text:
A forensic scientist at the state crime lab intentionally hid her backlog of cases for years, failed to test DNA submitted in 40 cases, and kept evidence from those cases in her possession, according to a DPS audit uncovered by a six-month 12 News Investigation.
In at least one of those cases, justice may have been denied.
On October 18, 2009, 19-year-old Melissa Rukstelis called Tempe police to report she was sexually assaulted by a man she said she dated in high school.
Rukstelis had been at a party hosted by a friend in the area of McClintock and Hermosa Drive, the police report said. She told the investigating officer, Det. Sue Schoville, she had recently re-connected with David Baldry, 21.
Rukstelis told the officer she invited Baldry to the party to "catch up" and that they hadn't been in a romantic relationship since she was in high school. Rukstelis admitted to drinking heavily during the party and, according to the police report, vomiting several times.
The police report said that at 4 a.m., Baldry offered to give Rukstelis a ride home because the person who was supposed to give her a ride was asleep.
A person at the party told police that he helped Baldry escort Rukstelis to Baldry's car and put her in the back seat as this was "easiest" for them. The witness told the investigator Rukstelis was lying in the car, wearing a seat belt and she was close to "passed out" when she and Baldry left, records show.
The police report showed that Rukstelis laid in the back of Baldry's Ford Taurus and gave him directions to her house.
Baldry later told police he stopped two houses down from the party so she could throw up, as well as a second time on a residential side street along Baseline Road.
While Rukstelis admitted to police that she was "extremely intoxicated," she said she remained awake and noticed Baldry kept driving around instead of taking her home, according to the report.
Rukstelis told police that when they finally reached her apartment complex she fell asleep in the backseat of the car.
When she woke up, she said her jeans were pulled down "completely off her right leg and down by her knee on her left leg," according to the police report. Rukstelis also told the officer Baldry digitally penetrated her against her will. She said she thought she was "dreaming" but woke up and told him to "stop." "I crossed my legs" and "pushed his hand away."
Rukstelis said she then fell back asleep and Baldry performed oral sex on her, according to the report. At that point the police report shows she pushed Baldry toward the door and told him to get off of her.
She told the officer Baldry became upset with her, pushed her and held her down. The officer took photographs that showed Rukstelis had multiple scrapes, scratches and bruises on her arms, including a three-inch scratch she says was from Baldry holding her down. In addition, she had multiple purple and red contusions on her back, according to the police report.
Rukstelis got out of the car, realized she'd left her purse and returned to get it, the police report said. She told the investigator that at that point Baldry got out of the car and approached her, but she couldn't remember if she "slapped" or "punched" him in the face. In the report, she said Baldry uttered a profanity at her and pushed her against the car, then she ran into her house.
Rukstelis told police she laid down in the tub as she continued to be sick and did not immediately contact police because she was "too intoxicated."
The Tempe Police Officer seized the clothes Rukstelis wore to the party as evidence and a sexual assault examination was performed on her, records show.
Suspect denies sexual assault
On October 23, 2009, Schoville called David Baldry and recorded the conversation. The report and audio recording reveals Baldry only said he knew Rukstelis from attending Mountain Pointe High School. In the recording, he claimed he had no prior sexual history with Rukstelis, "no high school relationship with Rukstelis or even a romantic relationship."
Baldry was adamant on the recording that they had no history together other than that of mutual friends.
"We didn't even date in high school, we were just friends," Baldry said on the recording.
However, one of Rukstelis' friends who lived at the home where the party was held confirmed to the detective that Rukstelis and Baldry were involved intimately in high school, records show.
During the recorded conversation, Baldry also denied removing her pants, putting his fingers in her vagina, and performing oral sex.
Baldry said he offered to let Rukstelis sit in the front seat but that she wanted to lie down in the back seat and told the detective she passed out in the back seat when he got to her apartment complex. He said he remained outside the car while trying to wake her up, according to the recording. He told the investigator that when Rukstelis woke up she started yelling at him, calling him names and then slapped him in the face.
According to police records, Baldry said that at no time were Rukstelis' pants down. He said he never touched her private parts or performed oral sex on her. According to the report and the audio recording, Baldry said there would be no reason to find his DNA on Rukstelis' body.
Baldry told police he'd done nothing wrong and was just trying to be a "good friend," the report said. He told the officer that he did not touch Rukstelis other than by shaking her shoulder and grabbing her arms when her knees buckled under her. Baldry denied any physical contact with her and denied all her accusations.
The investigator encouraged Baldry to offer up his DNA to avoid being falsely accused, the report said. However, on the recording, he can be heard saying "this is making me extremely uncomfortable" and "I just hear stories all the time of just bullshit, like people getting wrongly accused for things."
He declined to willingly offer up his DNA during the conversation, according to the police report and the audio recording.
After the alleged assault, Rukstelis was interviewed a second time at Tempe Police Headquarters. She also obtained an Order of Protection against Baldry from the Chandler Municipal Court on October 30, 2009, records show.
Police reports show that on August 11, 2010, the DPS Crime Lab notified Tempe PD that no semen was detected in the sex assault test kit. However, the lab said further testing – called Y-STR – could be done to try to locate male DNA on the collected evidence.
To conduct Y-STR testing, Schoville would need to submit DNA from the suspect for the scientific analysis. On September 2, 2010, she obtained a court order from Maricopa County Superior Court Judge White for Baldry's DNA. The order allowed Schoville to swab the inside of Baldry's mouth, which she collected as evidence at the Tempe Police Department.
The swabs were sent to the DPS Crime Lab so that the Y-STR testing could be completed and a possible suspect identified.
But there wouldn't be immediate answers. This case would sit at the DPS Crime Lab for years.
Audit uncovers crime lab misconduct
Kathy Press, the supervising forensic scientist tasked with examining this evidence, was hiding cases from her supervisors to cover up her backlog of cases, DPS records show. She even kept evidence "in her possession", according to the state audit.
Supervising Forensic Scientist Jennifer Kochanski discovered the misconduct when she began an audit of the DNA unit's backlog in October 2015. Kochanski identified 29 cases Press was assigned that were not completed in a timely manner, DPS records show.
"In January 2016, you reported 11 additional cases were on your backlog. These additional cases were in your possession. You had the evidence in your possession and the case files were at your desk. Many of the cases identified were cases from several years prior," Kochanski wrote.
On January 19, 2016, Kochanski wrote that the Scientific Analysis Bureau (SAB) identified a total of 40 cases assigned to Press in which she failed to complete the scientific analysis process. Reports show that many of these cases were several years old.
Kochanski indicated it was difficult to track the cases because Press had taken possession of the evidence but then "unassigned" herself from the case. Kochanski wrote that she had to check the "audit trails" to see who worked on the case, which is how she discovered Press' involvement.
As the investigation continued, Kochanski determined Press' actions appeared to be "an intentional act to hide your backlog of cases."
Among the 40 cases, one in particular stood out as an "old case": the Tempe Police Department's sexual assault case involving Rukstelis.
SAB determined that Press did not complete the de-convolution work even though the original profile she entered received a CODIS hit for a suspect in December 2014. The investigation also concluded that Press failed to notify Tempe Police about this hit and, at the time of the investigation, had not completed the report she was required to issue to Tempe PD, according to state records.
Press was put under internal affairs investigation. Records show Kochanski asked Press why she had not completed her cases. Kochanski asked if Press was "too busy...or overwhelmed." DPS records show Press said, "No, I just haven't gotten to them yet." Press agreed that these cases should have been completed "a long time ago."
Kochanski also noted that when police departments inquired about the status of testing, emails revealed that Press either didn't respond to their emails or said she would get them information but didn't follow up.
According to DPS records, when asked, Press agreed with the allegation that she was "inefficient" "because there's cases that are on my backlog that should have gone out."
This audit wasn't the only time there was an issue with Press' backlog of cases. Internal documents from Press' personnel file show in January 2015, Central Regional Crime Lab Manager Scott Rex identified 37 of Press' cases that were four to five years old. At that time, Press was put on a performance improvement plan and relieved of some of her responsibilities.
As a result of the policy violations and misconduct discovered during the internal investigation, Press was demoted from supervising forensic scientist to forensic scientist IV effective May 21, 2016. The order was signed by Deputy Director Lieutenant Colonel Heston Silbert.
On May 11, 2016, prior to the demotion taking effect, Press tendered her resignation effective May 24, 2016. She wrote that personal and family circumstances have made it difficult for her to continue a career at DPS.
The same day, she notified the Tempe Police Department that she had finished the scientific analysis of their 2009 sexual assault case and David Baldry's DNA was a match.
Too little, too late
On September 14, 2016, Tempe police arrested Baldry on suspicion of sexual assault. Det. Greg Bacon questioned him for three hours.
Initially, Baldry again denied allegations that he touched Rukstelis' vagina or performed oral sex on her, according to police records.
"I did not sexually assault her," Baldry said, according to a video recording of the police interview.
After reminding Baldry of his statements in 2009, Bacon tells him, "you lied."
"That's pretty clear-cut. You lied. There's no other way to say it. You lied. There's no other way to say it. You lied. Your DNA was found inside of her vagina," Bacon told Baldry, according to the recording.
Baldry finally cracks.
"It was like foreplay, it was just like, you know touching and all of that," he said.
"He wouldn't until they had him pinned. It was like he was putting up that surrender flag: 'I'm done. I'm done. You've caught me," said Rukstelis.
During the interview, Baldry told Bacon that he "did not think Rukstelis was too intoxicated to provide consent." He also told the detective that when he realized she had passed out or fallen asleep, he stopped, according to police records.
There would be no victory for the alleged victim.
The Maricopa County Attorney declined to prosecute Baldry and said the six years it took to receive the DNA results was a factor.
"And that six to seven years minimum what it would take before we would get in front of a trial, yeah it had an effect." said County Attorney Bill Montgomery.
He added that six years was "a ridiculous amount of time" to complete testing.
Montgomery said that other factors contributing were a consent issue and a lack of witnesses.
"It's not an instance in which she did anything wrong, the case is not gonna come together for us like we need it to, as we know we need it to in order to get a jury to convict," he said.
Montgomery said Rukstelis did everything right – in reporting, in having an exam done, and in cooperating with law enforcement.
"Even if everybody is telling the truth, we would have a hard time because of that consent issue," said Montgomery.
The county attorney said he is required to prove the victim did not consent and the suspect knew the victim wasn't consenting.
"No one is saying that they disbelieve the victim," Montgomery said. "The question becomes, 'do we have the evidence to present to a jury where we can get them to convict?'
"One of the things we look at as prosecutors is the amount of time since an incident occurred for several reasons. Number one, the jury's going to know the date that a crime occurred and they're also in their own minds going to try to figure out, 'well, why are we here today after so much time has elapsed?'
"And there's practical concerns too, about the ability for people to remember what they said back when the crime originally was investigated.
