MDaemon Server v16.5 Release Notes

MDaemon 16.5.0 - September 13, 2016

SPECIAL CONSIDERATIONS

[16456] Hosted email options with MDaemon Private Cloud are now available. To learn more, please visit: http://www.altn.com/Products/MDaemon-Private-Cloud/.

[17268] F2|Server Settings|IPv6 has changed default to "off" (unchecked) for the option to use IPv6 with outbound hosts for new installs.  This option can cause delivery issues for those who are not prepared for IPv6.

[11436] F2|Logging|Log Mode option to "log by day of the week" (ie, Monday.log, Tuesday.log, etc) has been deprecated and removed. If you were using this option you are now using "log by date" (ie, MDaemon-2016-02-22-X.log, etc). As a result, the F2|Logging|Maintenance checkbox to overwrite log files is no longer necessary and has been removed. Also, there is a new setting added to F2|Logging|Maintenance which lets you set the number of .OLD backups that are created once the max log file size is reached (previously only one was possible). These backups are numbered (the number is part of the file name) with the newest data always first (for example, SMTP(out).log.01.old has newer data than SMTP(out).log.02.old, etc. Finally, added hyphens into the file name to make the date easier to read.

[17076] Ctrl+S|Sender Authentication|SMTP Authentication has a new checkbox which requires all incoming messages arriving from local IPs to use authentication and be rejected if lacking. Trusted IPs are exempt. This setting is enabled by default for first time new installs. However, it is disabled by default for upgraders to avoid delivery issues from clients or other services that don't authenticate and aren't currently listed as a trusted IP. Please enable this option if you can as it is a good security practice.

[16797] In previous versions, gateway address verification never verified senders (only recipients).  A new checkbox at Ctrl+G|Gateway Manager|Global Gateway Settings can toggle this behavior.  It is enabled by default which means this is a change from previous behavior.  It is now possible that messages sent from addresses which can not be verified will be refused whereas they may have been accepted before.  If this is not to your liking disable this option.

[4884] The logic behind the AccountPrune tool's message pruning operation has been changed. This tool is called when MDaemon needs to delete old messages from user and public mail folders. In the past this tool used the "last modified" date from the message file on disk. MDaemon now looks first at the Date: header within the message itself. If the Date: header is present and complies with standards then that date is used to determine message age instead of the file's "last modified" date. This represents a change from previous behavior.

[17099] F2|Logging|Maintenance has a new setting which governs the maximum number of days the SecurityPlus update log will keep data (MDaemon\SecurityPlus\avupdate.log). The new default setting is to keep data going back 30 days. At midnight each night, and the first time MDaemon starts up after upgrading, MDaemon will delete older data from this file.

[16924] As part of the work related to task 16924 (see below) some bugs preventing the immediate sending of "urgent" priority remote mail were found and fixed. Urgent priority messages are defined as message files who's name matches the pattern: "<root>\Queues\Remote\p?10*.msg".  Messages found with that file name pattern will now be properly detected and will trigger a remote queue processing event within 5 seconds regardless of scheduled remote queue processing timers (this was broken).  Also, RAW messages were always expanded out to queue as MD_PRECEDENCE_LOW (the lowest priority value) even when created with higher values.  As a reminder, "urgent" priority messages will trigger a queue run where "high" priority messages merely sort to the top of the queue and wait for the next scheduled queue run.  As a reminder, you can use F2|Server Settings|Priority Mail to define your own criteria for important mail that should trigger immediate queue runs. Finally, IMAP logon failures due to bad credentials were not being written to the event log when so configured (only SMTP and POP failures were). This has been fixed.

[11777] Mailing list digest messages are supposed to be UTF-8 but several bugs were preventing this from working. As a result of fixing these problems it is no longer possible to trigger digest delivery based on the number of lines in the digest data file. So the option to do so has been removed from Alt+G|<list-name>|Digest. Also, the API function MD_ListMaxLineCount has been changed to always return ZERO (meaning disabled). Next, the need for the DIGEST.MBF file is no longer present and so that file has been removed. The MD_ListInfo structure and API functions related to its DigestMBF member have been left in place however changes made to this member are not saved and always contain DIGEST as the value. Finally, the $BODY-DIGEST$ macro is no longer needed and has been removed.

