Important Product Alert: Root Certificate Expiration
If you are using SSL with Netscape Messaging Server, you need to be aware of important information related to root certificate expiration. At a minimum, you may need to ask your users to upgrade their browsers to Communicator 4.7. Depending on how you are using SSL, you may also need to update the root certificate in your server. For important and urgent information on root certificate expiration, see Digital Certificate Security Alert.
These release notes contain important information about Netscape Messaging Server 4.1 Patch 2. Please read these notes before using the product. Messaging Server 4.1 Patch 2 is available only for the Solaris 2.6 platform.
Use of this product is subject to the terms detailed in the license agreement accompanying it. For information on installing Netscape Messaging Server 4.1, see http://home.netscape.com/eng/server/messaging/4.1/.
These release notes contain the following sections:
The complete and the patch releases install in the same manner.
Netscape Messaging Server 4.1 Patch 2 contains the following fixes to the Messaging Server 4.1 Patch 1 release:
The CERT advisory at http://www.cert.org/advisories/CA-2000-02.html describes two methods of attack whereby an e-mail may contain malicious HTML tags or scripts based on unvalidated input and/or from untrustworthy sources.
The Messenger Express function of Messaging Server 4.1 was vulnerable to one of these methods whereby it allowed tags such as <IMG>, <APPLET>, <OBJECT> and <EMBED> to be embedded in e-mail. This fix is that these tags are now stripped, along with previously stripped tags of <SCRIPT> and "onHandlers".
The ISS X-Force found a potential security vulnerability in the Netscape Enterprise and FastTrack web servers which also affects the Messenger Express function of the Messaging Server. The details are described at http://xforce.iss.net/alerts/advise37.php3.
This vulnerability has been fixed in Messaging Server 4.1 Patch 2.
Messaging Server 4.1 Patch 2 fixes a case where UTF-8 encoded headers were not being parsed properly and caused an smtp daemon failure.
The limits in size of 1 KByte if the Administration console is used, and 2 KBytes if text is entered using the configutil command has been fixed.
This has been fixed through the use of an updated shared library in <server-root>/bin/msg/lib/.
Messaging Server 4.1 Patch 2 adds support for a new configuration parameter which can be used to change the existing limit of 2000 messages that occurs when the the MTA throttles:
local.service.smtp.throttlethreshold
By default, this parameter is not set; the 2000 message limit is an internal limit.
Messaging Server 4.1 Patch 2 fixes a case where setting the service.smtp.authmaildomain parameter did not force SMTP authentication with those domains.
The parameter is set using one of the following methods:
./setconf service.smtp.authmaildomain "xxx. 0.0.0.0"
(with a tab between the xxx. and 0.0.0.0 values).
or
./configutil -o service.smtp.authmaildomain -v - < tabfile
(where tabfile is a file containing tab-separated entries).
The message returned to the sender appears as:
Your message was rejected by mail-host for the following reason:
Authentication required for this domain
Messaging Server 4.1 Patch 2 fixes several problems with inappropriate process growth by the smtp daemon. Note: none of these are related to load capacity.
Messaging Server 4.1 Patch 2 fixes several issues with queueing behavior of the smtp daemon.
Normally, only one message is sent during a session, but it was possible that the MTA would fail if more than one message was sent during a single session, and there were good, bad and deferred recipients in the second message.
Messaging Server 4.1 Patch 2 fixes several stability problems when handling bad/malformed messages and dealing with network failure conditions.
Messaging Server did not check whether or not the remote server supported DSNs (ESMTP), resulting in inappropriate delivery failures.
If multiple messages are sent through a single session of the MTA, the authentication state is lost and ignored after the first message.
No matter what the values of service.smtp.port or smtp/tcp service in /etc/services, the smtp log would show that it was listening on port 0.
The sendmail utility would use localhost and port 25 by default. Now sendmail not only supports the service.listenaddr and service.smtp.port configuration parameters, but to handle multiple instances of the messaging server, it also supports new configuration parameters:
local.service.sendmail.port
local.service.sendmail.listenaddr
See Tuning Recommendations for more information.