"Where you have differences between what somebody may have said, particularly if their recollection at the time could have been impacted by substance use, whether legal or not, and then what they're able to recollect when they get on the witness stand in front of a jury -- all that factors in too."
Ultimately, Montgomery said they decided there was not a reasonable likelihood of a conviction.
Rukstelis said she feels victimized by the system designed to seek justice for her.
"Someone does it once, they can do it again. And I want people to know who he is," she said.
12 News was unable to reach David Baldry after several attempts but did leave a message with someone who knows him to ask him to call.
Over the course of our investigation DPS respectfully declined to speak on camera but issued two statements:
Tempe PD case 2009172852 (DPS DR 2009744972) was submitted to the DPS Crime Laboratory in November 2009, with a request to perform DNA analysis on a sexual assault kit. A Scientific Examination Report was returned to Tempe PD in January 2010, stating that no semen or spermatozoa were detected in the sexual assault kit. In September 2010, Tempe PD requested that the Laboratory attempt further DNA analysis. In early 2016, it was discovered that the ADDITIONAL DNA analysis had NOT been completed for this case. The analyst assigned to the case did not complete the analysis or report the results in a timely fashion, ultimately reporting the DNA results in May 2016. When this was discovered, the analyst was disciplined and demoted. Subsequently, the analyst resigned from the Department. The excessive time to complete the analysis is regrettable. ALTHOUGH the Laboratory has procedures in place to ensure that this does not OCCUR, THE INVOLVED EMPLOYEE DID NOT FOLLOW THESE PROCEDURES, PREVENTING MANAGEMENT FROM DISCOVERING THE ISSUE EARLIER.
The second statement from DPS identified the former employee as Kathleen Press:
Through an internal investigation it was discovered a former employee had gone to lengths to hide their work files and mask their incompetence. The case for which you inquire was assigned to this employee, who as a result of our internal investigation was demoted and subsequently resigned. Under Col. Milstead's administration, beginning in 2015, a department-wide, work-performance accounting and auditing system was implemented. As a part of this system, greater scrutiny and accountability is provided to each employee's work. As a result of a supervisor's diligence, the aforementioned misconduct by a former employee was discovered. The employee's lack of professionalism is beyond regrettable, it is reprehensible. In the last two years we have increased the speed and accounting of cases assigned to the Crime Lab and specifically the Forensics Unit.
All of the major laboratory disciplines have improved their processes and have lower backlogs than in 2013. The backlogs for the disciplines have improved as follows:
• Blood Alcohol, from 759 cases to 4
• Controlled Substances from 1,554 cases to 1,240
• DNA from 5,348 cases to 1,310
• Latent Prints from 1,411 cases to 176
• Toxicology from 877 cases to 513
Press issued the following statement through a spokesperson:
For just under 10 years, I had a productive career with the Arizona Department of Public Safety, rising through the ranks through multiple promotions into a supervisory role. I did so despite an overwhelming caseload, little support and a leadership structure that refused to solve or take responsibility for a well-documented backlog in DNA testing.
I resigned from DPS by my own choice in 2016. I did so because I could no longer work for an organization that continued to allow issues to fester nor work in a position that was negatively impacting my health and my family life.
The case in question represents a true tragedy – one caused by DPS leadership's refusal to help fix a backlog they knew existed. Rather than attempt to solve this backlog crisis, they chose to ignore it and sweep it under the rug. This blame deflection apparently continues to this day, as their untrue statements about my performance indicate. DPS leadership's false assertion that I let this case languish for six years flies in the face of the truth reflected by the case files.
I never allowed this case or any other case to sit idle for undue periods of time to hide incompetence or misconduct. At a time when I was taking on multiple leadership roles – positions that today are handled by multiple full-time employees – I was also required to maintain a caseload that was in no way a one-person job. As emails and case files document, DPS leadership was well aware of this caseload and the department's backlog, as were others involved in the cases. They were also well aware of my assumption of additional roles and responsibilities, and my attempts to re-assign cases so they could be completed.
While it may be convenient for DPS to "throw me under the bus," that's simply a deflection of what really happened here. To make excuses is simply to fail the victims of these crimes again. That failure is beyond unfortunate.
The majority of Press' 40 cases are from Tempe police. It's not clear if DPS notified any of the agencies about what happened. However, when we reached out to Tempe, they were not aware of the situation.
Here is the list of her 40 cases:
2009703286 [Coolidge PD, PC]
2009708038 [Glendale PD, PC]
2011708490 [Glendale PD, PC]
2012708795 [Tempe PD, SA]
2010729903 [Glendale PD, SA]
1978021106 [Tempe PD, VC]
2007740874 [Tempe PD, SA]
2007741955 [Tempe PD, PC]
2008720387 [Tempe PD, VC]
2009704369 [Glendale PD, PC]
2009708639 [Surprise PD, PC]
2009724452 [Tempe PD, SA]
2009739417 [Tempe PD, PC]
2009744972 [Tempe PD, SA]
2010720698 [Tempe PD, PC]
2010731792 [Tempe PD, PC]
2010740660 [Tempe PD, SA]
2011738986 [Tempe PD, PC]
2011732514 [Tempe PD, SA]
2011732754 [Tempe PD, SA]
2012708024 [Tempe PD, PC]
2012712817 [Tempe PD, VC]
2012718026 [Tempe PD, PC]
2012720787 [Tempe PD, VC]
2012722405 [Tempe PD, VC]
2012727440 [Tempe PD, SA]
2012734155 [Tempe PD, SA]
2012730880 [Tempe PD, VC]
2013707961 [Yuma PD, SA]
1997048006 [Tempe PD, SA]
2009727317 [Tucson PD, SA]
2010729202 [Tempe PD, PC]
2010734389 [Tempe PD, PC]
2012708030 [Tempe PD, PC]
2012714208 [Tempe PD, PC]
2012723616 [Tempe PD, PC]
2012726211 [Tempe PD, PC]
2012730880 [Tempe PD, PC]
2012735051 [Glendale PD, SA]
2013701406 [Prescott Valley PD, PC]
PC = Property Crime
Katie Bieri contributed to this report.


text:
You are about to enter a website that may contain content of an adult nature.
Hello everyone, this is Indian cam girl XXTitsGaloreXX here. I'm 25 year old Female speak English in the Indian live sex chat action. I am a smart, sexy female looking to have fun and meet new people. I love having and talking about sex. I love showing off this sexy body and getting my toys out for you.. What makes me special is Im Being Myself.. I can be spontaneous! Also I enjoy a good conversations! Open-minded personality! I like guys who doesnt treat u like trash! And knows that this is what we do here for a living. FUN FLIRTY OPEN MINDED FUNNY LOVE TO LAUGH AND HAVE A GREAT TIME LOVE TO SHOW MY BODY AND TOUCH MYSELF EVERY WHERE... is my expertise and also what I will do in Indian live sex private show. I have Green eyes, Long Black hairs and my measurements are 38-60-90. For Turn ons: SMILE!!! I find that smile is the being of LOVE... I enjoy seeing a guy CUM : Its my big Turn Ons ! Also a guy who can hold a good conversations as well as Erotic Sex Chat.. mmmmmmm.... For TurnsOff: I`m a nice girl with real personality, not a dummy. Please keep that in mind while we are together. ;o) I dont like Who cant polite themselfs!!!!!!!. If you prefer kinks, then Piercings,Tattoos,Shaved, are mine. I'm just hungry for a HARD cock, can't wait to see u in my Indian webcam sex chat room! :)
This website contains live indian sex cams, desi cams, hindi cam and tamil sex chat related sexually explicit content.
You must be at least 18 years of age to enter this website.
© Since 2012 myindiansexcams.com Indian Sex Chat Network All Rights Reserved
AllHosts1 - AllHosts2 - AllHosts3 - AllHosts4 - AllHosts5 - AllHosts6 - AllHosts7 - AllHosts8 - AllHosts9 - AllHosts10 - AllHosts11 - AllHosts12

subset: commoncrawl


text:
Batman to Join Superman in 'Man of Steel' Sequel
Time Warner Inc.'s Warner Bros. showed footage from six movies at Comic-Con and brought out stars including Tom Cruise, Sandra Bullock and Jeff Bridges, but it was a single image that stole the show.
A merging of Superman's iconic "S" over Batman's black-winged creature on the big screen sent the approximately 5,000 people in the San Diego Convention Center's Hall H into near-hysteria as director Zack Snyder announced that a sequel to June's hit "Man of Steel," expected in 2015, will also feature the caped crusader.
There were no further details, as Snyder and "Man of Steel" writer David S. Goyer are still working on the story. Though Henry Cavill will again play Superman, Warner has yet to cast an actor as Batman. Christian Bale, who played him in the "Dark Knight" trilogy, will not take the role yet again.


text:
"Farewell Exile"
Season 4 Episode 6 | 15m 32s
When a letter arrives from her husband, Fatima must choose between a continued life of poverty or a dangerous journey across international borders with her young son. Directed by Lamia Alami.
Aired: 08/03/16Video has closed captioning.
Problems Playing Video?
Film School Shorts is made possible by a grant from Maurice Kanbar, celebrating the vitality and power of the moving image, and by the members of KQED.


text:
Tales From The Sharrows
666 Never Gonna Happen Drive, North by Northwest
Washington, DC 20003
Having lights on your bike (and using them at night) is something I feel very passionately about and it's something that you should feel passionately about as well. They're cheap and easy and could save your life.
Tonight was the night that I
WABA, in case you don't know, has its offices in an underground bunker that could probably withstand a blast from a multi-kiloton nuclear weapon (Pick another target, enemies of freedom). The hard-working staff remained hard-working throughout and beyond our visit. It's not easy to make bike advocacy happen and they do a great job and I'm glad that collectively we found a way to help them out a bit. I have no doubt that they will translate your generosity into great things. Vote for them as best DC non-profit here. Here are some pictures, without context or explanation or even captions:
I'd like to thank Greg for the tour and the bike-centered conversing. I'd also like to thank him for the insider-y info about bike infrastructure that I hope will be brought to fruition soon. Or if not to fruition, at least to Fruitopia.
After leaving WABA, I salmoned down Ontario (Delicious Ontario salmon!) to Euclid (You klidding me, right?) and over to the 11th, where I saw a couple of other bicyclists, all heading in the other direction. I'm just never over in this part of town, so I won't even hazard a guess as to where. Home, I guess.
11th went from the 11th I didn't know to the 11th I did and then it was [insert previous ride home post here]. Chain skipped a bit, so I don't know what that's about. Probably some sort of gypsy curse. Took it really easy on Penn once I realized that the traffic lights weren't going to be any different if I went any faster. I feel like this is the key insight of bicycling: you can't beat the system. That was also the key insight of 1984. That and how terrifying cages full are rats are.