[16664] LDAP: added checkbox to Ctrl+G|Verification and Ctrl+U|Active Directory|LDAP screens which lets you elect to chase referrals.  MDaemon now explicitly disables referrals for every LDAP connection it makes unless this checkbox is set. This represents a change from previous behavior which defaulted to always enabling referrals. That seemed to cause issues for people so it is now disabled always UNLESS you set these options to enable it.

[16698] Ctrl+S|Sender Authentication|SMTP Authentication has a new setting which requires the credentials used for AUTH to match those of the address in the FROM header.  This prevents cases in which one person authenticates as user X while claiming to be user Y within the message.  This is similar to the existing setting we've always had which compares against the return-path value. The wording of that option was also slightly changed. This switch is enabled by default and handles aliases as if they were the real account email.

[17465] Ctrl+S|Sender Authentication|SMTP Authentication screen has two options related to forcing authentication credentials to match something else about the message (either the return-path or the From: header address). Both of these options can potentially cause issues for gateway mail storage/forwarding. Therefore a third option has been added to Ctrl+G|Gateway Manager|Global Gateway Settings which exempts gateway mail from them both. This option is enabled by default.

[16638] MDPGP: Several default settings related to MDPGP use have been changed. If you are installing for the first time or have never accessed the UI to view these settings then these are your settings now so please check them carefully. If you are updating a previous installation and have accessed the MDPGP UI in the past then your existing settings are untouched however you may wish to check and change your settings as follows:

All these options can be found within the MDPGP GUI which is accessible from the Security top-level menu.  Even though several of these settings are now enabled by default (including the entire MDPGP server itself) no work will be or can be done until keys are known and have been added to the key-ring. With this version of MDaemon there are a lot more ways to automate getting that done. Yet this may not be desired in all cases. Please check and change settings to meet your needs.

[17263] When MX record lookups during message delivery result in a DNS server failure result then the message will be left in the queue for attempted delivery during the next processing cycle. This change is in conformity with RFC guidelines. Previously, MDaemon would attempt direct delivery and, failing that, immediately bounce the message in some configurations.

[17522] This version of MDaemon is not compatible with old versions of BlackBerry Enterprise Server (BES) for MDaemon. BES will be disabled when MDaemon is installed. To continue running BES, update to BES for MDaemon version 2.0.3.

MAJOR NEW FEATURES

[15733] WORLDCLIENT/PKA1 PUBLIC-KEY SERVERS (MDaemon PRO only)

WorldClient: WorldClient has been taught to be a very basic public-key server. A new checkbox on the MDPGP GUI enables/disables this. If enabled, WorldClient will honor requests for your users' public-keys. The format of the URL to make the request looks like this: "http://<WorldClient-URL>/WorldClient.dll?View=MDPGP&k=<Key-ID>". Where <WorldClient-URL> is the path to your WorldClient server (for example, "http://wc.altn.com") and <Key-ID> is the sixteen character key-id of the key you want (for example, "0A1B3C4D5E6F7G8H").  The key-id is constructed from the last 8 bytes of the key fingerprint - 16 characters in total.

DNS (PKA1): MDPGP now supports collection of public-keys over DNS using PKA1. A new checkbox on the MDPGP GUI enables/disables this. If enabled, PKA1 queries are made and any key URI found is immediately collected, validated, and  added to the key-ring. To publish your own public-keys to your domain's DNS you must create special TXT records.  An example of how to do this is as follows:  Suppose user arvel@altn.com has key-id 0A2B3C4D5E6F7G8H.  Then, in the DNS for domain "altn.com" create a TXT record at "arvel._pka.altn.com" (replace the @ in the email address with the string "._pka.").  The data for the TXT record would look something like this: "v=pka1; fpr=<key's full fingerprint>; uri=<WorldClient-URL>/WorldClient.dll?view=mdpgp&k=0A2B3C4D5E6F7G8H" where <key's full fingerprint> is the full fingerprint of the key (40 characters long representing the full 20 byte fingerprint value).  You can see a key's full fingerprint value by double clicking on the key in the MDPGP GUI. Keys successfully collected and imported to the key-ring using this method are tracked in a new file called fetchedkeys.txt. Keys will auto-expire and be forgotten according to the TTL value of the PKA1 record which referred them -or- when X hours have passed (a value which you can configure using a new control on the MDPGP GUI) - whichever is GREATER.  So, this means that the value you configure here can be thought of as a minimum length of time (in hours) that a key will be cached. The default value is 12 hours and the lowest acceptable value is 1 hour.

