# C I T A D E L

## an open source messaging and collaboration platform

Copyright ©1987-2006 by the Citadel development team:

Clint Adams | portability enhancements
Steven M. Bellovin | author of public domain 'parsedate' function
Nathan Bryant | build system, security, database access, and others
Art Cancro | overall system design and lead developer
Brian Costello | cosmetics, additional commands
Nick Georbit | additional client features
David Given | IMAP and build patches
Wilfried Goesgens | build system patches
Michael Hampton | client software development
Andru Luvisi | troubleshooting and development assistance
Daniel Malament | string compare function for IMAP server
Stu Mark | additional client features, IGnet protocol design
Edward S. Marshall | RBL checking function design
Ben Mehlman | additional client features
Matt Pfleger | additional client features
Ari Samson | assistance with project management
Trey Van Riper | QA and portability enhancements
John Walker | author of public domain base64 encoder/decoder
Steve Williams | documentation
Ethan Young | IGnet protocol design

The entire package is open source software. You may redistribute and/or modify it under the terms of the GNU General Public License, version 2, which is included in this manual.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
For more information, visit either of these locations on the web:

- The Citadel home page: http://www.citadel.org
- UNCENSORED! BBS, the home of Citadel: http://uncensored.citadel.org

## Table of Contents

1. License
2. Installation

1. Everything in its place...
2. Creating a system account for Citadel
3. Bypassing the login: prompt
4. Compiling the programs
5. Upgrading
6. The citadel.rc file
7. Using an external editor for message composition
8. Printing messages
9. URL viewing
10. Setup and login
11. Configuring your host system to start the service
12. Logging in for the first time
13. Welcoming new users
14. Space for adding your own client features (doors)
15. Troubleshooting and getting help

3. System Administration

1. Overview
2. Aide commands
3. Editing rooms
4. File directories
5. Creating and editing user accounts
6. Deleting and moving messages
7. Customizing the help files
8. Site configuration

4. Configuring Citadel for Internet e-mail

1. Introduction
2. Basic site configuration
3. Enabling the Internet mail protocols
4. Hosting an Internet mailing list
5. Using Citadel in conjunction with another MTA

5. Building or joining a Citadel network

1. Overview
2. Conventions and etiquette when connecting to the public Citadel network
3. Getting ready to join the network
4. Defining neighbor nodes
5. Sharing rooms
6. Sending mail
7. Changing the polling interval

6. Database maintenance

1. Introduction
2. Backing up your Citadel database
3. Database repair
4. Importing/Exporting your Citadel database

7. Cryptography support (TLS/SSL)

1. Overview
2. Generating and installing a Trusted Certificate

8. LDAP directory support

1. Introduction
2. Preparing your LDAP server for Citadel connections
3. Configuring the LDAP Connector for Citadel

9. Included utilities

1. Overview
2. aidepost
3. whobbs
4. msgform
5. userlist
6. sendcommand

## GNU General Public License

Version 2, June 1991

    Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place - Suite 330, Boston, MA  02111-1307, USA

    Everyone is permitted to copy and distribute verbatim copies
    of this license document, but changing it is not allowed.

### Preamble

The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it.

For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.

We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.

Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations.

Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.

The precise terms and conditions for copying, distribution and modification follow.

### TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does.

1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.

You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

- a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.

- b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

- c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.

In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

- a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

- b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

- c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code.

4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.

This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.

8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.

9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

### END OF TERMS AND CONDITIONS

## Installation

### Overview

Citadel is an advanced, multiuser, client/server messaging system suitable for BBS, e-mail, and groupware applications. It is designed to handle the needs of both small dialup systems and large-scale Internet-connected systems. It was originally developed on an Altos system running Xenix, and has been installed and tested on various Unix and Unix-like platforms. The current development environment (and public BBS) is an ordinary Linux system. The current distribution includes:

- The Citadel server (this is the back end that does all processing)
- A text-based client program designed with the traditional Citadel "look and feel" (room prompts, dot commands, and the like)
- Setup programs
- A set of utilities for system administration and maintenance
- Documentation

Some knowledge of the Unix system is necessary to install and manage the system. It is mandatory that the sysop have "root" access to the operating system. The following are required to install Citadel:

- A unix-like operating system (Linux, FreeBSD, Solaris, etc.)
- C compiler (GCC with gmake is the recommended build environment)
- POSIX threads (already present on most systems)
- TCP/IP
- Berkeley DB v4.1 or newer
- libical v0.24 or newer (if you want the calendar service to work)
- Enough disk space to hold all of the programs and data

If you are running Citadel on a Linux system, it is STRONGLY recommended that you run it on a recent distribution (such as Fedora Core 3 or newer). A new-ish distribution will have most or all of the prerequisite tools and libraries already integrated for you.