What if Congress was more like feudalism (don't tell Susan Reynolds) in that each representative and senator was responsible for providing a certain number of security guards?
Along East Capitol, I did my usual moderately paced dawdle. The driver of a Mercedes considered making a left turn across my path, but didn't because I didn't stop for him. He flashed his high beams at me, as if to say "stop for me." Perhaps I should have switched my front light to blink as if to say "nope."Later, I passed a charming looking family (or maybe just dude with his mistress and love child. I don't want to make assumptions), all of whom who thought it would be a lovely idea to have a conservation while standing in the bike lane. One ding and nothing. Two dings and I felt like I might has well have not dinged at all (don't tell Tennyson). I rode by and didn't say anything or even look askance. I suppose I could have made a big deal over being inconvenienced, but I wasn't really inconvenienced.
Swings coffee tomorrow, if anyone is inclined.


text:
A historical and informational resource for the alumni community and beyond, the Legacy Project profiles people associated with named funds at Columbia Law School. The goal is to honor, commemorate, and preserve the institutional memory of individuals who have made named funds possible by telling the story of their impact on the community.
Visit the individual pages to learn how these funds accomplish the ideals of the individuals profiled and enhance our student and academic communities.
For information on how to create a named fund at Columbia Law School, please contact Anina Gayla, Director of Donor Relations, at 212-854-1752 or [email protected]
If you wish to make a gift to one of these funds, please give online. Select "other" under the designation line, and on the following page please type the name of the fund in the comment box.


text:
Job Seekers, Welcome to HOSA Career Center
The job you tried to view is no longer active.
See similar jobs below or perform a new job search.
See similar jobs below or perform a new job search.
Sort By
10,067 'flex OR medical OR lab OR tech OR STATECODE:"PA"' Jobs
Saint Mary Rehab Hospital, Pennsylvania
Kindred Healthcare
1 Week Ago
Danville, Pennsylvania
4 Weeks Ago
Saint Mary Rehab Hospital, Pennsylvania
Kindred Healthcare
4 Weeks Ago
Harrisburg, Pennsylvania
Penn State Health
4 Weeks Ago
Philadelphia, Pennsylvania
6 Days Ago
Paoli, Pennsylvania
5 Days Ago
Chief Nursing Officer for new community hospital under construction; in attractive mid-Atlantic area
Enola (Harrisburg), Pennsylvania
PSH Hampden Medical Center; part of Penn State Health, a newly formed $2.3B regional health system
4 Weeks Ago
Lancaster, Pennsylvania
Penn Medicine/LGHealth
6 Days Ago


text:
Click or tap to see a larger version
Fannie Nampeyo, Hopi, Polychrome jar with bird element and geometric design
$ 6200
Polychrome jar with bird element and geometric design
5 1/2 in H by 9 in Dia
Condition: Very goodℑs=4
Signature: Fannie Nampeyo
100 West San Francisco Street, Santa Fe, New Mexico 87501
(505) 986-1234 - www.andreafisherpottery.com - All Rights Reserved
Fannie NampeyoHopi
Fannie Nampeyo was born in the Corn Clan home of her mother, Nampeyo of Hano, around 1900. She was the youngest daughter born to Nampeyo and Lesou. The older women of her father's family gave her the name "Popongua" or "Popong-Mana," which means "Picking Pinons." It has been said the name "Fannie" was given to her by either missionaries or health care workers on the Hopi Reservation.
Fannie attended the Polacca Day School, completing her formal education by graduating from third grade. While many young girls in the Hano-Tewa Village area of Hopi grew up learning to make pottery alongside their mothers, Fannie didn't. In her teens she worked at the Hubbell Trading Post as a maid and contributed to her family income that way. She has been referred to as "tempestuous" in those days, and least compatible with her mother. It wasn't until after she married Vinton Polacca in the early 1920's that she began to be interested in making pottery. That was also about the same time her mother was beginning to lose her eyesight due to untreatable trachoma. Fannie worked with her mother more and more, learning to polish from her father and how to decorate and paint from her mother. In those years, if they signed their pottery the signature was simply "Nampeyo," and as Nampeyo herself never learned to read or write, Fannie most likely did all the signing. Later pieces they collaborated on were signed "Nampeyo Fannie" while pieces Fannie made by herself were signed "Fannie Nampeyo" and usually included a Corn Clan symbol.
From the early 1920's until she passed in 1987, Fannie was an outstanding and prolific potter. She most often made jars, cups, saucers, miniatures and bird effigy bowls. Her favorite styles were red and black on yellow and black on yellow. Her favorite designs appear to be the favorite designs of her mother: rain, clouds, feathers, stars and migration patterns. Her participation in the Hopi Show at the Museum of Northern Arizona in 1961 earned her a first place blue ribbon.
After her mother passed, Fannie became the Matriarch of the Hopi-Tewa Corn Clan, as her mother had been. Fannie didn't just make pottery either: she developed a successful tamale business in Keams Canyon and she also made quilts. Fannie taught all of her children to make pottery and several of them excelled at it. All of her children graduated from high school and most went on to college or university.
Tewa Village and First Mesa
The Hopi people live in villages on or around three primary mesas in northeast Arizona. Some of these communities have been continuously occupied since the 12th century. Because they lived in isolation longer than any other pueblo group, the Hopis retain much of their traditional religion, lifestyle and language. That said, the Hopi mesas have also long been sanctuaries for other tribes during times of great drought or great hardship (such as those brought on by the Spanish in the early years of their colonization of Nuevo Mexico). As a result, the landscape around First Mesa is littered with the remains of villages once founded by people speaking Keresan, Towa, Tewa and other languages.
The Hopi pottery tradition is quite varied with roots traced as far away as vitrified ceramics found in the environs of Valdivia, Ecuador, and produced between 1200 and 1500 BC. Archaeologists excavating in the ruins around First Mesa found shards of pottery styles and painted designs also found in the Rio Salado region and among the ancient Sinagua settlements in the Wupatki, Tuzigoot, Walnut Canyon and Homolovi areas (all abandoned between about 950 and 1200 AD).
The area around Jeddito was occupied by Towa-speaking people from the Four Corners region beginning around 1275. The Jeddito area is where Jeddito yellow is found, the clay that made the pottery shards of Sikyátki so spectacular. Beginning in the 1400's, Keres-speaking people arriving from the east began to build what became Awatovi, on Antelope Mesa between Jeddito and First Mesa. Sikyátki itself was also built by people from the east beginning in the early 1300's. At first Sikyátki was inhabited solely by the Kokop (Firewood) clan, then the Coyote clan came and grew to become the largest single clan in the village. Why the village was destroyed is shadowed in myth but Jesse Walter Fewkes (the first archaeologist to excavate in the Sikyátki area) felt the village was destroyed before the first Spanish visitor arrived in 1540. Oral history has it that Sikyátki and its people were wiped out but the clans that lived in the village have somehow continued to exist.
The Hopi Cultural Center
The ruins at Awatovi (on Antelope Mesa, east of Walpi and south of Keams Canyon) have yielded pottery shards in styles and with designs that were also prominent in the prehistoric village now known as Pottery Mound (in central New Mexico). Among the pot shards found at Pottery Mound are plain and decorated Hopi products, white clay products from the Acoma-Zuni area and red clay products from north-central New Mexico. Pottery Mound was abandoned a few decades before the Spanish arrived in New Mexico in 1540. It has been reported that the residents of Awatovi were Keres-speaking people from the Laguna-Acoma area (where Pottery Mound is) and, as such, were not as resistant as the Hopi themselves were to the Christianizing practices of the Spanish Franciscan monks when they came into the Hopi lands around 1609. As Awatovi was the only pueblo in the Hopi region to construct a Christian mission, most archaeologists attribute that to the reason why residents of Walpi and Old Oraibi destroyed the village and killed nearly all its residents in the fall of 1700. However, at the time of that destruction, Awatovi was the largest and most populous pueblo in the Hopi mesas. That was also shortly after Hopi recruiters went to the Rio Grande Pueblos for Tewa warriors to relocate near the Hopis. It was also around 1690 that the people of Walpi were relocating from their old pueblo at the foot of First Mesa to their new location atop the southernmost finger of First Mesa, a move made for defensive reasons.
Tewa warriors and their families began arriving in the area in 1696 and were steered to take up residence at the foot of First Mesa along the only route to the mesa top (in that location, the Tewas would be the first people to encounter incoming Spanish military - the Hopis atop First Mesa felt they would make a good first line of defense should the Spanish attempt to reconquer them). The Tewas were also good at repulsing Ute, Paiute and Navajo raiders. After they won a famous battle against the Utes they built Tewa Village (also known as Hano) at the foot of First Mesa. Some of the Tewa women were potters and in the ages-old way, they slowly shared what they knew with Hopi potters, and vice versa. That cross-pollination went on for years, and not just with pottery. Cross-cultural marriages happened, too, and today the people are known as Hopi, Hopi-Tewa and Tewa, depending on their ancestry. And while Tewa Village is completely surrounded by the Hopi Reservation, many of the residents are fluent in Tewa, Hopi and English. Some are fluent in Spanish and Navajo, too.
During those same troubled times Towa-speaking people from Jemez Pueblo migrated to Hopi and Navajo territory (in the Jeddito Wash area) to escape the violence of the Spanish reconquest. They established familial ties that are still in place today (which may explain why Jeddito Wash is a Navajo Reservation area surrounded by the Hopi Reservation). The village of Sichomovi on First Mesa was founded in the late 1700's by members of the Wild Mustard Clan, Roadrunner Clan and others who'd come to the area from east of Santa Fe (Pecos Pueblo and the pueblos of the Galisteo Basin). Around 1800 a long period of severe drought caused many Hopis to migrate to Zuni territory and once the drought had broken, most returned to their ancestral lands. While at Zuni many Hopi potters picked up the Zuni method of white-slipping their pottery and continued to produce white ware after returning to Hopi. However, their quality wasn't nearly as good as that of Hopi pottery produced pre-1700.
The quality, styles and designs of Sikyátki had lived on in Awatovi pottery, although the potters of Awatovi were also enamored of using a white slip on top of the Jeddito clay base. The potters of Awatovi also introduced some new designs (the "Awatovi star" being one) but after the village was destroyed, very little of their knowledge and practice passed on. Hopi ceramics entered a virtual Dark Age for almost 200 years.
By the mid-1800's the Hopi pottery tradition had been almost completely abandoned, its utilitarian purposes being taken over by cheap enamelware brought in by Anglo traders. Hopi pottery production sputtered along until the late 1800's when one woman, Nampeyo of Hano, almost single-handedly revived it. Nampeyo lived in Tewa Village on First Mesa and was inspired by pot shards found among the nearby ruins of the ancient village of Sikyátki. Today credit is given to Nampeyo for fully reviving the Sikyátki style. She was so good that Jesse Walter Fewkes, the first archaeologist to formally excavate Sikyátki, was concerned that her creations would shortly become confused with those made hundreds of years previously.