The service.smtp.domain configuration parameter was sometimes used rather than service.smtp.defaultdomain for address completion.
Previously this was considered a short-hand for invoking a program delivery, and was not supported, but that is not a problem and the RFC compliance issue has been fixed.
If you included a $ in your greeting message text, it now shows up as a $, rather than a /25 in the message that is delivered to the mailbox.
Messaging Server 4.1 Patch 2 changes a case where the default message sync level on the file system was not doing an explicit fdatasync() after each new message in the queue.
Messaging Server 4.1 Patch 2 fixes a case on HP/UX where sending messages with large attachments would be deferred.
Messaging Server 4.1 Patch 2 fixes a case on HP/UX where if the Directory Server goes off-line in the middle of a large dynamic group send, the message would not be properly deferred to the rest of the recipients.
The new user greeting messages auto-created on login contain a To: header which is not proper. This has been fixed so that the user's To: header now gets the information from the user's mail: attribute in LDAP.
During installation, the correct libUBEfilter.so and hide.so from <server-root>/bin/msg/install/templates/msg-inst/smtp-bin/plugins/ is now copied to the instance directory <server-root>/msg-<instance>/smtp-bin/plugins/.
This limitation has been raised to 10000 lines. If this many lines of filtering are needed, it's suggested that a plugin be used instead.
Messaging Server 4.1 Patch 2 fixes several issues with regard to the Unsolicited Bulk E-mail filtering and plugins.
Versions of Outlook Express (for example) can send MIME attachments with invalid closing terminator lines. The services would not correctly identify the size of the message. 4.1 Patch 2 now corrects for this.
The failure has been fixed and the upper limit has been increased to 256, but is now a set limit and will be logged if attempting to read a message with more than that number of attachments.
When parsing the message, if a uuencoded data block is encountered, the parser could sometimes fail to detect the terminator or trailing line.
If data is stored in ISO-8859-1 instead of UTF-8 in their directory server, the http daemon may fail with the following exception:
Run-time exception error; current exception: xalloc
No handler for exception.
Because of a problem with the session ID calculation, it was possible that users would be prevented from logging in due to the service attempting to re-use existing in-use session IDs. There is no security impact as the failure was that logins would not succeed.
Messaging Server 4.1 Patch 2 fixes many stability and display problems for the HTTP service.
The store daemon did not allocate enough space space for its internal stacks. The amount of space allocated by stored was doubled in 4.1 Patch 2.
In some situations, the stored may end up looping. This can be seen by running the command:
stored -v -v -1
Since this is supposed to only pass through the database once, if you see the same entry being processed, then looping is occuring.
If one of the services core dumps and leaves a mismatched set of opens and closes, then it's possible that stored will fail during recovery.
Messaging Server 4.1 Patch 2 fixes some rare stability problems for the Store service.
A message fetched during an IMAP session having an internal date prior to 1980 may cause imapd to fail. In 4.1 Patch 2, the offending message will have a log entry output instead of failing.
The service.authcachesize configuration parameter controls the size of the authentication cache. If the cache was not yet full, a lookup finds the user ID entry and the entry has expired, the internal cache reporting was being improperly incremented.
Messaging Server 4.1 Patch 2 fixes a case where running the nsds3setup command against an existing Administration domain setup in Directory Server 4.1 would fail.
Fix a problem found with the reconstruct utility found during failure testing.
If a client connects through the MMP using IMAP, a password surrounded by quotation marks will fail, while the same client connection directly to the Messaging Server will work properly. This is now fixed.
After upgrade, your Messaging Server configuration is changed to reference the correct User Directory.
See the following document for more tuning information: http://home.netscape.com/eng/server/messaging/4.15/TuningGuide.html
Messaging Server 4.04 and later allows the administrator to tune the maximum number of recipients of a message. Care should be taken to modify this values because ISPs and other systems receiving mailing lists may need to accept a large number of recipients in each mail.