### Other pieces which complete the Citadel system:

- "WebCit", a gateway program to allow full access to Citadel via the World Wide Web. Interactive access through any Web browser.
- Access to Citadel via any standards-compliant e-mail program, thanks to Citadel's built-in SMTP, POP, and IMAP services. You can use Mozilla, Netscape, Evolution, Eudora, Pine, Outlook, etc. with Citadel.
- Access to Citadel's calendar and address book functions using any GroupDAV-enabled PIM client (requires WebCit).

### Coming soon:

- More integration with third-party software.

### Everything in its place...

Hopefully you've unpacked the distribution archive into its own directory. This is the directory in which all Citadel files are located and in which all activity will take place. Several subdirectories have already been created during the unpacking process, and others may be created by the software if needed. Make sure you have Berkeley DB installed on your system, and that you have all the development libraries and headers in place so that you can compile against them. If you don't, you can get the latest Berkeley DB at http://www.sleepycat.com. If your operating system uses a separate library to support POSIX threads (pthreads), make sure that library is installed as well. This is almost never the case with Linux, but some commercial Unix flavors might need it.

### Creating a system account for Citadel

As with many Unix programs, Citadel wants to run under its own user ID. Unlike other programs, however, this user ID will do double-duty as a public login for your system if you are running a BBS. This account is typically called "bbs" or "citadel" or something to that effect. You will tell Citadel what the user-id of that account is, and when someone logs in under that account, Citadel will prompt for a user name.

The Citadel user should have a unique uid. The home directory should be the one your Citadel installation resides in (in this example we will use `/usr/local/citadel`) and the shell should be either "citadel" in that directory, or a script that will start up the citadel client. Example:

    citadel::100:1:Citadel Login:/usr/local/citadel:/usr/local/citadel/citadel

When you run setup later, you will be required to tell it the username or user ID of the account you created is, so it knows what user to run as. If you create an account called `citadel, bbs`, or `guest`, the setup program will automatically pick up the user ID by default.

For all other users in /etc/passwd (or in some other name service such as NIS), Citadel will automatically set up an account using the full name (or 'gecos' in Unixspeak) of the user. It'll also ignore any password you supply, because it uses the user's password on the host system. This allows a 'single sign on' type of environment. Note that this does have to be enabled at compile time -- it's the configure option called `--enable-autologin`. Keep in mind that these users can use *either* their Citadel login name or their login name on the host computer, and their password on the host computer.

### Bypassing the `login:` prompt

If you normally log in to your host system using some method other than telnet (such as ssh), you might want the telnet service to go straight into Citadel, instead of displaying the `login:` prompt first. You can do this by having telnetd start citadel directly instead of `/bin/login`. The `setup` program will offer to configure this automatically for you if it sees a configuration it understands. If you would prefer to configure it manually, all you need to do is make a simple change to your `inetd` or `xinetd` configuration. Here are some configuration examples.

An example for `inetd` (put the following line in `/etc/inetd.conf`, replacing any existing telnet configuration line already there):

    telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd -L /usr/local/citadel/citadel

An example for `xinetd` (if you have a file called `/etc/xinetd.d/telnet` then simply replace that file with this one):

    service telnet
    {
    	flags           = REUSE
    	socket_type     = stream
    	wait            = no
    	user            = root
    	server          = /usr/sbin/in.telnetd
    	server_args     = -L /usr/local/citadel/citadel
    	log_on_failure  += USERID
    	disable         = no
    }

Please make sure you know what you're doing before you install this! If you are going to put Citadel somewhere other than `/usr/local/citadel` then change the directory name accordingly. If you know of any other local peculiarities which need to be observed, edit the above configuration accordingly as well. And, of course, if you're working remotely, make sure you can successfully log in using SSH before you start making changes to telnet, because if you accidentally break telnet and don't have SSH running, you'll have effectively locked yourself out of your system until you can get physical access to the console.

### Compiling the programs

You can easily compile the Citadel system with the following commands:

    ./configure
    make
    make install

The 'configure' script will generate a Makefile from the Makefile.in, and it will also write the file "sysdep.h" to your Citadel directory. Please do not edit sysdep.h or Makefile.in yourself. The configure script will figure out your system dependencies and set everything correctly.

Mac OS X 10.1 and later are now supported. (Sorry, 10.0 cannot be supported, now or in the future.) You need to install the Developer Tools CD, which you can purchase or download for free from http://developer.apple.com. Then run configure like this:

    env CC=/usr/bin/cc ./configure (options - see below)

By default, the Citadel system will install in `/usr/local/citadel`. If you wish to place it in a different directory, you can instead do:

    ./configure --prefix=/export/home/citadel      (or whatever)

If you've got Berkeley DB installed in a non-standard location, you can help the configure script find it by doing something like this:

    ./configure --with-db=/usr/local/BerkeleyDB-4.1

Keep in mind that if you're using Berkeley DB from a non-standard location, you'll have to make sure that location is available at runtime.