Sikyátki pottery shapes are very distinctive: flattened jars with wide shoulders; low, open bowls decorated inside; seed jars with small openings and flat tops; painting methods of splattering and stippling and very distinctive designs. The Sikyátki style originally evolved when Keres and Towa-speaking potters from New Mexico got together with Water Clan potters from the Hohokam areas of southern Arizona and northern Mexico and they began working with clays found in the Jeddito area. Over the years other clans came to the area and made their own contributions to what we now know as "Sikyátki Polychrome." Accoding to Jesse Walter Fewkes, that merging of styles, techniques and designs created some of the finest ceramics ever produced in prehistoric North America.
Today's Hopi pottery tends to be a white, yellow, orange or buff colored background decorated with designs in red and black mineral paints. Painted designs tend to fill the entire space, often with an asymmetrical and symmetrical design. Most of the symbology painted on Hopi pottery is themed with "bird elements:" eagle tails, feathers, bird wings and migration patterns. Many Hopi, Hopi-Tewa and Tewa potters are members of the Corn Clan and their annual religious cycle revolves around the seasons of corn. The vast majority of today's Hopi pottery shapes and the designs painted on them are obvious descendants of the work of Sikyátki and Awatovi potters.
Hopi at Wikipedia
The Hopi Tribe official website
Prehistoric Hopi Pottery Designs, Jesse Walter Fewkes
Upper photos courtesy of TheArmchairExplorer, Creative Commons Attribution-ShareAlike 4.0 License
Lower photos courtesy of the Museum of New Mexico
Santa Fe, NM 87501


text:
Enter a first and/or last name to search Georgia marriage records. This website was created to provide genealogists with access to the Georgia marriage records from a single place. Additional information on how to obtain Georgia marriage certificates is available below.
Search marriage records for other states.
Marriage records contain information about the marriage of two people, including the date of marriage, place of marriage, sometimes the names of the mothers and fathers, and even the people who witnessed the marriage. Marriage certificates issued by state and local governments will often include the place of residences, and perhaps even the maiden names of the mothers.
This webpage gives you access to all of the online databases containing Georgia marriage records, Georgia marriage licenses, Georgia marriage indexes, Georgia marriage announcements, and other related Georgia genealogy records.
Marriage records have long been used to help with genealogy research. They are considered to be "primary source" records, because the information is recorded by an eye witness, at the time the marriage takes place. The Internet has allowed people to store marriage records into various online archives. This has brought access to online marriage records much more easier for genealogy researchers.
Newspapers frequently publish notices of marriages, and in addition to marriage certificates, are a popular source of research by genealogists.
On this page you will find the most comprehensive databases containing marriage records of Georgia. We also suggest searching for "Georgia marriage records" using Google.com, which will yield all such databases.
Search the Georgia Marriage Records Database
How to Obtain Georgia Marriage Certificates
Birth and death records began on a statewide level in 1919. Compliance was not considered extensive until 1928. Records before that time were kept on a county basis, and vary from county to county. Marriage records are the most complete, available from the 1700s on in most areas, but also vary from county to county. For birth records after 1919, and marriage records after June, 1952, write:
Georgia Division of Public Health
For prior records, contact the clerk of the county in question.
Other Georgia Marriage Records Websites
Recommended Georgia Genealogy Records
This page was last updated:


text:
Dinner to honor Don, Patty Cook
Don and Patty Cook, longtime supporters of Mental Health America of Colorado, will be honored at Tribute 2010, the organization's signature fundraiser. It takes place Sept. 29 at the Sheraton Denver Downtown.
The Cooks were introduced when Colorado first lady Jeannie Ritter hosted a reception at the Governor's Mansion that was attended by 60-plus committee members, board members and staff.
The Cooks spoke briefly about their work with MHAC and shared why they are so dedicated to its mission. "Mental health issues," they emphasized, "touch all of our lives and we support Mental Health America of Colorado because it works to improve the lives of people living with mental illness by providing resources and education for them and their loved ones."
Guests included Gov. Bill Ritter; the 2009 honorees, Cy and Lyndia Harvey; Tom Flanagan, the president and CEO of Citywide Banks; Seth Belzley, chair of the MHAC board; Tribute co-chairs Bert and Dyana Z. Furmansky and Jack and Andrea Hyatt; Dr. Robert Freedman; Gail and Dr. Stu Kassan; and Robyn Loup.
The theme for Tribute 2010 is "This Bell Shall Ring Out Hope," and symbolizes the bell that is part of MHAC's logo and history. In 1953, Mental Health America issued a call to asylums across the country for discarded chains and shackles once used to restrain people in mental health hospitals. The bindings, according to MHAC, were melted down and recast in to a bell, a sign of hope and a powerful reminder that the invisible chains of misunderstanding and discrimination continue to bind people with mental health conditions. "Today," a MHAC spokeswoman says, "the bell rings out hope for improving mental health and achieving recovery from mental illnesses."
Proceeds from the dinner will support MHAC's efforts in outreach, education, prevention and advocacy. In 2009, these services reached more than 20,000 Coloradans.
Joanne Davidson: 303-809-1314 or firstname.lastname@example.com; also, GetItWrite on Twitter


text:
By at July 09 2019 11:01:27
Provide checklists. As users complete your form, you may well be asking them to provide supporting information or attach supplementary documents where required. Providing a checklist, often at the beginning or end of a form, helps remind users about all the things they should remember to attach, and any further steps they need to go through.
A light shade of a colour, like blue, across the whole background of a form relieves the eye from the harshness of a stark white background. And if the answer spaces people have to fill in are white, the tinted background both cues them in to where they write, and allows them to visually sense how much they have to fill in.


text:
This HOWTO presents a way for configuring a Virtual Mail System using Exim, MySQL, SpamAssassin, ClamAV and Dovecot.
If you find this guide useful or have any ideas / improvements don't hesitate to drop me a mail.
Exim will be the main component in this HOWTO, as it's the mail server. Why exim? Because I like it! Have a look at a MTA Comparison.
A quick overwiew of this projects goals and features.
Some assumptions I made about the setup and howto use it.
You'll get the whole plot when I'm describing the Idea. All the techniques used will be explained there.
The implementation consists of installing and configuring the tools / software components that are connected. Either follow these instructions, or just grab all configfiles and adapt them to your needs.
Some additional material is provided at the end.
Best viewed with Clean Style.
2010-11-02 + SMAD -> VMSA (rename + SourceForge project) 2009-10-30 + only shortened changelog showed by default + /etc/exim/scan_archive.sh: better support for non-GNU systems by using awk instead of gawk and POSIX-compliant function definitions (thanks to Jesco Freund) 2009-10-03 + exim.conf parsing error (in exec double ext archive) fixed 2009-09-27 + missing routers fixed (introduced during update) 2009-09-15 + domain-list double entry fixed (introduced during update) ...For a complete list please see the CHANGELOG
I've received some feedback about successful installations using this guide under a number of Distributions. Perhaps you'll have to tweak a litte bit here and there but it already worked on:
Remember: try to contribute and give feedback.
The following assumptions are made:
I will not go into details installing the needed software, as it's dependent on your distro. I'll just assume it's all right there.
As configuration may vary accross different distros and I'm using Gentoo, you'll have to figure out the difference to your one. However it should not be that hard, perhaps some different config file locations or user names running the services. Keep in mind to adapt them.
So far I've got success stories from Debian and FreeBSD users. Please provide feedback!
You are familiar with the used programs or at least with their functionality.
This guide does not make sense, if you don't know what e.g. MySQL or an IMAP-Server may be useful for.
The reason is that you should be able to adjust the config to your needs. This way you may exchange a component through another piece of software. If you don't want to use ClamAV, but another or additional virus-scanner it's helpful to understand the Exim-config. Or perhaps you don't like the idea of GreyListing and want to get rid of this functionality.
So if you understand the way of configuring it you may use this guide as the glue for connecting the components. This way you're able to adapt it better to your needs as they may be different to mine.
As various used Programs need to communicate with each other, I configure them to use UNIX Domain Sockets, whenever possible. Otherwise they are bound to the loopback-interface. This way no unnecessary ports are opened to the public, thus avoiding additional attack-vectors.
Of course this does not affect the SMTP-server or IMAP/POP3-server, as we do want to provide these services to the public. ;-)
Apart from that it is possible to deploy each tool onto another hardware, for better scalability. They all are able to communicate via IP.
I'm not using dovecots new SASL-Authenticator to implement SMTP-Auth in exim, instead both of them authenticate against MySQL on their own.
I'm not using dovecots delivery feature (nor any other maildropper) to store incomming mails in MailDir, instead exim stores them directly there. If you experience problems with dovecot getting slow on building an index on access, you may take the benefit of using dovecots deliver, which updates the index on every new incomming mail. That depends on your hardware, but this average server will take just about a second in folders with 16k+ mails for a full index-recreation, so in general you shouldn't even notice...
The following software is used in this HOWTO, so I suggest installing it via the packet-management of your favorite distro. The exact versions I used are noted, but you should be fine with the features the major-version-number gives you.
The idea of the whole virtual mail system is to reduce administrative overhead.
All settings are stored in a MySQL database and all services such as SMTP and IMAP should use them.
A user is identified by his email-address (served by the system) and his password.
You can consider it as an account.
Users are able to send mail using SMTP-AUTH and read mail using IMAP or POP3. These privileges may be revoked.
There are several settings a user may set (e.g. through SMAD):
In all further examples let's say firstname.lastname@example.com is a user.
Aliases are email-addresses that are redirected to another address (local or remote, even aliases again).
E.g. email@example.com may redirect all mails to firstname.lastname@example.com.
An alias may redirect a mail to multiple recipients.
E.g. email@example.com may redirect an incomming mail to email@example.com and firstname.lastname@example.com.
By default every user gets some aliases defined automatically according to the "plussed addressing scheme".
Mail to email@example.com gets redirected to the user's mailbox, where string can be anything valid in an email-local-part.
string gets introduced by the +-sign. Multiple +-signs are valid.
This can be used to publish different mail-addresses to different people in order to track who sold your address to whom.
E.g. you give the address firstname.lastname@example.com to company A and one day you receive a mail to that alias-address from company B, you'll notice where they got the address from.
By the way I noticed that most harvesters used to gather email-addresses from web-pages seem to choke on these plussed addresses.
I've setup a page with fake addresses that is only visible to crawlers/harvesters and was disappointed that this spamtrap didn't received a mail for months (half a year as of 2007-04-22).