For more discussion and examples on using the pka1 method do a google search for "pka1 keys in dns" and you will find it.

Tracking Keys: As part of this work some internal changes were made such that MDPGP tracks keys by their primary key-ids always and everywhere now rather than a combination of sometimes the key-id and other times the sub-key-id which was messy. The UI was cleaned up to remove two unnecessary columns in the list box related to superfluous (for display purposes anyways) key-ids. Also, this work required me to more strictly control the content of MDPGP's "exports" folder. As a result you will always find exported copies of local user keys there.  Please use OS tools to protect this folder (and indeed the entire PEM folder structure) from unauthorized access because, although they are themselves encrypted, the private keys of users are stored here.

Preferred Keys: Some problems arose as part of this work when multiple different keys for the same email address are on the key-ring.  In past versions MDPGP would simply use the first one that it found. You can now right-click on any key and set it as preferred. When a preferred key is found then that key will be used whenever there are more than one to choose from. When there is only one key for an email address then that key is preferred automatically even if not selected as preferred (but you can still select it as preferred if you want). When multiple keys for the same address are present and none are selected as preferred then the first one found is used. When a key is selected as preferred an asterisk is set in the first column of the UI. Preferred.txt stores the preferred key selections.

Disabled Keys: As part of this work it was necessary to change how disabled keys are tracked. Previous versions tracked disabled keys by placing their key-ids into the plugins.dat file. This version migrates those settings out of plugins.dat and into a new file called oldkeys.txt. Deleted keys are now tracked there.

[2214] XMPP INSTANT MESSAGING SERVER (MDaemon PRO only)

An XMPP server is now included that allows MDaemon users to instant message using third-party XMPP clients. Clients are available for most OSes and mobile devices. For a complete list please refer to http://xmpp.org/xmpp-software/clients/. XMPP instant messaging is completely independent of MDaemon's current chat system (WorldClient Instant Messenger).

The server is installed as a Windows service and a configuration screen for it can be found in the MDaemon UI at Ctrl+W|XMPP. The default XMPP server ports are 5222 (SSL via STARTTLS) and 5223 (dedicated SSL). The XMPP server will use MDaemon's SSL configuration if enabled in MDaemon.

For multi-user chat service, when asked the default is "conference.(your-domain)". For user search service, if asked the default is "search.(your-domain)". Often this will be pre-filled in or assumed by clients. The search fields are 'Name' and 'Email'. The % symbol may be used as a wildcard. Some XMPP clients use DNS SRV record for auto-discover of host names. Please refer to http://wiki.xmpp.org/web/SRV_Records. For more info on XMPP please refer to http://xmpp.org.

[16575] FROM HEADER PROTECTION/MODIFICATION

The purists out there are going to hate this but users who have been tricked in the past will love it. Sometimes users are fooled into thinking an email comes from one person when it is actually from an attacker. This happens because email clients often display only the sender's name and not his email address. This new option defeats such an attack at the cost of altering the From: header value. If enabled, the From: header is modified. For example: From: "Spartacus" <crixus@capua.com> would become From: "crixus@capua.com -- Spartacus" <crixus@capua.com>. This only happens to messages arriving for local users. This option is disabled by default and can be found at Ctrl+S|Screening|Hijack Detection screen.  Enable with care as users are not expecting the From: header to be altered in this way even in order to help recognize an attacker.

[8526] CENTRALIZED MANAGEMENT OF OC CLIENT SETTINGS (MDaemon PRO only)

MDaemon has been taught how to push client settings to Outlook Connector users. Setup|Outlook Connector (or Alt+O|OC Client Settings) opens up a set of screens where you can configure default client settings for all OC users of all domains. On the MDaemon Private Cloud version, the same screens appear within the Domain Manager for each of your individual domains. All these screens mirror those found within the OC client and are intended to allow you to create a set of values which are pushed out to OC users the next time they connect. This feature is disabled by default. Settings are only sent when they are new or have changed since the last time the OC client connected and received them.