File permissions are always a bother to work with. You don't want Citadel to crash because someone couldn't access a file, but you also don't want shell users peeking into the binaries to do things like reading others' mail, finding private rooms, etc. The Citadel server needs to be started as root in order to bind to privileged ports, but as soon as its initialization is finished, it changes its user ID to your Citadel user in order to avoid security holes.

### Upgrading

Any existing Citadel installation which is at version 5.50 or newer may be upgraded in place without the need to discard your existing data files.

Upgrading to a new version uses the same build procedure as compiling the program for a fresh install, except that you want to do `make upgrade` instead of `make install`. This will overwrite the programs but not your data. Be sure to shut down citserver during this process! If Citadel is running while you upgrade, you may face data corruption issues.

After doing `make upgrade`, you should run `setup` again to bring your data files up to date. Please see the setup section below for more information on this.

### The `citadel.rc` file

The text-based client included with Citadel is suitable for BBS applications. Much of its command set and other behavior is configurable through a Run Control (RC) file. The standard client looks for this file in the following locations:

- `$HOME/.citadelrc`
- your-Citadel-directory`/citadel.rc`
- `/etc/citadel.rc`
- current-directory`/citadel.rc`

The next couple of sections deal with client-side configuration.

### Using an external editor for message composition

Citadel has a built-in message editor. However, you can also use your favorite text editor to write messages. To do this you simply put a line in your citadel.rc file like this:

    editor=/usr/bin/vi

The above example would make Citadel call the vi editor when using the `.Enter Editor` command, or when a user selects the "Always compose messages with the full-screen editor" option. You can also make it the default editor for the `Enter` command by editing the `citadel.rc` file. But be warned: external editors on public systems can be a security hole, because they usually provide users with the ability to drop into a shell on the host system, or save files using names other than the name of the temporary file they are editing. If you intend to use an external editor on a public BBS, make sure you use one that has been hardened for such a purpose -- one which has had the 'shell' and 'save as' commands disabled, as well as any other functions which a destructive user could use to gain unauthorized access to your host system.

### Printing messages

Citadel can send messages to a printer, or just about anywhere else in your system. The variable `PRINTCMD` in `citadel.rc` specifies what command you use to print. Text is sent to the standard input (stdin) of the print command.

So if you did this:

    printcmd="a2ps -o - |lpr -Plocal"

...that would convert the printed text to PostScript, then print on the printer named "local". There's tons of stuff you can do with this feature. For example, you could use a command like `cat <<$HOME/archive` to save copies of important messages in a textfile. Again, this is probably something you don't want to configure for a public BBS host -- most system administrators don't want remote users sending arbitrary things to local printers.

### URL viewing

This is one more feature which is appropriate for local users. While reading a message that has Internet URL's in it, you can select the `URL-view` command, and it will perform some pre-defined action (usually, this is to open up the URL in a web browser). For example:

    urlcmd=netscape -remote "openURL(%s)"

In the above example, it would open up the URL in an open Netscape window.

### Setup and login

Before logging in for the first time, you must run the setup program. To begin this procedure, enter the following commands:

    cd /usr/local/citadel
    ./setup

The setup program will guide you through a simple configuration procedure. It will ask you what directory to place your data files in -- the default is the current directory, which is usually the sensible thing to select. If you want to run more than one instance of Citadel on the same host, however, you can specify a different directory here -- just remember to specify the directory name again when you start up the server later on.

`setup` will then shut down the Citadel service if it is found to be running.

You will then be prompted for the name of the system administrator. This is not merely a cosmetic option -- when you log in to your system a little while from now, you'll log in with this name, and it will automatically assign your account the highest access level.

Next, you will be prompted for the User ID of the Citadel account on your host system. If you have an account called `bbs`, `guest`, or `citadel`, that account's UID will be the default. If you are upgrading or reconfiguring an existing system, the existing value will be preserved.

Then you will be prompted for a server port number. This is the TCP port which Citadel clients use to connect to your Citadel server. In almost all cases, you want to use the default -- port 504, which is the official port number assigned by the IANA for Citadel implementations.

The Citadel service will then be started, and you will see the following message:

    Setup is finished.  You may now log in.

Setup is now complete, on most systems, anyway. Please see below to find out if you need to do anything else:

### Configuring your host system to start the service

Please note: this topic involves modifications made to `/etc/services` and `/etc/inittab` in order to configure your host system to automatically start the Citadel service. `setup` will automatically perform these steps if it can, and if you allow it to -- just answer 'Yes' when prompted, and everything will be taken care of for you. If you answer 'No' -- or if your system is a little bit odd (for example, BSD systems don't have `/etc/inittab`) -- read this section and do what you need to in order to get things configured.

Before you can use Citadel, you must define the "citadel" service to your system. This is accomplished by adding a line to your /etc/services file that looks something like this:

    citadel		504/tcp			# Citadel Server

504 is the port number officially designated by the IANA for use by Citadel. There should not be any need to use a different port number, unless you are running multiple Citadels on the same computer and therefore need a different port for each one.