On examining the mail-server logs I discovered a lot of rejected mails due to non-existent local email-addresses. Taking a closer look on these failed addresses I found out that most of them where cropped after the +-sign. E.g. from this page harvesters may find email@example.com, but are adding email@example.com to their database.
Obviously these broken harvesters can be tricked by using such a plussed address where the wrongly cropped address is invalid and rejected by the mail-server.
Note: some websites are coded with too restrictive input filters that won't allow some characters in an email-address. However - using them is not your fault. If you are in doubt, see this comprehensive list of allowed characters.
Taking the last mentioned method to the next level, you can publish alias-addresses that are valid only if a condition that is embeded in the address matches.
Conditionals are introduced by the #-sign and take a parameter that's seperated from the condition by another #-sign.
The general syntax for a conditional email-address is firstname.lastname@example.com for user.
Remember: they do not need to be setup by the user. Just use them!
For now there a two conditions implemented:
An email-address like firstname.lastname@example.com is valid and the mail server accepts it, if the current date is not higher than YYYYMMDD, which is a day encoded like 20070308 and the user exists.
This way you can publish a temporary valid address e.g. for an one-time online-game.
Or you may embed such an address on your webpage that's dynamically generated to be valid one week, like firstname.lastname@example.com, which is generated with the following PHP-code: <?="user#before#" . date("Ymd", ( time() + (7 * 24 * 60 * 60) )) . "@struction.de"?>
People may contact you, but crawlers harvesting email-addresses won't be able to spam you after the defined time.
An email-address like firstname.lastname@example.com is valid and the mail server accepts it, if the domain of the sender's address matches domain and the user exists.
E.g. you can publish firstname.lastname@example.com for the newsletter of company A which is expected to send news from domain company-A.com.
If they trade this address to some other company, mail from them will get rejected.
This one is quite simple.
If a mail could not be accepted because there's no user like email@example.com and you've defined a CatchAll for the domain struction.de, incomming mail gets redirected like an alias to another address.
Somebody requested this feature. In my opinion it just increases spam in your inbox, but on the other hand if you've plenty of unused domains...
For all hosted domains there's an email-address named alle@domain, that redirect incomming mail to all users of domain.
The only limitation is that it's only for internal use, which means to send a mail to this address you have to be authenticated using SMTP-AUTH.
There's a fully buzzword-compliant web-interface available, which should allow you to to everything you need.
You may also maintain it using phpMyAdmin, as all tables and columns are documented as comments in their database-structure. Additionally the database is really flat structured and thus more like a (network-attached) config file, for easy maintainance (this was actually a feature in the old times without SMAD).
Just create a line in the user-table.
The password-hash can be generated with
dovecotpw -s SHA1
Make sure, you chop the prefix {SHA1} from the output hash.
The database-structure itself should be self-documenting. If you're unsure, check out the table-comments.
The following SQL should create a new user email@example.com, using default values for optional fields:
INSERT INTO `user` (`username`, `domain`, `password`, `Full Name`) VALUES ('test', 'example.com', 'W6ph5Mm5Pz8GgiULbPgzG37mj9g=', 'test user entry for demo')
There are more ways to create the password hash. Just have a look at the Addon Section.
There are several techniques implemented to catch spam & virii.
All of them have their advantages and disadvantages, so our goal is to mix them up at a good ratio.
It's important to handle such incomming mail in a transparent way.
No mail should get lost without a trace, so we cannot accept it in the first place and silently drop it later. In this situation the sender doesn't know that his mail never reaches the recipient. As spam & virus mails often use faked sender-addresses, we end up in clogged mail-queues or flooding the wrong person, if we send out notifications.
So the whole decision has to be made while receiving the mail.
On the one hand this is quite ressource-intensive, but on the other hand we can reject the mail and the sending mail-server recognizes that and is responsible for notifying the sender.
So our mail-queue keeps clean and we don't bother the wrong person.
But now there's another inconvenience.
As we want different users to have different spam-thresholds we cannot reject spam because an incomming mail may have multiple users with different thresholds.
Aliases need to be resolved and the final recipient may even reside on a foreign mail-server.
Thus we just tag the spammy mail with the score in a header or reject it, if its score is far above the maximum threshold in all user preferences. There are ways to limit the number of recipients per mail, but I dont't like the idea because of broken mail-servers. Later at delivery-time, we know the user the mail is locally deliverd to. So we can evaluate the spam-score with his preferences, but it's to late to reject the mail.
So finally it's the users choice to automatically filter out mails with a high spam-score in his client.
For the same reason we only can use a system-wide bayes-database.
I know these are a lot of disadvantages, but for me it's important to have a reliable mail system and I definitely like the advantages of getting rid of most unwanted mail at SMTP-time.
If you know a way to solve this problem, please let me know!
I don't like GreyListing in general, because it may delay legitimate mail.
But as the advantage of rejecting spam- & worm-spreading bot-nets is inviting, I've implemented a simple selective version within Exim.
All incomming mails that scores more than GREYLIST_SPAM_THRESHOLD (in /etc/exim/exim.conf) will be temporary rejected if seen for the first time and on consecutive attempts for at least GREYLIST_TIMEOUT seconds.
This way we catch low scored mail that's likely spam, while not delaying most legitimate mail. Through the delay period we increase the chance that updated Colaborative Checksum Lists, URIBL or DNSBL will score the mail higher in the meantime.
If you have backup MX servers for you domain, or some foreign accounts forwarded, you'll probably won't benefit that much from this method.
However - it won't harm you, so give it a try...
Some Windows executeable file extensions won't be allowed as attachments. This avoids installing a trojan horse accidentally.
Since the business gets more progressive, executeable viruses may be hidden inside archives (e.g. zip). As it now needs more than one click to get infected (open the archive, click the trojan) we won't do anything against executeables in archives.
However - there's a technique to put an executeable in an archive and camouflage it by prepending another (harmless) extension, like invoice.pdf.exe. Since Windows may supress the extension, it will actually trick the user by showing only invoice.pdf.
We will reject these potentially dangerous executeable double extensions, because there's no valid use case to send those files.
See Aliases and Conditionals to learn how to avoid spam by protecting your mail-address.
Exim adds several headers to an incomming mail that will give SpamAssassin some hints, later (via /etc/spamassassin/99_struction_EXIM.cf).
Exim performs a callout verification on the sender address. This tests wheather this address accepts mail, initiating a SMTP-connection to the senders mail-server.
Valid and existing addressed will get some negative spam-points, while non-existant ones will score real hard.
Some spammers use the recipents address as the senders address, or an address of the recipients domain, thinking they may be whitelisted.
As we only allow our users to send mail using SMTP-AUTH and spammers can't do this, we can reject those mails.
Authenticated senders will receive some negative spam-points, as we trust them.
However - since they may have a worm / bot installed that uses their authentication credencials, we still scan 'em!
Most spam uses non-RFC-conformant (E)HELO greetings at the beginning of their SMTP-connection. These failures will score some spam-points later. As there are some MTAs out there, which seem to be broken, it's better not to reject them.
Some spammers try to impersonate our mail-server, thinking it's more trusted or whitelisted.
These are rejected, as they can't have our IP ;-).
It's possible to configure exim for more than one virus scanning engine. Each incomming mail has to pass a chain of all engines to be accepted. After the first engine detects a virus, the message is rejected.
The list of supported engines in long: Kaspersky Version 4/5, ClamAV, DrWeb, F-Secure, Sophie and any command-line-scanner like F-Prot. (from Exim Documentation - Content Scanning at ACL time - 41.1 Scanning for viruses)
Install ClamAV, SpamAssassin, Dovecot and Exim. It's obvious that you'll need MySQL, too - but that may be installed as a dependency. Just make sure you're using at least MySQL version 5, since older versions lacked handling of trailing blanks in strings. (That's annoying if a user configures the system to prepend 'SPAM ' to the subject of a spammy mail and MySQL forgets about that blank.)
Be sure to install/compile your packages with all needed features. In Gentoo it'll be usefull to add support for mysql, ssl, maildir as global USE-flags for all packages.
After installing all services, keep in mind to add them to your startup-scripts as you want to run them after booting ;-)
In order to use SSL encrypted connections you need a certificate and key. There are several possibilities to create them. If you need to manage some more you may want to use a tool like TinyCA.
For simplicity I use the same cert/key for both programs: Exim and Dovecot. They should be placed under /etc/exim/exim.crt and /etc/exim/exim.key.
Don't forget to set the file-permissions correctly. (owner=mail / exim.key should be readable only for owner)
Include support for exiscan-acl. Optional lmtp, spf, srs. Exclude gnutls, as ssl will provide the same features.
Daemon should be run as user mail.
Optional include POP3 support: pop3d
Daemon should be run as user dovecot.
Daemon should be run as user clamav. Make sure it's compiled with gmp-support to verify signature updates.
This service isn't installed the same way as the others in Gentoo. Somehow they prefer to run it on a per-system-user basis, but actually we only want users to be virtual. That's why this setup is described more detailed.
We are running SpamAssassin in a system-wide config under user spamassassin, so create him and his home-directory /home/spamassassin with appropriate permissions. (bayes database will be stored there):
adduser --home-dir /home/spamassassin --create-home --comment "added for spamd" --user-group spamassassin
Create a directory /var/run/spamassassin owned by the user spamassassin. I prefer all runtime-files for a service like sockets or pid-files in a own directory.
Make sure to start spamd with correct options. This is done in /etc/conf.d/spamd in Gentoo. (Debian e.g. uses /etc/default/spamassassin and a slightly different syntax):
SPAMD_OPTS="--max-children 15 --max-conn-per-child=25 -H -u spamassassin --socketpath=/var/run/spamassassin/spamd.sock --socketowner=spamassassin --socketgroup=spamassassin" PIDFILE="/var/run/spamassassin/spamd.pid"
As all mail is content-scanned during the SMTP-session it's nessessary to react fast.
Some seconds scan-time per mail is ok, but when SpamAssassin is expiring bayes tokens during a session that may take long and timeout the connection.
Therefore we create a daily cronjob /etc/cron.daily/spamassassin-expire-bayes that expires bayes tokens.
Make sure, it's executeable!
Be sure to create another daily cronjob
/etc/cron.daily/spamassassin-update that checks for rule-updates.
Make sure, it's executeable!
All packages installed? Everything works so far? Then let's get started...
Install the database scheme from system-scheme.sql:
mysql -p <system-scheme.sql
Create MySQL users for exim and dovecot with read-only permissions on the new database. In addition exim needs INSERT-permission for the greylist-table. Substitute EXIMPASSWORD and DOVECOTPASSWORD with some random secret (e.g. created with 'pwgen --secure 32 2').
