of ensuring that frequently used contacts are readily available.

	Unlike your local Contacts list, you cannot directly update entries that are in the company directory. Instead, those entries must be updated by the system administrator using the Directory panel in the server manager. See the Directory section of Chapter 11 for more information.

By clicking on the Preferences link on the navigation menu, you can modify preferences for your webmail session, as shown in the screen below.

You have four preferences you can configure:

• Signature - You may include any text that you wish to appear by default at the bottom of your e-mail messages. Once configured, it will always appear at the bottom of a Compose or Reply window when you enter that window. You can, however, delete it for a specific message simply by editing the text in the Compose or Reply text window.

• Full Name - If you leave this blank, all of your messages will appear to recipients as having come from your e-mail address. If you enter text here, recipients will usually see that text first instead of your e-mail address.

• From Address - By default your From address is your regular system e-mail. You do not need to set it here. Enter an address here only if you want people to see a different reply address than your normal system-generated e-mail address.

• Preferred Language - This allows you to specify the language used in the menus.

When you are done modifying your preferences, press the Save Preferences button at the bottom of the page.

[5] In fact, the bounce command will send the message on to a third-party without indicating that you were the one forwarding it. So if "ffrog" sent a message to the "sales" group (of which you are a member) and you then bounced it to another user, that user would see the message coming from "ffrog" and going to "sales", but your name would not appear anywhere in the visible headers. Compare that to a "forward" command where the recipient knows you are the person forwarding the message.

[6] The search is called an LDAP search because the directory is queried using the Lightweight Directory Access Protocol (LDAP), one of the most common protocols used on the Internet for searching directories.

In the process of developing the SME Server, we found it necessary to include some additional open source software. While Contribs.org does not provide direct technical support for this additional software, its availability on the server may be of benefit to advanced users.

	Use of this software is at your own risk and should not be attempted unless you know what you are doing! Contribs.org does NOT provide support for this software.

MySQL is a free, open source database management system. It provides a fully functional relational database similar to that provided by many commercial database vendors. We use it here as the back-end for our webmail application. More information about MySQL can be obtained at http://www.mysql.com/.

PHP is a web scripting language that has become popular because it easily allows developers to create dynamically generated web pages. Additionally, it includes commands that allow for easy interaction with databases, particularly MySQL. The PHP language resembles C or perl and is actually embedded in the actual HTML pages on the web server. If you are familiar with Microsoft's Active Server Pages, PHP works in a similar manner. We have installed it on the server because it is needed as part of our webmail application. To learn how to use PHP in your own web pages, please read the PHP FAQ at http://www.php.net/FAQ.php and the manual at http://www.php.net/manual/.

procmail is an open source mail processing tool that can run on the server to preprocess incoming mail messages perform actions such as filtering them into folders. More information about procmail can be found at: http://www.procmail.org/. Additionally, members of our developer community have contributed HOWTO documents that show how to use procmail and many other packages on our server. See http://no.longer.valid/modules/mylinks/ for links to those documents.

taper is a open source tape backup program provided for those who wish an alternative to the flexbackup program used by default in the server manager. More information about taper can be found at: http://www.e-survey.net.au/taper/.

A local area network (LAN) is the system of wires and other hardware that connects the computers within your office and allows them to communicate with one another. An ethernet LAN is the most common type. Ethernet refers both to a kind of connection and to a protocol for how Internet data packets travel around your network.

The hub, a common component of an ethernet, serves as a point of interface between computers on the network. Each computer on your network is connected to the hub using an ethernet network cable. Different hubs operate at different speeds: slower hubs, operating at 10 MB/sec, are suitable for small networks; faster hubs, operating at 100 MB/sec, are suitable for larger networks. Switching 10/100 MB hubs can operate at either speed, and provide a good way to upgrade your network gradually.

An ethernet adapter, also called an ethernet card or network interface card (NIC), connects each computer to the ethernet LAN. An server with a dedicated Internet connection requires two ethernet adapters; one connects it to your LAN and the other connects it to the external network that leads to your ISP. If your server connects to your ISP using a modem or ISDN adapter, it only requires one ethernet adapter.

A router ensures that Internet data packets (e.g. e-mail, web page information, etc.) reach the appropriate computers on your network. Routing is one of the functions performed by the server in server and gateway mode.