The next step is to arrange for the server to start. The `citserver` program is the main Citadel server. Before we cover the recommended method of starting the server, let's examine its usage options:

    citserver [-hHomeDir] [-xDebugLevel] [-tTraceFile] [-lLogFacility] [-d] [-f]

The options are as follows:

`-hHomeDir` - the directory your Citadel data files live in. This should, of course, be a directory that you've run the `setup` program against to set up some data files. If a directory is not specified, the directory name which was specified in the `Makefile` will be used.

`-xDebugLevel` - Set the verbosity of trace messages printed. When -x is used, it will suppress messages sent to syslog (see below). In other words, syslog will never see certain messages if -x is used. Normally you should configure logging through syslog, but -x may still be useful in some circumstances. The available debugging levels are:

- 0 - Emergency condition; Citadel will exit immediately
- 1 - Severe errors; Citadel may be unable to continue without attention
- 2 - Critical errors; Citadel will continue with degraded functionality
- 3 - Error conditions; Citadel will recover and continue normally
- 4 - Warning messages; Citadel will continue normally
- 5 - Normal operational messages
- 6 - Informational messages, progress reports, etc.
- 7 - Debugging messages; extremely verbose

`-tTraceFile` - Tell the server where to send its debug/trace output. Normally it is sent to stdout.

`-lLogFacility` - Tell the server to send its debug/trace output to the `syslog` service on the host system instead of to a trace file. `LogFacility` must be one of: `kern, user, mail, daemon, auth, syslog, lpr, news, uucp, local0, local1, local2, local3, local4, local5, local6, local7`. Please note that use of the `-l` option will cancel any use of the `-t` option; that is, if you specify a trace file and a syslog facility, log output will only go to the syslog facility.

`-d` - Run as a daemon; i.e. in the background. This switch would be necessary if you were starting the Citadel server, for example, from an rc.local script (which is not recommended, because this won't allow the server to automatically restart when it is shut down).

`-f` - Defragment all the databases upon startup. This currently has no effect, as it is a vestige from the old data store.

The preferred method of starting the Citadel server is to place an entry in your /etc/inittab file. This will conveniently bring the server up when your system is up, and terminate it gracefully when your system is shutting down. The exact syntax for your system may vary, but here's an entry that could be used on a Linux system:

    cit:2345:respawn:/usr/local/citadel/citserver -h/usr/local/citadel -t/dev/tty9 -x6

In this example, we've chosen debugging level 6, and have the trace stuff output to one of the virtual consoles. It's important to remember to turn off any getty that is set up on that virtual console, if you do this. After making this change, the command `init q` works on most systems to tell init to re-read the file. If in doubt, just reboot the computer.

### Logging in for the first time

At this point, your system is ready to run. Run the `citadel` program from the shell and log in as a new user. NOTE: the first user account to be created will automatically be set to access level 6 (Aide). This overcomes some obvious logistical problems - normally, Aide access is given by another Aide, but since there aren't any on your system yet, this isn't possible.

### Welcoming new users

Sometimes you might decide that you want a welcome message (or several different messages) automatically mailed to new users upon their first login. Now there is a way to do this. If you create a room called `New User Greetings`, and it is a private room (invitation-only probably makes the most sense), any messages you enter into that room will automatically be delivered to all new users upon registration.

You can put anything you want there: a welcome message, system policies, special information, etc. You can also put as many messages there as you want to (although it really doesn't make sense to clutter new users' mailboxes with lots of junk).

Don't worry about wasting disk space, either. Citadel has a single-instance message store, so all the new users are actually looking at the same copy of the message on disk.

### Space for adding your own client features (doors)

Please take note! This function really represents the "old" way of doing things, and it doesn't fit in well with the client/server paradigm. Please consider it "deprecated" because it may be removed someday.

The "doorway" feature is just a generic way to add features to the system. It is called "Doorway" to make it resemble the doors on non-Unix boards, but as we all know, us Unix types don't have to write special code to access the modem. :-) Anyway, when a user hits the `*` (doorway) command, Citadel does...

    USERNAME=(username); export USERNAME
    ./subsystem (user-number) (screen-width) (access level)

...so you can put whatever you want in there. I suggest putting in a menu program to allow the users to pick one of a number of programs, etc. Do be aware that door programs will only be available when the client and server programs are running on the same computer, and when the user is running the text-mode client. Because of these restrictions, Door programs are being utilized less and less every day.

### Troubleshooting and getting help

That's just about all the information you need to install the system. But if you get stuck, you can visit UNCENSORED! BBS and report a problem or ask for help. But if you intend to report a problem getting the Citadel server to run, please double-check the following things first:

- Did you do `./configure && make && make install` ??
- Did you run setup?
- Did you start the server?