GRANT USAGE ON *.* TO 'exim'@'localhost' IDENTIFIED BY 'EXIMPASSWORD' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT SELECT ON `system`.* TO 'exim'@'localhost'; GRANT INSERT ON `system`.`greylist` TO 'exim'@'localhost'; GRANT USAGE ON *.* TO 'dovecot'@'localhost' IDENTIFIED BY 'DOVECOTPASSWORD' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT SELECT ON `system`.* TO 'dovecot'@'localhost';
Create /etc/dovecot/dovecot-sql.conf with following content (and substitute your DOVECOTPASSWORD):
driver = mysql connect = host=/var/run/mysqld/mysqld.sock dbname=system user=dovecot password=DOVECOTPASSWORD default_pass_scheme = SHA1 password_query = SELECT password, '/var/mail/%d/%n' AS userdb_home, 'mail' AS userdb_uid, 'mail' AS userdb_gid FROM user WHERE username = '%n' AND domain = '%d' AND IMAP_allowed = 'YES'
Edit /etc/dovecot/dovecot.conf to suit your needs and be sure it contains:
protocols = imap imaps ssl_cert_file = /etc/exim/exim.crt ssl_key_file = /etc/exim/exim.key disable_plaintext_auth = yes login_user = dovecot verbose_proctitle = yes default_mail_env = maildir:/var/mail/%d/%n protocol pop3 { # fix broken pop3 logins pop3_uidl_format = %08Xu%08Xv } auth default { mechanisms = plain passdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb prefetch { } user = nobody }
Because ClamAV needs to access the temporary files created by Exim for scanning, make sure the user running clamd (clamav) is in mail-group (the GID that Exim runs = mail) by adding to /etc/group a line like:
Since version 0.90 the configuration syntax has changed. Pick your version:
Edit /etc/clamd.conf to suit your needs and make it contain:
PidFile /var/run/clamav/clamd.pid TemporaryDirectory /tmp DatabaseDirectory /var/lib/clamav LocalSocket /var/run/clamav/clamd.sock FixStaleSocket yes StreamMaxLength 32M FollowDirectorySymlinks yes FollowFileSymlinks yes User clamav AllowSupplementaryGroups yes
Edit /etc/freshclam.conf to suit your needs and contain:
UpdateLogFile /var/log/clamav/freshclam.log PidFile /var/run/clamav/freshclam.pid DatabaseOwner clamav DatabaseMirror db.xx.clamav.net DatabaseMirror database.clamav.net ScriptedUpdates yes Checks 96 NotifyClamd /etc/clamd.conf
Edit /etc/clamd.conf to suit your needs and make it contain:
AllowSupplementaryGroups DetectBrokenExecutables ScanRAR ArchiveLimitMemoryUsage
Edit /etc/freshclam.conf to suit your needs and contain:
Configure SpamAssassin to your needs, but ensure to have all needed plugins installed (edit *.pre)
Add /etc/spamassassin/99_struction_EXIM.cf to take advantage of spam-hints configured in Exim.
Add /etc/spamassassin/wrongmx.pm and /etc/spamassassin/99_struction_WrongMX.cf to catch spam that is send through a low priority MX, while your server is up.
Add /etc/spamassassin/iXhash.pm and /etc/spamassassin/99_struction_IXHASH.cf to catch spam with fuzzy checksums by iX magazine (german article, project page).
Add /etc/spamassassin/99_struction_DNSRBL.cf to use some additional DNSRBLs.
Make sure your /etc/spamassassin/local.cf contains the following directives:
# we run spamassassin through exiscan-acl from exim. # thus, in exim we cannot take modified spamd output as mail. # no message modifications will be visible to exim! # the only way to get debugging output into the mail is a report. report_safe 0 # somehow bayes did not work, so try to specify database path directly bayes_path /home/spamassassin/.spamassassin/bayes # Enable the Bayes system use_bayes 1 use_bayes_rules 1 bayes_auto_learn 1 bayes_use_hapaxes 1 bayes_expiry_max_db_size 400000 # do not automatically expire database, as it causes long scantimes (and timeouts for exim) # make sure the cronjob doing this in an external process is setup! bayes_auto_expire 0 # Enable or disable network checks skip_rbl_checks 0 use_dcc 1 use_pyzor 1 dcc_path /usr/bin/dccproc pyzor_path /usr/bin/pyzor # as the server is unreliable in these times, increase the timeout pyzor_timeout 10 # new template. Try to keep it under 78 columns (inside the the dots below). # ........................................................................ clear_report_template report SpamAssassin _VERSION_ on host _HOSTNAME_ report scan-date = _DATE_ report score = _SCORE_ report bayes-score = _BAYES_ report bayes-token-summary = _TOKENSUMMARY_ report bayes-token-spam-count = _BAYESTCSPAMMY_ report bayes-token-ham-count = _BAYESTCHAMMY_ report bayes-token-spam = _SPAMMYTOKENS(16,short)_ report bayes-token-ham = _HAMMYTOKENS(16,short)_ report bayes-auto-learned = _AUTOLEARN_ _AUTOLEARNSCORE_ report last-external-host = _LASTEXTERNALRDNS_ [_LASTEXTERNALIP_] HELO=_LASTEXTERNALHELO_ report ASN = _ASN_ _ASNCIDR_ report possible-languages = _LANGUAGES_ report relayed-countries = _RELAYCOUNTRY_ report pyzor = _PYZOR_ report RBL = _RBL_ report DCC-brand = _DCCB_ report DCC-result = _DCCR_ report ==== ====================== ================================================== report " pts rule name description" report ---- ---------------------- -------------------------------------------------- report _SUMMARY_ # ........................................................................
Create the helper script /etc/exim/scan_archive.sh.
Use exim.conf.dist as initial /etc/exim/exim.conf and edit it to suit your needs by inserting/modifing the following lines:
Insert MySQL-connection-config with substituted EXIMPASSWORD:
# mysql auth hide mysql_servers = localhost/system/exim/EXIMPASSWORD
Define and adjust some variables:
# seconds after a greylisted message is accepted (10 minutes) GREYLIST_TIMEOUT = ${eval:10*60} # integer spam score threshold to activate selective greylisting (1.0 points) GREYLIST_SPAM_THRESHOLD = 10 # messages bigger than this aren't spam-scanned SPAM_FILESIZE_LIMIT = 1M # messages bigger than this aren't virus-scanned VIRUS_FILESIZE_LIMIT = 32M
Set primary_hostname to your fully qualified server-name.
Make Exim listen on SMTP-SSL (465) and submission port (587), too:
# ports to listen on (smtps is forced to use TLS/SSL via tls_on_connect_ports) daemon_smtp_ports = smtp : smtps : submission
localdomains are fetched from database. if mail is comming for USER@DOMAIN, it will return DOMAIN, so to make Exim feel responsible for a domain just add a user in the database.
domainlist local_domains = ${lookup mysql {\ SELECT domain FROM user WHERE domain='${quote_mysql:$domain}' \ UNION \ SELECT domain FROM alias WHERE domain='${quote_mysql:$domain}' \ UNION \ SELECT domain FROM catchall WHERE domain='${quote_mysql:$domain}'\ }}
Some SSL/TLS configuration. use your certificates and enforces SSL on SMTP-SSL
# SSL/TLS config tls_advertise_hosts = * # additionally listen on ssl/smtp tls_on_connect_ports = 465 tls_certificate = /etc/exim/exim.crt tls_privatekey = /etc/exim/exim.key # log some details log_selector = +tls_cipher +tls_peerdn
Define our ACLs to be called on RCPT and DATA SMTP-command:
acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data
Define Control for virus-scanner as an exim variable, so we can use multiple engines later
av_scanner = $acl_m0
Define SpamAssassin-connection via socket:
spamd_address = /var/run/spamassassin/spamd.sock
Add these lines after 'accept hosts = :' in acl_check_rcpt:
# temporary reject message, if already greylisted and entry hasn't expired yet # authenticated users skip this defer message = Your Message is currently still greylisted! Please try again later. log_message = message from ${sender_address} over [${sender_host_address}] is still GreyListed !authenticated = * # true, if triple is in db and not yet GREYLIST_TIMEOUT seconds since first seen # false, else (older or not in db) condition = ${if >={GREYLIST_TIMEOUT}{${lookup mysql{\ SELECT (UNIX_TIMESTAMP()-MAX(first_seen)) AS QueueTime \ FROM greylist \ WHERE SenderIP = '${quote_mysql:$sender_host_address}' \ AND SenderAddress = '${quote_mysql:$sender_address}' \ }{$value}{${eval:GREYLIST_TIMEOUT+1}}}}{true}{false}} # deny, if foreign, unauthenticated connection claims to come from a local domain # 2009-08-01
this has some strange behaviour (blocking) on two systems (A & B are different servers) with this config under the following condition # A: user@Adomain writes to user user@Bdomain (which is an alias for someotheruser@Adomain) # if your users have such circular aliases on different servers using this config, simply comment it out! deny message = Sender claims to have a local address, but is neither authenticated nor relayed (try using SMTP-AUTH!) log_message = Forged Sender address (claims to be local user [${sender_address}], but isn't authenticated) !hosts = +relay_from_hosts !authenticated = * condition = ${if match_domain{$sender_address_domain}{+local_domains}} warn message = You cannot be localhost.localdomain in the internet log_message = HELO is faked as localhost.localdomain condition = ${if match{$sender_helo_name}{\Nlocalhost\.localdomain\N}} # we're doing HELO checks here, because we can't add headers in acl_smtp_helo warn message = X-Invalid-HELO: HELO is IP only (See RFC2821 4.1.3) log_message = HELO ($sender_helo_name) is IP only (See RFC2821 4.1.3) condition = ${if isip{$sender_helo_name}} warn message = X-Invalid-HELO: HELO is no FQDN (contains no dot) (See RFC2821 220.127.116.11) log_message = HELO ($sender_helo_name) is no FQDN (contains no dot) (See RFC2821 188.8.131.52) # Required because "[IPv6:<address>]" will have no .s condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}} condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}} warn message = X-Invalid-HELO: HELO is no FQDN (ends in dot) (See RFC2821 18.104.22.168) log_message = HELO ($sender_helo_name) is no FQDN (ends in dot) (See RFC2821 18.104.22.168) condition = ${if match{$sender_helo_name}{\N\.$\N}} warn message = X-Invalid-HELO: HELO is no FQDN (contains double dot) (See RFC2821 126.96.36.199) log_message = HELO ($sender_helo_name) is no FQDN (contains double dot) (See RFC2821 220.127.116.11) condition = ${if match{$sender_helo_name}{\N\.\.\N}} warn message = X-Invalid-HELO: Host impersonating [$primary_hostname] log_message = HELO ($sender_helo_name) impersonating [$primary_hostname] condition = ${if match{$sender_helo_name}{$primary_hostname}{yes}{no}} # TODO: nicht auf loopback generieren warn message = X-Invalid-HELO: $interface_address is _my_ address log_message = HELO ($sender_helo_name) uses _my_ address ($interface_address) # [own IP] or even without brackets as HELO condition = ${if or{{\ eq{[$interface_address]}{$sender_helo_name}\ }{\ eq{$interface_address}{$sender_helo_name}\ }}} warn message = X-Invalid-HELO: no HELO log_message = no HELO ($sender_helo_name) condition = ${if !def:sender_helo_name}
Add these lines after 'require verify = sender' in acl_check_rcpt:
# embed a header flag, if sender callout verification fails. this may lead to rejection in future, or give a hint to bayes filter # the next both directives have complement verify conditions, so only one matches warn message = X-Sender-Verify: FAILED ($sender_verify_failure) log_message = Sender ($sender_address) could not be verified using callout: $acl_verify_message ($sender_verify_failure) !verify = sender/callout=10s,random warn message = X-Sender-Verify: SUCCEEDED (sender exists & accepts mail) verify = sender/callout=10s,random
Edit the line after 'accept authenticated = *' in acl_check_rcpt:
control = submission/sender_retain/domain=
Exchange all lines of DATA-ACL acl_check_data with (write new):
# Unpack MIME containers and reject file extensions # used by worms. Note that the extension list may be # incomplete. deny message = $found_extension files are not accepted here demime = com:exe:vbs:bat:pif:reg:scr # Reject messages that have serious MIME errors. # This calls the demime condition again, but will return cached results. deny message = Serious MIME defect detected ($demime_reason). demime = * condition = ${if >{$demime_errorlevel}{2}{1}{0}} # Deny if the message contains a virus. Before enabling this check, you # must install a virus scanner and set the av_scanner option above. deny message = This message contains a virus ($malware_name) and is rejected. log_message = rejected VIRUS ($malware_name) from $sender_address to $recipients (ClamAV) set acl_m0 = clamd:/var/run/clamav/clamd.sock condition = ${if < {$message_size}{VIRUS_FILESIZE_LIMIT}} demime = * malware = * # 2009-08-01
disable f-prot for now, since its usage has changed # this is the place to configure additional virus scanning engines. # just copy and modify this block (read exim doc for available scanners) # deny message = This message contains a virus ($malware_name) and is rejected. # log_message = rejected VIRUS ($malware_name) from $sender_address to $recipients (F-Prot) # set acl_m0 = cmdline:/usr/bin/f-prot -ai -archive -collect -dumb -packed %s:Infection. :Infection. (.+)\$ # condition = ${if < {$message_size}{VIRUS_FILESIZE_LIMIT}} # demime = * # malware = * # reject executeable double extensions in archives deny demime = zip:rar:arj:tar:tgz:gz:bz2 condition = ${run{/etc/exim/scan_archive.sh $message_exim_id ${lc:$found_extension}}{no}{yes}} message = This message contains an unwanted binary Attachment in ${uc:$found_extension} file using a double extension log_message = ${uc:$found_extension} archive contains potential dangerous double extension. delay = 15s # Add headers to all messages (:true). Before enabling this, # you must install SpamAssassin. You may also need to set the spamd_address # option above. # warn message = X-Spam-Score: $spam_score\n\ X-Spam-Score-Int: $spam_score_int\n\ X-Spam-Bar: $spam_bar\n\ X-Spam-Report: $spam_report !authenticated = * condition = ${if < {$message_size}{SPAM_FILESIZE_LIMIT}} spam = spamassassin:true # temp. reject messages that seem to have timeouts during spam-scan defer message = Temporary error while spam-scanning. Please try again later. log_message = message temporarily rejected, because of spam-scan error (maybe timeout) !authenticated = * condition = ${if < {$message_size}{SPAM_FILESIZE_LIMIT}} condition = ${if !def:spam_score} # Reject spam messages with score over 10+2*max_score_from_db (fallback=15 if mysql fails), using an extra condition. deny message = This message is classified as UBE (SPAM) and therefore rejected. You scored $spam_score points. Congratulations! #spam = spamassassin:true !authenticated = * condition = ${if >={$spam_score_int}{${lookup mysql{\ SELECT ((max(spam_threshold)*2+10)*10) AS spam_reject_threshold \ FROM user \ WHERE SMTP_allowed='YES' \ }{$value}{15}}}{true}{false}} # temporary reject message for greylisting, if integer spamscore is above GREYLIST_SPAM_THRESHOLD and the message (sender address + IP) is seen for the first time # authenticated users skip this defer message = Your Message will be greylisted! Please try again in GREYLIST_TIMEOUT seconds. log_message = message from ${sender_address} over [${sender_host_address}] will be GreyListed as it scores $spam_score spam points !authenticated = * condition = ${if >={$spam_score_int}{GREYLIST_SPAM_THRESHOLD}{true}{false}} # false, if triple is in db (at this point if it's in the timeout has expired) # true, if not condition = ${lookup mysql{ \ SELECT MAX(first_seen) \ FROM greylist \ WHERE SenderIP = '${quote_mysql:$sender_host_address}' \ AND SenderAddress = '${quote_mysql:$sender_address}' \ }{false}{true}} # insert triple into database (which should succeed) condition = ${lookup mysql{ \ INSERT INTO greylist ( SenderIP, SenderAddress, first_seen ) \ VALUES ( '${quote_mysql:$sender_host_address}', '${quote_mysql:$sender_address}', UNIX_TIMESTAMP() ) \ }{$value}fail} # log, if mail successfully passed greylisting warn message = X-GreyList: Message successfully passed GreyListing after $acl_m0 seconds. log_message = message from ${sender_address} over [${sender_host_address}] with HELO ($sender_helo_name) successfully passed GreyListing after $acl_m0 seconds and scores $spam_score spam points !authenticated = * # true, if triple is in db (at this point if it's in the timeout has expired) # false, if not condition = ${lookup mysql{ \ SELECT MAX(first_seen) \ FROM greylist \ WHERE SenderIP = '${quote_mysql:$sender_host_address}' \ AND SenderAddress = '${quote_mysql:$sender_address}' \ }{true}{false}} set acl_m0 = ${eval:$tod_epoch-${lookup mysql{ \ SELECT MAX(first_seen) \ FROM greylist \ WHERE SenderIP = '${quote_mysql:$sender_host_address}' \ AND SenderAddress = '${quote_mysql:$sender_address}' \ }{$value}}} # save exim version and current date in header warn message = X-Exim-Version: $version_number (build at $compile_date)\n\ X-Date: $tod_log\n\ X-Connected-IP: $sender_host_address:$sender_host_port # save additional information in header warn message = X-Message-Linecount: $message_linecount\n\ X-Body-Linecount: $body_linecount\n\ X-Message-Size: $message_size\n\ X-Body-Size: $message_body_size #X-Received-Count: $received_count\n\ #X-Recipient-Count: $recipients_count\n\ #X-Local-Recipient-Count: $rcpt_count\n\ #X-Local-Recipient-Defer-Count: $rcpt_defer_count\n\ #X-Local-Recipient-Fail-Count: $rcpt_fail_count warn log_message = DEBUG load_avgx1000: $load_average spam_score: $spam_score message_size: $message_size # finally accept the message in DATA ACL. accept
Define the following routers directly after the dnslookup-router in the router-section (Order is important!):
# alle@
is an auto-generated alias for all users of , which is only available for authenticated senders # NOTE: we need to respect SMTP_allowed for every user! mysql_all_domain_alias: driver = redirect # restriction to local domains only may be a double check, as data takes care of it already ;-) domains = +local_domains local_parts = alle data = ${lookup mysql{ \ SELECT CONCAT(username,'@',domain) AS sendto \ FROM user \ WHERE domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }} # treat localhost as authenticated condition = ${if or {{\ def:authenticated_id\ }{\ eq {$sender_host_address}{127.0.0.1}\ }}\ } file_transport = address_file pipe_transport = address_pipe # an alias can be specified by giving one or more db-entries that match username and domain, # or return a comma-seperated list of recipients. # when no domain is specified in db-entry, recipients are taken from all domains with a matching username # setting internal='YES' only allows sending mail to this alias, if authenticated (for internal usage) mysql_alias: driver = redirect # restriction to local domains only may be a double check, as data takes care of it already ;-) domains = +local_domains file_transport = address_file pipe_transport = address_pipe data = ${if or {{\ def:authenticated_id\ }{\ eq {$sender_host_address}{127.0.0.1}\ }}{\ ${lookup mysql{ \ SELECT sendto \ FROM alias \ WHERE ( username='${quote_mysql:$local_part}' \ AND (domain='${quote_mysql:$domain}' OR domain='') )}}\ } {\ ${lookup mysql{ \ SELECT sendto \ FROM alias \ WHERE ( ( username='${quote_mysql:$local_part}' AND (domain='${quote_mysql:$domain}' OR domain='') ) \ AND internal='NO' )}}\ }} local_part_suffix = +* local_part_suffix_optional # 2006-10-03 # virtual user in mysql-db? and suffixed with a condition? # currently supported: # #before# @ e.g.: email@example.com will accept mail for existing user firstname.lastname@example.com, if current date is before 20061003 # #fromdomain# @ e.g.: firstname.lastname@example.com will accept mail for existing user firstname.lastname@example.com, if current domain of sender is example.com mysql_user_condition: driver = accept # restriction to local domains only may be a double check, as the condition takes care of it already ;-) domains = +local_domains # 2006-10-08 # as we embed base64 encoded strings in local_part_suffix, and these are case sensitive, we must take care of them. # NOTE: this results in the missing feature, that conditional-mails in this router are case-sensitive! (pille#...#...@struction.de != Pille#...#...@struction.de) caseful_local_part = true condition = ${if and {{\ # existing user eq {${lookup mysql{ \ SELECT CONCAT(username,'@',domain) AS email \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{true}{false}}}{true}\ }{\ # different conditions or {{\ # suffix contains #before# and date (yyyymmdd) is not yet #before#yyyymmdd and {{\ eq {${sg{$local_part_suffix}{^#([^#]+)#[0-9]\{8\}\$}{\$1}}}{before}\ }{\ lt {$tod_logfile}{${sg{$local_part_suffix}{^#[^#]+#([0-9]\{8\})\$}{\$1}}}\ }\ }\ }{\ # suffix contains #fromdomain# and the domain-name of sender and {{\ eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{fromdomain}\ }{\ eq {$sender_address_domain}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\ }\ }\ }{\ # suffix contains #b64from# and the base64 encoded address of sender DOES NOT WORK YET! and {{\ eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{b64from}\ }{\ eq {${str2b64:$sender_address}}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\ }\ }\ }\ }\ }\ }\ } local_part_suffix = #* transport = local_mysql_delivery # 2006-09-07 virtual user in mysql-db? (note: it's not nessessary to return real data) mysql_user: driver = accept # restriction to local domains only may be a double check, as the condition takes care of it already ;-) domains = +local_domains condition = ${lookup mysql{ \ SELECT CONCAT(username,'@',domain) AS email \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{true}{false}} local_part_suffix = +* local_part_suffix_optional transport = local_mysql_delivery no_more # 2007-01-16 catchall domains # a catchall domain can be specified by giving one or more db-entries that match the domain, # or return a comma-seperated list of recipients. # this router acts as a fallback, so it has to be placed below all routers that react on 'users'. # any mail to a not otherwise (in another router above) defined local_prefix in these domains are forwarded. # so keep in mind that this mostly may forward unsolicited mail and should not be used at all ;-) mysql_catchall: driver = redirect # restriction to local domains only may be a double check, as data takes care of it already ;-) domains = +local_domains file_transport = address_file pipe_transport = address_pipe data = ${lookup mysql{ \ SELECT sendto \ FROM catchall \ WHERE domain='${quote_mysql:$domain}' \ }}
Add the following line to the remote_smtp-transport in the transport-section to remove some headers for outbound mail.