Allowing a third party, such as a systems integrator or networking company, to install your ethernet can be a good idea. It can help you select, procure and install the appropriate ethernet adapters, hub and cables. There are also various how-to guides available in bookstores if you are committed to installing it on your own.

If your IP address is assigned dynamically, you may find it helpful to use a dynamic DNS service. A dynamic DNS service provides you with an automated way to notify them whenever your IP address changes so that they can immediately publish new DNS records for your domain. Without dynamic DNS, you would have to contact your ISP to have them change your DNS records, and your web site and other services would be unavailable for several days until the change was processed. You can easily enable the usage of a dynamic DNS service by selecting it on your server console.

A dynamic DNS service can be a great solution when used with a dedicated connection. With a typical dialup connection, your IP address changes much more frequently (possibly every time your server connects) and, because the server only connects intermittently, there is a delay in informing the dynamic DNS service of the change. This means that the risk of misdirected information is much greater with a dialup connection. For this reason, we recommend and support the use of dynamic DNS services only for dedicated connections.

Contribs.org has tested four dynamic DNS services, of which two are free services and two are commercial services: yi.org (free), dyndns.com (commercial), tzo.com (commercial) and dyndns.org (free). For simplicity, we have preprogrammed the server to work with these services (including pre-installing their client software). If you have arranged dynamic IP address assignment from your ISP and you wish to use one of these services, all you need to do is visit the appropriate web site to sign up for service, and enable that particular function in the server console. In pre-configuring the server for this particular service, we in no way interfere with nor prevent you from using another dynamic DNS service if you wish. To do so, however, would require some customized configuration on your part.

Contribs.org has tested the functionality of these services with our software. However, we accept no liability for any breach of service on their part. A failure on the part of your dynamic DNS service can result in your network becoming temporarily unreachable from the Internet. During these times, your e-mail may be undeliverable.

If your IP address is assigned dynamically and you intend to receive all your e-mail directly (rather than having it stored at an ISP and retrieving it via POP or IMAP), but you decide not to use a dynamic DNS service, you should implement multidrop e-mail as your e-mail solution as this will ensure that no e-mail is misdirected to another IP address (See Some important notes on Service list D (multidrop mail) in Chapter 3.)

Dynamic DNS services are not perfect. They merely point hostnames to IP addresses. If your system receives an IP address via DHCP or PPPoE, it will automatically update the dynamic DNS service each time it comes online. However, when your server disconnects from the Internet, with most dynamic DNS services your server does not indicate that it is offline in any way to the dynamic DNS service. If your system is offline for a period of time, it is possible that someone else will be assigned your IP address by your ISP. If this occurs, with most dynamic DNS services this other system will now start receiving your e-mail and web page requests until your server comes back online and updates the service with your new IP address. There is not much you can do about this, but you should be aware of this fact if there is any chance your system will be offline for a long period of time.

The server comes with a proxy server called Squid which can proxy the web (HTTP), FTP and Gopher protocols. Proxy servers temporarily store information from the Internet on the hard drive of the server, allowing other users to access it directly from that hard drive. For example, when an employee visits a web page, the web proxy server will store that web page. Subsequent visitors to that web page will read it from your proxy server's hard drive, rather than over the Internet. This slightly reduces the network performance for the first visitor to that web page, but can enhance the performance for subsequent visitors.

Many gateway systems require the use of proxy servers, but with the server it is optional. Networked applications such as web browsers will work perfectly without proxying, due to the IP masquerading capability of the server.

In general, we recommend that proxying be disabled in your network applications. Using the proxy server can benefit the organization if you have a slow Internet connection and you've installed your server software on a fast computer. In this case, reading from the hard drive will be faster than reading from the Internet. Remember, though, that a proxy server benefits the second and subsequent visitors to a site but not the first visitor, so this benefit only applies if your users tend to visit the same sites repeatedly.

A proxy server is generally not appropriate if you have a fast Internet connection and you've installed your server software on a lower- or mid-level computer. In this case, reading from the hard drive of the computer may not be faster than over the Internet. It also offers no benefit to your organization if employees at your site do not tend to visit the same web pages.

If you are having difficulty configuring another vendor's hardware or software, we recommend you refer to the manual or contact the vendor for that product.

The SME Server is open source software, Contribs.org encourages users to freely share copies of our software.