To report a problem, you can log on to UNCENSORED! or any other BBS on the Citadel network which carries the `Citadel/UX>` room. Please DO NOT e-mail the developers directly. Post a request for help on the BBS, with all of the following information:

- The exact nature of your difficulty
- A transcript of the error message(s) if possible
- The version of Citadel you are running
- The version of Berkeley DB present on your system
- Which operating system you are running, and what version
- If you are running a Linux system, we need to know which distribution, and the version of the kernel, libc, and pthreads you are using (it would help to post the output of a `ldd ./citserver` command).

## System Administration

### Overview

Citadel, when installed properly, will do most of its maintenance by itself. It is intended to be run unattended for extended periods of time, and most installations do just that without any software failures.

The system has seven access levels. Most users are at the bottom and have no special privileges. Aides are selected people who have special access within the Citadel program. Room Aides only have this access in a certain room. Preferred users can be selected by Aides for access to preferred only rooms. A sysop is anyone who has access to the various sysop utilities - these are in their own executable files, which should have their permissions set to allow only sysops to run them. You should either create a sysops group in /etc/group, or use some other existing group for this purpose.

Aides have access to EVERY room on the system, public and private (all types). They also have access to commands starting with `.Aide` in addition to being able to delete and move messages. The system room, `Aide>`, is accessible only by those users designated as Aides.

### Aide commands

Aides have the following commands available to them that are not available to normal users. They are:

`.Aide Kill this room` | Deletes the current room from the system.
`.Aide Edit this room` | Allows editing of the properties of the current room. This is explained in greater detail below.
`.Aide Who knows room` | For private rooms with access controls, or mailbox rooms, this command displays a list of users who have access to the current room.
`.Aide edit User` | Allows editing of the properties of any user account on the system.
`.Aide Validate new users` | For public access systems, this command reviews all new user registrations and allows you to set each new user's access level (or simply delete the accounts).
`.Aide enter Info file` | Each room may contain a short textual description of its purpose, which is displayed to users upon entering the room for the first time (or in the room banner, for users of the Web client). This command allows you to enter or edit that description.
`.Aide Room Invite user` | Access control command to grant any specific user access to a private room.
`.Aide Room Kick out user` | Access control command to revoke any specifc user's access to the current room. This works regardless of whether the room is public or private.
`.Aide File Delete` | If the current room has an associated file directory, this command may be used to delete files from it.
`.Aide File Send over net` | If the current room has an associated file directory, this command may be used to transmit a copy of any file in that directory to another node on a Citadel network.
`.Aide File Move` | If the current room has an associated file directory, this command may be used to move any file in that directory to another room. The target room must also have an associated file directory.
`.Aide Message edit` | This command allows editing of any of the various system banners and messages which are displayed to users. Type the name of the banner or message you wish to edit.
`.Aide Post` | This is the functional equivalent of the `Enter message` command available to all users, except that it allows you to post using any user name.
`.Aide System configuration General` | This command allows configuration of a large number of global settings for your Citadel system. These settings will be explained in greater detail below.
`.Aide System configuration Internet` | This command allows configuration of settings which affect how your Citadel system sends and receives messages on the Internet.
`.Aide System configuration check Message base` | Perform a consistency check on your message store. This is a very time-consuming operation which should not be performed unless you have reason to believe there is trouble with your database.
`.Aide System configuration Network` | Configure networking (e-mail, room sharing, etc.) with other Citadel nodes.
`.Aide System configuration network Filter list` | If you are on a large public or semi-public network of Citadel nodes and you find content from certain systems or individuals objectionable, you can use this command to define a rule set to automatically reject those messages when they arrive on your system.
`.Aide Terminate server Now` | Immediately shut down the Citadel service, disconnecting any users who are logged in. Please keep in mind that it will start right back up again if you are running the service from `/etc/inittab`, so in practice this command will probably not get much use.
`.Aide Terminate server Scheduled` | Shut down the Citadel service the next time there are zero users connected. This allows you to automatically wait until all users are logged out.
`.Aide mailing List recipients` | Any room may be made into a mailing list. Enter this command to open an editor window containing the list of Internet e-mail addresses to which every message posted in the room will be sent.
`.Aide mailing list Digest recipients` | Similar to the regular mailing list command, except the messages will be sent out in 'digest' form -- recipients will see messages from the address of the room itself rather than the address of the author of each message, and a digest may contain more than one message. Each room may have any combination of List and Digest recipients.
`.Aide Network room sharing` | Configures the sharing of the current room's contents with other Citadel nodes. Messages posted in this room on any Citadel system will automatically be replicated to other Citadel systems carrying the room.

### Editing rooms

This command allows any aide to change the parameters of a room. Go to the room you wish to edit and enter the `.Aide Edit room` command. A series of prompts will be displayed. The existing parameters will be displayed in brackets; simply press return if you want to leave any or all of them unchanged.

    Room name [IG's Fun Room]:

...the name of the room.

    Private room [Yes]?