headers_remove = X-Spam-Report:X-Spam-Bar
Define a new transport local_mysql_delivery in the transport-section. This one will be called for virtual users to deliver the mail into their maildir:
local_mysql_delivery: driver = appendfile # file = /var/mail/$local_part # directory = /home/$local_part/.maildir directory = /var/mail/${domain}/${local_part}/ maildir_format delivery_date_add envelope_to_add return_path_add user = mail group = mail mode = 0660 # at this time, we know a local user to get his individual preferences to tag the mail # the '${eval:$header_X-Spam-Score-Int:}' is is a hack to cope with negative ints that seem to be parsed as strings, thus failing the comparsion # if there's no X-Spam-Score-Int header set by data-acl above, don't panic ;-) # another hack is that we remove important headers, we add later to be sure there are no multiple versions from earlier relays, or forged ones (this is BUGGY right now as it merges all equal headers!) # therefore i implemented the ${sg{$header_X-Spam-Score-Int:}{^.*\n}{}} regex hack, that strips all headers_remove = Subject : X-Spam-Flag : X-Spam-Score-Int : X-Spam-Score : X-Spam-Bar : X-Spam-Report headers_add = "X-Spam-Threshold: ${lookup mysql{ \ SELECT spam_threshold \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{$value}{ERROR}}\n\ X-Spam-Score: $header_X-Spam-Score:\n\ X-Spam-Score-Int: $header_X-Spam-Score-Int:\n\ X-Spam-Bar: $header_X-Spam-Bar:\n\ X-Spam-Report: $header_X-Spam-Report:\n\ X-Spam-Flag: ${if def:header_X-Spam-Score-Int:{\ ${if >={${eval:${sg{$header_X-Spam-Score-Int:}{^.*\n}{}}}}\ {${lookup mysql{ \ SELECT spam_threshold*10 \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{$value}{ERROR}}}{YES}{NO}}\ }{\ UNKNOWN\ }}\n\ Subject: ${if def:header_X-Spam-Score-Int:{\ ${if >={${eval:${sg{$header_X-Spam-Score-Int:}{^.*\n}{}}}}\ {${lookup mysql{ \ SELECT spam_threshold*10 \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{$value}{ERROR}}}{${lookup mysql{ \ SELECT spam_tag \ FROM user \ WHERE username='${quote_mysql:$local_part}' \ AND domain='${quote_mysql:$domain}' \ AND SMTP_allowed='YES' \ }{$value}{ERROR}}$h_subject:}{$h_subject:}}\ }{$h_subject:}}\n\ X-Delivered-To: $original_local_part@$original_domain ($local_part@$domain)\n\ X-Message-Age: $message_age"
Define the following two authenticators in authenticators-section. They will verify the password for SMTP-AUTH from the database, but advertise this functionality only if the connection is encrypted to avoid disclosure:
plain: driver = plaintext public_name = PLAIN server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}} server_condition = ${if crypteq {$3}{\{sha1\}${lookup mysql{ \ SELECT password \ FROM user \ WHERE CONCAT(username,'@',domain)='${quote_mysql:$2}' \ AND SMTPAUTH_allowed='YES' \ }}}{yes}{no}} server_set_id = $2 login: driver = "plaintext" public_name = "LOGIN" server_prompts = Username:: : Password:: server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}} server_condition = ${if crypteq {$2}{\{sha1\}${lookup mysql{ \ SELECT password \ FROM user \ WHERE CONCAT(username,'@',domain)='${quote_mysql:$1}' \ AND SMTPAUTH_allowed='YES' \ }}}{yes}{no}} server_set_id = $1
Create a daily cronjob
/etc/cron.daily/tidy_exim_dbs that cleans up old stuff from Exim's internal DBs.
Make sure, it's executeable!
Have a look for complete (Gentoo-based) config-files.
Please do not use without reading/understanding them first. There may be references to my domain-name in them and I don't want to read your mail that gets routed to me!
NOTE: the current version of SMAD (20090516) refers to the old version of this HOWTO. It should work with this version, but since automatic domain-recognition has changed its behaviour, this needs to be redesigned in SMAD, too. The main difference is that in SMAD you still need to create a (dummy) user to create a new domain. This will be changed in the next release of SMAD, in order to create alias- or catchall-only domains.
Simple Mail ADmin is available for beta-testing now. feel free to test it and file bugreports, if nessessary.
it should be feature-complete and allows you to:
SMAD will be renamed to VMSA (Virtual Mail System Admin) and hosted on SourceForge. you can try the development version in Mercurial SCM until the first new version is released:
hg clone http://vmsa.hg.sourceforge.net:8000/hgroot/vmsa/vmsa
for intructions how to install smad, please refer to the INSTALL file. we also provide a CHANGELOG.
On Gentoo you should be fine with the following additional dependencies:
you may try out the development version of the interface on our live-demo.
There are three roles to log in:
The database is reset once a day! If you experience problems or strange error messages - remember: it's the development version!
There's a great third-party add-on for Thunderbird called Virtual Identity, which allows you to manage your virtual identities (e.g. automatic plussed aliases, ...) with ease.
It has all the special voodoo to answer with the correct address if you reply and you don't have to setup these addresses as real accounts. Instead you can use them on the fly. You may even create a new one, just by editing the "From:"-line of your mail.
For SquirrelMail (an IMAP-WebMail) there's a plugin called change_sqlpass which does not seem to be maintained for some years now.
I've written a patch against the last version 3.3 to file change_sqlpass/functions.php to support the base64 encoded sha1 password hashes.
Configure it by creating a MySQL-user for squirrelmail and containing the following lines in change_sqlpass/config.php:
$csp_dsn = 'mysql://squirrelmail:SQUIRRELMAILPASSWORD@unix(/var/run/mysqld/mysqld.sock)/system'; $lookup_password_query = 'SELECT count(*) FROM user WHERE username = "%2" AND domain = "%3" AND password = %4'; $password_update_queries = array( 'UPDATE user SET password = %4 WHERE username = "%2" AND domain = "%3"' ); $force_change_password_check_query = ''; $password_encryption = 'B64SHA1'; $csp_salt_static = ''; $csp_salt_query = '';
For Apache's mod_auth_mysql I've written a patch against the last version 3.0.0 to file mod_auth_mysql.c to support the base64 encoded sha1 password hashes in our database. (see it on SourceForge's project patch page)
Configure it by creating a MySQL-user called apache with read-only access to the relevant username/domain/password fields using the password APACHEPASSWORD:
GRANT USAGE ON *.* TO 'apache'@'localhost' IDENTIFIED BY 'APACHEPASSWORD' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT SELECT ( `username` , `domain` , `password` ) ON `system`.`user` TO 'apache'@'localhost';
After compiling the patched module, you can create a password authenticated directory, all users of the mail-system can login to, by placing the following content in a .htaccess file (or the apache config):
AuthName "MySQL authenticated zone" AuthType Basic AuthMySQLUser apache AuthMySQLPassword APACHEPASSWORD AuthMySQLDB system AuthMySQLUserTable user AuthMySQLNameField CONCAT(username,'@',domain) AuthMySQLPasswordField password AuthMySQLPwEncryption sha1base64 require valid-user


text:
Set sail on the adventure of a life time in the Whitsundays. Experience the style, grace and pace of sailing on the classic timber tall ship, Derwent Hunter for the day.
Derwent Hunter visits some of the best snorkelling destinations in the Whitsundays. With our on board Marine Biologist & Master Reef Guide you will be sure to learn some fun and interesting facts throughout the day.
After a delicious morning tea, pick up a private mooring located at the northern Whitsunday Island reef and enjoy snorkelling on fringing corals. . Many snorkellers get the chance to swim with the large resident turtles who call this area home.
Visit a second beach/snorkelling location before returning to the vessel for a hearty fresh smorgasbord lunch freshly prepared on board.
Learn about the unique history of the Hunter and help to respect and preserve the Great Barrier Reef. Get involved and help the crew hoist the sails to sail back to Airlie Beach across the Whitsunday Passage. You can enjoy a cold beer or glass of wine from their onboard bar, with a delectable cheese platter for afternoon tea.
(Itinerary subject to weather conditions).
Day Sailing on tall ship Derwent Hunter to the premier snorkelling destinations at the remote northern Whitsundays Islands. Experience the thrill of getting involved with "real sailing" - help raise the sails, take the helm or sit back and watch the spectacular scenery pass by.
Try snorkelling at two fabulous locations, go ashore by dinghy and swim and snorkel from the safety of a sandy beach, ideal for those snorkelling for the first time. Enjoy a non stop smorgasbord of freshly prepared food from morning tea, delicious lunch and afternoon snacks with a cold beer or wine.
With plenty of deck space, permanent shade, and a passionate and friendly crew, the Derwent Hunter is an ideal platform to explore the Whitsunday Islands.
Note: Information on listed products and services are provided by the operator and were correct at the time of publishing. Rates are indicative based on the minimum and maximum available prices of products and services. Please visit the operator's website for further information. All prices quoted are in Australian dollars (AUD).


text:
There are a variety of B&B's to choose from in our association! From a log home in a peaceful mountain setting or Victorian home in the heart of the city, and everything in between, we have just what you're looking for to make you feel right at home. We all work together as a cohesive group to ensure a memorable experience.
Always looking for a deal? Our members offer a variety of packages or specials to help make your Northern Idaho trip an amazing one you'll talk about for years to come. We've partnered with many local vendors to package together exciting and adventurous activities. Whether it's a quite romantic reconnect, or activities to participate in while you stay with us, our packages and specials can get you started on your stay.
Northern Idaho is rich with outdoor adventure and exciting experiences. Whether you enjoy a thrilling roller coaster ride or zip-lining across the tree tops or a lazy cruise on one of our beautiful lakes, the Idaho panhandle has it all. We are happy to play concierge for you, and help you put together a vacation that you'll never forget.