By default, this value is set to 100000.
Messaging Server 4.1 Patch 2 adds support for a new configuration parameter which can be used to change the existing limit of 2000 messages that occurs when the MTA throttles:
local.service.smtp.throttlethreshold
By default, this parameter is not set; the 2000 message limit is an internal limit. You must restart the smtp daemon (as with all MTA configuration parameters) to have this value take effect
Messaging Server 4.1 Patch 2 adds support for the following new configuration parameters to handle multiple instances of the messaging server:
local.service.sendmail.port
local.service.sendmail.listenaddr
The sendmail utility now does the following when looking up its listen address and port number:
You cannot specify a symbolic-link directory or a mount-point directory as your server root. If you attempt to do this, the setup program displays a misleading error message.
To obtain Netscape Console for platforms other than the installed platform, you'll need to obtain the appropriate platform version of Netscape Console by visiting http://home.netscape.com/eng/server/console.
This will be fixed in the next release.
This will be fixed in the next release.
If you are using Directory Server 4.1, you must use Netscape Console 4.1 (packaged with Directory Server) to administer your Directory Server. (As of June 1999, Directory Server 4.1 is in beta release.)
All Netscape Console Java environments must be shut down before running uninstall. Close and exit all instances of the Netscape Console before running uninstall. Be sure there are no Netscape Console instances running on remote machines.
The server is compatible with Netscape Navigator 3.x and 4.x, and Internet Explorer 3.02 and above. These browsers support Javascript and therefore will support webmail access to Netscape Messaging Server 4.1. For optimal performance, Netscape recommends using Netscape Navigator 4.x or Internet Explorer 4.x browsers.
Netscape supports the XSERVER private extension for authenticating message submissions. Reconstructing a mailbox causes all of the authenticated sender information to be discarded.
If something interrupts the upgrade process that upgrades a Messaging Server 3.x mail store to the 4.x format, the process can be resumed. The upgrade process will not attempt to upgrade mailboxes that have already been upgraded to the 4.1 format. However, after the resumed upgrade is completed, you must run reconstruct -m before starting up the Messaging Server.
The program delivery option will not work with shells that are not considered valid. The /etc/shells file contains the path for all valid shells. If the file is missing or empty, the following are valid login shells for the user to which the message is addressed:
For more information about program delivery, see the Messaging Server Administrator's Guide.
This means a user might still receive "over quota" messages until the user receives a new message or until the user logs off and logs in again. You can fix this problem by sending mail to the user after you reset the quota limit.
If the server process terminates unexpectedly, shut down all Messaging Server processes before restarting the server. Otherwise, the remaining processes might stop responding while waiting for locks held by the terminated process.
For example, SMTP configuration settings require server restart; most POP, IMAP, and HTTP settings do not. If you have questions about a particular configuration setting, contact Technical Support.
NFS is not supported for several reasons, including: open with O_EXCL is not atomic. This technique is used for synchronizing deferred handling between various threads.
You may encounter problems (JavaScript errors, white screens) using the resize or refresh buttons of the browser used for Messenger Express.
If you see a significant size growth of the smtpd process, please contact Technical Support.
See also the previous section, Known Limitations and Considerations, and the following section, Corrections to the Documentation, for other issues that might affect product capability or use.
Solution: Install Messaging Server 4.1 with Directory Server Export version (which comes packaged with Netscape Messaging Server 4.1). Or, install Messaging Server and Directory Server in separate server roots.
Solution: After unpacking the Messaging Server 4.1 Patch 2 archive, modify the file msg/msg.inf so that it says:
[msg]
...
Dependencies = admin/4.1 (or whatever version of the Administration Server is in use)
Solution: If you install Messaging Server on the same Unix machine more than once, make sure the /etc/nsserver.cfg file contains, on the first line, the server-root of the Messaging Server you will be using.