...enter Yes if you wish to restrict access to the room, or no if the room is to be accessible by all users. Note that Citadel doesn't bother users about access to rooms every time they need to access the room. Once a user gains access to a private room, it then behaves like a public room to them. The following four questions will only be asked if you selected Private...

    Accessible by guessing room name [No]?

...if you enter Yes, the room will not show up in users' `Known rooms` listing, but if they `.Goto` the room (typing the room's full name), they will gain access to the room.

    Accessible by entering a password [No]?
    Room password [mypasswd]:

...this adds an additional layer of security to the room, prompting users for a password before they can gain access to the room.

If you did not select guessname or passworded, then the only way users can access the room is if an Aide explicitly invites them to the room using the `.Aide Room Invite user` command.

    Cause current users to forget room [No] ? No

Enter Yes if you wish to kick out anyone who currently has access to the room.

    Preferred users only [No]? No

Enter Yes if you wish to restrict the room to only users who have level 5 (Preferred User) status (and Aides too, of course). You should make the room public if you intend to do this, otherwise the two restrictions will be COMBINED.

    Read-only room [No]? No

If you set a room to Read-Only, then normal users will not be allowed to post messages in it. Messages may only be posted by Aides, and by utility programs such as the networker and the "aidepost" utility. This is useful in situations where a room is used exclusively for important announcements, or if you've set up a room to receive an Internet mailing list and posting wouldn't make sense. Other uses will, of course, become apparent as the need arises.

Now for a few other attributes...

    Directory room [Yes]? Yes

...enter Yes if you wish to associate a directory with this room. This can be used as a small file repository for files relevant to the topic of the room. If you enter Yes, you will also be prompted with the following four questions:

    Directory name [mydirname]:

...the name of the subdirectory to put this room's files in. The name of the directory created will be `<your Citadel directory>/files/<room dir name>`.

    Uploading allowed [Yes]? Yes

...enter Yes if users are allowed to upload to this room.

    Downloading allowed [Yes]? Yes

...enter Yes if users are allowed to download from this room.

    Visible directory [Yes]? Yes

...enter Yes if users can read the directory of this room.

    Network shared room [No]? No

...you can share a room over a network without setting this flag, and vice versa, but what this flag does is twofold:

- It prevents people with no network access from entering messages here
- Messages are displayed with the name of their originating system in the header.

    Permanent room [No]? No

Citadel contains an 'auto purger' which is capable of removing rooms which have not been posted in for a pre-defined period of time (by default this is set to two weeks). If you wish to keep this from happening to a particular room, you can set this option. (Keep in mind that `Lobby>`, `Aide>`, any private mailbox rooms, any network shared rooms, and any rooms with a file directory are automatically permanent.)

    Anonymous messages [No]? No
    Ask users whether to make messages anonymous [No]? No

...you can have rooms in which all messages are automatically anonymous, and you can have rooms in which users are prompted whether to make a message anonymous when they enter it. The real identity of the author of each message is still revealed to the Room Aide for this room, as well as any system-wide Aides.

    Room aide [Joe Responsible]:

...on larger systems, it helps to designate a person to be responsible for a room. Room Aides have access to a restricted set of Aide commands, ONLY when they are in the room in which they have this privilege. They can edit the room, delete the room, delete and move messages, and invite or kick out users (if it is a private room), but they cannot perform aide commands that are not room-related (such as changing users access levels).

    Listing order [64]:

This is just a simple way to try to control the order rooms are listed in when users call up a `Known Rooms` listing. Rooms with a lower listing order are displayed prior to rooms with a higher listing order. It has no other effect. For users who list rooms in floor order, the display will sort first by floor, then by listing order.

    Message expire policy (? for list) [0]:

This provides you with the opportunity to select how long each message will remain in a room before automatically being deleted. Press `?` for a list of options. You can choose to keep messages around forever (or until they are manually deleted), until they become a certain number of days old, or until a certain number of additional messages are posted in the room, at which time the oldest ones will scroll out.

When a new Citadel system is first installed, the default system-wide expire policy is set to 'manual' -- no automatic purging of messages takes place anywhere. For public message boards, you will probably want to set some sort of automatic expire policy, in order to prevent your message base from growing forever.

You will notice that you can also fall back to the default expire policy for the floor upon which the room resides. This is the default setting. You can change the floor's default with the `;Aide Edit floor` command. The default setting for the floor default, in turn, is the system default setting, which can be changed using the `.Aide System configuration General` command.

    Save changes (y/n)? Yes

...this gives you an opportunity to back out, if you feel you really messed things up while editing.

### File directories

If you have created any directory rooms, you can attach file descriptions to the filenames through a special file called `filedir`. Each line contains the name of a file in the directory, followed by a space and then a description of the file, such as:

    myfile.txt This is a description of my file.
    phluff A phile phull of phluff!