Obviously, several of these client settings (like "Your Name" for example) can not be configured with a single value that works for all OC users.  Therefore macros are used such as $USERNAME$ which expands to the correct value for the individual user when the settings are sent to the OC client.  Take care not to place hard-coded values (like "Arvel Hathcock") in the "Your Name" field or every OC client will get "Arvel Hathcock" after the settings are received and applied.  The UI will help police this but it is a point you should keep in mind. A button in the UI will remind and serve as a reference for MDaemon's macro system. A checkbox on the OC Client Settings screen controls whether OC users are allowed to override these settings or not. If you don't want them to be able to change these settings then set the checkbox accordingly and the controls within their OC client will be disabled.

None of this works unless the OC user is using Outlook Connector v4.0.0 or higher.

As part of this work the Outlook Connector screens were moved from Accounts|Account Settings to Setup|Outlook Connector.

[16758] IMPROVED IP SCREENING

Ctrl+S|Screening|IP Screen has a new Import button. MDaemon has been partially taught how to import APF (typically used by firewalls) and .htaccess format files (typically used by web servers). MDaemon understands only a sub-set of this file format (for now). For example, "deny from" and "allow from" are understood but other verbs may not be. Only IP values are imported (not domain names). CIDR notation is OK but partial IP addresses are not. Each line can contain any number of space (or comma) separated IPs. For example, "deny from 1.1.1.1 2.2.2.2/16" is OK. So is "3.3.3.3, 4.4.4.4, 5.5.5.5". These files are designed to control access to services so they are really IP deny/allow lists. You can find these files online to download and can (for example) block all IPs from a certain region or nation and there are even files online that contain lists of compromised IPs. For example, google search for "List of all IPs from <country>". Lines starting with # are ignored.  Lines can contain things other than IP addresses and that should not stop the IP addresses from importing properly. I hope to improve this in future versions so if you have a specific example of a file that you need MDaemon to import properly (but it won't) you can send it to me and I will look into it (arvel@altn.com).

[10239] AUTOMATIC INSTALLATION OF PRODUCT UPDATES

Ctrl+O|Preferences|Updates is a new screen with several controls that allow you to configure whether and when unattended installation of automatically downloaded product updates will be performed (or not). When enabled, MDaemon can automatically update itself, SecurityPlus (if you have it), and Outlook Connector (if you have it). The Outlook Connector update covers just the server piece. Updating Outlook Connector client plugins is covered elsewhere.

When MDaemon detects new versions of these products it will download and queue the update for installation at an hour configured by you (2 AM is the default). Queued updates are remembered across server restarts so they will be performed eventually (even if the server is periodically switched off for whatever reason). Queued updates are listed in a new file called "QueuedUpdates.dat" so you can always delete all pending updates by deleting this file.  The update installers themselves are kept in a new folder called "Updates" off the MDaemon root. If there are multiple products to update they are done one at a time and each one absolutely requires a system reboot when it finishes. If you don't like that then do not enable these settings (they are all disabled by default).

When automatic updates are performed the email to postmaster/admins about an update that they can go and download manually is not generated. Instead, these people receive the post-installation "Special Considerations" email normally sent as well as a separate email stating that the update was performed. Also, the System log tracks all installation activity. For example: "Installing update: <path to installer>" and "MDaemon will be stopped by the installation process" and "Server will be rebooted after installation completes" etc can all be seen there. Lastly, the process can take a long time (many minutes) so the time between the start of the update and the unavoidable server reboot is to be expected. Did I mention that there will be a server reboot?  Get over yourself - its gonna happen :)

As part of this work "MDLaunch /stop" no longer causes MDaemon to prompt for confirmation.

As part of this work the option to inform the postmaster about updates has been moved from Ctrl+O|Preferences|Miscellaneous to the new screen mentioned above.

[16810] IMPROVED WORLDCLIENT

[7937] WorldClient now supports categories for email in the LookOut and WorldClient themes. Users can add the Categories column to the message list by going to Options | Columns and checking "Categories" in the Message List section.  To select categories for one or multiple messages, select the message(s) in question and right click on one of the messages.  In the context menu there is a "Categories >" option.  Click the option and a list of all the available categories will be displayed.  If there are more than 27 category options, an up arrow and a down arrow will be displayed at either end of the list.  To view more options click the down arrow, and to go back up the list click the up arrow. If a user has permissions to edit categories, the user can choose the "Edit Categories" option in the toolbar in the LookOut theme or the "more" drop down menu in the WorldClient theme. If a single message is selected in the list, any saved changes will be applied to the message in question. Users can also use the Set Categories option in the external message view to choose/edit categories. Users can also sort and search by Categories. 