If you have multiple queues, the uninstall process will remove the default queue, but not alternate queues. If you have multiple partitions, the uninstall process will remove the primary partition, but not subpartitions.
Solution: You will need to delete any alternate queues or subpartitions manually.
Solution: You might need to add an ACI for the webmail administrator to the LDAP user/group DN entry. For more information, contact Technical Support.
Solution: You will need to save the 3.x information and recreate the entries for Messaging Server 4.1.
Solution: You will need to save the 3.x information and recreate the entries for Messaging Server 4.1.
Solution: If you want to create a custom DN for the end-user administrator, you must create these entries manually before the installation. You must create the end-user administrator group DN with the common name Enduser Administrators ("cn=Enduser Administrators"). You can create the end-user administrator user DN using any uid.
Solution: If you want to specify a custom location for the queue directory, you must ensure that Messaging Server has access to the custom location.
Solution: If anonymous search is not available on the User/Groups Directory Server, then during installation the DN for the User/Groups Administrator should be used, not the uid for the User/Groups Administrator.
Solution: They are not started by default as stated in the install script.
Solution: In the /etc/NscpMsg script, set the timezone (TZ) for Messaging Server by adding the following line after the LANG= variable:
export TZ=GMT-8
If you include a slash character (\) in an over-quota message, Messaging Server cannot parse the message and will not deliver the message to the user.
Solution: When specifying an over-quota message, do not use a slash character (\) in the message.
If you see any of the following error messages:
Problem getting messaging server instance serving user <user>
Error in configinit
Solution: Make sure the mailaclbody.cgi and lscgi commands in the <server-root>/bin/user/admin/bin directory are setuid to the local.serveruid value, and setgid to the local.servergid value:
cd <server-root>/bin/user/admin/bin
chmod 06550 lscgi mailaclbody.cgi
chown local.serveruid lscgi mailaclbody.cgi
chgrp local.servergid lscgi mailaclbody.cgi
and
cd <server-root>/admin-serv/config && chmod 0640 adm.conf admpw
Solution: You can correct this problem by changing the line in the certmap.conf file from:
#default:FilterComps e, uid, ...
to
#default:FilterComps mail, uid, ...
Running configutil or setconf commands to change the values of the parameters local.ugldap* does not change the values.
Solution:The following values are read only. Their values are synchronized with the values retrieved from the administration server:
For local.ugldap* set the local.ugldapuselocal (to "yes") to ignore the administration server setting using configutil or setconf.
Another alternative is to leave local.ugldapuselocal as is and use Netscape Console to change the user and group DS in the administration server part of the console.
For local.ldaphost you cannot change it in the Messaging Server configuration. You have to change it in the administration server shared configuration (in <server-root>/shared/config/dbswitch.conf).
On some platforms, it is not possible to use the counterutil command-line utility to list the set of counter objects in a given server's counter registry. The following list includes all counter objects recognized by the utility:
The Logging and Log Analysis document shows the wrong format for the Accept Log entry.
The documentation says the format is:
moduleName: envelopeID: mailFrom:[ peerAddress]: peerHost: msgID: msgSize:numRecipients: recipientList
but the correct format is:
moduleName: envelopeID: msgID: [peerAddress]: peerHost: mailFrom: msgSize: numRecipients: recipientList
The instructions currently read as follows:
Instead, the instructions should read:
This utility needs to be included in msg.z and installed under the <server-root>/bin/msg/install/bin directory prior to installing the language package. This allows the installer to change the language configuration in the config database dynamically.
Usage: configlang [opt] [-s sitelanguage] [-a installedlanguages]
The utility itself is used as a post installer. Specify the sitelanguage using the -d option and the installedlanguages using the -a option. Please ensure that you specify the -b option to start the servers after reconfiguration.
The administrator's guide and related documents are posted at the location http://home.netscape.com/eng/server/messaging/4.1/.
Installation instructions and release notes for all Netscape servers are posted at the location http://home.netscape.com/eng/server/.
If you can't find the information you need, please contact Netscape technical support.