...this would create file descriptions for the files `myfile.txt` and `phluff` which would be displayed along with the directory. It should also be noted that when users upload files to your system, they will be prompted for file descriptions, which will be added to the `filedir` file. If one does not exist, it will be created.

### Creating and editing user accounts

Anyone with Aide level access may use the `.Aide edit User` command to create and/or edit user accounts. There are several parameters which can be set here.

To create a user:

    Lobby> . Aide edit User
    User name: New User Name
    No such user.
    Do you want to create this user? Yes

At this point, the new user account has been created, and the command will continue as if you were editing an existing account. Therefore the remainder of this procedure is the same for creating and editing:

    Lobby> . Aide edit User
    User name: person of significance
    User #70 - Person of Significance  PW:

    ,

    Current access level: 4 (Network User)

The blank lines are the user's 'registration' information -- personal information such as full name, address, telephone number, etc. This information will comprise the user's vCard in both their user profile and in the Global Address Book.

    Change password [No]: No

...answer Yes to set or change the password for this account.

    Access level [4]:

...this allows you to set or change the access level for this account. The access levels available are as follows:

- 0 - Deleted. (This immediately deletes the account.)
- 1 - New, unvalidated user
- 2 - Problem user (severely restricts account - use for probationary access)
- 3 - User with no network privileges. Same access as a normal user except cannot post messages in rooms shared on a network.
- 4 - Normal user
- 5 - Preferred user (access is granted to privileged rooms)
- 6 - Aide (administrative access to the whole system)

    Permission to send/receive Internet mail [ No]? No

If your system is configured to only allow Internet mail privileges to certain users, this is where you can grant or revoke that privilege.

    Ask user to register again [Yes]: Yes

If you answer Yes to this question, the user will be presented with a 'registration' screen or set of prompts, the next time they log in using a Citadel client. This will prompt them for their full name, address, telephone number, etc.

    Times called [0]:
    Messages posted [0]:

These statistics are available for informational purposes only, so there is normally no need to change them.

    Set last call to now [No]: No
    Purge time (in days, 0 for system default [0]:

Citadel contains an auto-purger which is capable of automatically deleting accounts which have not been accessed in a predefined period of time. If you choose to perform this operation, you can 'touch' the account of a wayward user by setting their 'last call' time to 'now'. You can also adjust, on a per-user basis, the amount of time which must pass before their account is purged by the system. This time is set in days. You can also specify 0 days to indicate that you wish to use the system default setting.

### Deleting and moving messages

Aides and Room Aides have the ability to delete and move messages. After each message, the normal prompt appears:

    (8) <B>ack <A>gain <Q>uote <R>eply <N>ext <S>top m<Y> next <?>help ->

Entering `Delete` will delete the message. A `(y/n)` prompt will appear to confirm that you really want to delete the message. Entering `Move` will prompt for a room to which the message should be moved.

### Customizing the help files

The subdirectory called `help` contains your system's help files. There's nothing hard-coded into the system that dictates what files should be there. Whenever a user types the command `.Help` followed by the name of a help file, it displays the contents of that help file.

The help files that come with the system, of course, are enough to guide a user through its operation. But you can add, change, or remove help files to suit whatever is appropriate for your system.

There are several strings that you can put in help files that will be automatically substituted with other strings. They are:

     ^nodename    = The node name of your system on a Citadel network
     ^humannode   = Human-readable node name (also your node name on C86Net)
     ^fqdn        = Your system's fully-qualified domain name
     ^username    = The name of the user reading the help file
     ^usernum     = The user number of the user reading the help file
     ^sysadm      = The name of the system administraor (i.e., you)
     ^variantname = The name of the software you're running
     ^bbsdir      = The directory on the host system in which you have
                    installed the Citadel system.

So, for example, you could create a help file which looked like:

      "Lots of help, of course, is available right here on ^humannode.  Of
    course, if you still have trouble, you could always bug ^sysadm about it!"

### Site configuration

Once your Citadel server is up and running, the first thing you'll want to do is customize and tune it. This can be done from the text-based client with the `.Aide System configuration General` command, or from WebCit (if you have it installed) by clicking 'Advanced Options' followed by 'Edit site-wide configuration.' Either method will offer the same configuration options. This document shows the text mode client being used.

The first set of options deal with the identification of your system.

    Lobby> . Aide System configuration General
    Node name [uncnsrd]:
    Fully qualified domain name [uncensored.citadel.org]:
    Human readable node name [Uncensored]:
    Modem dialup number [US 914 999 9999]:
    Geographic location of this system [Mount Kisco, NY]:
    Name of system administrator [IGnatius T Foobar]:
    Paginator prompt []:

'Node name' refers to the short, unqualified node name by which your system is known on a Citadel network. Generally it will be the same as the unqualified host name of your computer; this is, in fact, the default setting.

Then enter the fully-qualified domain name (FQDN) of your system. If you are not on the Internet, you can simply set it to the same as your unqualified host name. Otherwise you should set this value to the host name by which your system is most commonly known.