[15829] WorldClient now allows admins to create custom categories. There are two files for this purpose;  DomainCategories.json and PersonalCategories.json. Domain Categories are enabled globally by default.  To disable it, change the value of DomainCategoriesEnabled in MDaemon\WorldClient\Domains.ini [Default:Settings] to "No".  Users are able to add and edit their own categories by default.  To disable this either per user (in the user's User.ini under [User]) or globally (in MDaemon\WorldClient\Domains.ini [Default:UserDefaults]) change the value of CanEditPersonalCategories to "No".  If Domain Categories is enabled, and a user is not allowed to edit personal categories, the user will only see the categories listed in DomainCategories.json.  However, if Domain Categories is disabled, and a user is not allwed to edit personal categories, the user will see the categories listed in PersonalCategories.json.  Users that already have a UserCategories.js file will not lose any changes they have made upon upgrade to MD 16.5, but with Domain Categories enabled, any category in their UserCategories.js file that matches the DomainCategories.json categories will become read only.  There are also two translation files that have been added in order to attempt to handle multi-lingual users on the same server; DefaultCategoriesTranslations.js and CustomCategoriesTranslations.json. The DefaultCategoriesTranslations.js file will be overridden each time MDaemon is upgraded, but the CustomCategoriesTranslations.json file will not be, so add any necessary custom category translations to the CustomCategoriesTranslations.json file.  These files make it possible for WorldClient to recognize a category saved to an event/note/task in one WC supported language as the equivalent category in any other WC supported language.  For more detailed information relating to the files mentioned here, see the MDaemon\WorldClient\CustomCategories.txt file.

[16497] LookOut and WorldClient themes - Added option to check a composed message for attachments prior to sending, when attachments are mentioned in the subject or body of the message

[5304] Admins can now hide the WhiteList and BlackList folders for WorldClient users. To do so, HideWhiteListFolder=Yes and/or HideBlackListFolder=Yes in the MDaemon\WorldClient\Domains.ini file under the [Default:UserDefaults] section. Individual users can continue to see the WhiteList and/or BlackList folders if the their User.ini has HideWhiteListFolder=No and/or HideBlackListFolder=No in the [User] section.

[16545] [16729] [16728] Account Editor|Web Services and Ctrl+T|Template Manager|New Accounts|Web Services have each had two new checkboxes added which control whether an account is allowed or required to use WorldClient's Two-Factor Authentication (2FA) system. When the checkbox to allow 2FA is enabled then users decide whether to use 2FA or not (see users manual for details on setting up 2FA). However, if both the allow and require 2FA checkboxes are enabled then users who have not setup 2FA will be given a session and redirected to a page to setup 2FA the next time they login to WorldClient. To force 2FA use immediately you must restart the WorldClient server to force all users to login anew. Once a user's authentication application's pairing has been verified with WorldClient, the user will be redirected to the normal WorldClient view. When 2FA is required then it cannot be disabled from within WorldClient's Options|Security page. However, the same users can still use the Get A New Shared Secret and Show My Shared Secret buttons.

[16293] MDPGP SIGNATURE VERIFICATION (MDaemon PRO only)

MDPGP can now verify embedded signatures found within messages. Previously it was not able to do this unless the message was also encrypted and signed. With this change signatures appearing without encryption can now be verified. You will see appropriate logging in the MDPGP log when this happens along with new icon and/or text which WorldClient will show when it displays a verified message. As a result of this change a new check-box has been added to the MDPGP GUI which enables signature verification for all non-local users (enabled by default) or you can specify exactly which email addresses can and can not use the service if you need (click the "Configure exactly who can and can not use MDPGP services" button for that).

CHANGES AND NEW FEATURES

FIXES

MDaemon is a registered trademark of Alt-N Technologies, Ltd.
Copyright ©1996-2016 Alt-N Technologies, Ltd.