The field called 'Human-readable node name' (also known as the 'node title' or 'organization name' in other software) is used solely for display purposes. Set it to the actual name of your system as you want it to appear in banners, messages, etc.

If you have a modem or bank of modems answering data calls for your system, enter it in the field marked 'Modem dialup number.' Otherwise you may leave it blank.

'Geographic location of this system' is another display field. Enter a city and state, or city and country.

'Name of system administrator' is important! Any user who logs on with the name you enter here will automatically be granted Aide privileges. This is one of two ways for the system administrator to grant himself/herself Aide access to the system when initially setting it up. (The other is simply to have the first account created on a new installation.)

The next set of options are your system's security settings. Before delving into the actual options, we should review the various access levels available on the system. Citadel has seven access levels:

- 0 (Deleted). A user whose access level is set to 0 will automatically be deleted by the system.
- 1 (New User). Users at this level may only read messages. Entering messages is prohibited, except in the `Mail>` room, where a message to 'sysop' may be entered.
- 2 (Problem User). Also known as 'Twit.'
- 3 (Local User). May enter messages, except in rooms shared on a Citadel network.
- 4 (Network User). May enter messages in every accessible room.
- 5 (Preferred User). Use of this level is up to the whim of the system administrator.
- 6 (Aide). Access is granted to the administrative functions of the system. (This access level may also be granted to a user only for a specific room, please see 'Room Aide' for more information.)

    Require registration for new users [No]: No
    Disable self-service user account creation [No]: No
    Initial access level for new users [4]:
    Access level required to create rooms [4]:
    Automatically give room aide privs to a user who creates a private room [No]: No

    Automatically move problem user messages to twit room [Yes]: Yes
    Name of twit room [Trashcan]:
    Restrict Internet mail to only those with that privilege [No]: No
    Allow Aides to Zap (forget) rooms [Yes]: Yes
    Log all pages [No]: No

'Registration' refers to the process of a user entering various personal contact information (real name, address, telephone number, etc.) into the system. When enabled, this information is stored as a vCard object on the system in two places: the user's `My Citadel Config>` room, and in the `Global Address Book>` room. (Note: the latter should be made private on publicly-accessible systems, for obvious reasons.)

If you answer Yes to 'Require registration for new users' then each new user, upon creating a new account, will immediately be entered into the registration process. On the other hand, if you answer Yes to 'Disable self-service user account creation' then new users will not be able to log in at all -- all accounts must be created by an Aide.

'Initial access level for new users' should be set to 1 (New User) if you would like to review each new user's registration info before granting them higher access. This would be done periodically with the `.Aide Validate new users` command. If you do not require registration, you should set the initial access level to 4 (Network User).

Given the above options, it then becomes clear that there are generally two ways you can set up your Citadel system, depending on its purpose:

- A public access BBS or message board - since you do not know who might want to log in, self-service account creation needs to stay enabled. If you want to be strict about users identifying themselves, then you should also require users to register (just remember to post a privacy policy if you're going to collect personal information) -- then set the initial access level to 1 (New User), so new users cannot post messages until after you've validated them. For a more lax environment, you can remove the registration requirement and grant new accounts level 4 (Normal User) access on the first visit.
- A private email/groupware system for your organization - in this case, disable self-service account creation; you don't want strangers welcoming themselves to your system. You'll probably also want to disable registration, because you or some other site administrator will be entering users' contact info when you create their accounts. Since this is also how you assign their Internet e-mail addresses, it's probably a good idea to do it yourself instead of expecting them to do it.

'Access level required to create rooms' is up to you. You might wish to restrict the creation of new rooms only to Aides, or you might wish to allow anyone to create a room. The latter is one of the Citadel culture's most long-standing traditions; the former may be appropriate if users are abusing this privilege.

You have the ability to 'Automatically give room aide privs to a user who creates a private room.' If you answer Yes, then any user who creates a guess-name, passworded, or invitation-only room will automatically become the room aide, and will have access to a subset of the `.Aide` command set while in that room. If you would rather grant this permission manually, answer No.

Another tradition in the Citadel culture is to refrain from deleting problem users, but instead to 'twit' them (reduce their access level to 2 [Problem User]). You can then 'Automatically move problem user messages to twit room' (answer Yes, then specify 'Name of twit room' and remember to create that room). If you employ this logic, any user with level 2 (Problem User) access will continue to have access to the same set of rooms, but all messages posted will automatically be routed to the Trashcan (or whatever you call your twit room).

If you have Internet mail configured, you have the option of restricting its use on a user-by-user basis. If you wish to do this, answer Yes to 'Restrict Internet mail to only those with that privilege.' Obviously this makes no sense for an internal e-mail system, but for a public BBS it might be appropriate.

Normally, Aides have access to every room, public or private. They are also forbidden from `Zap`ping rooms, because the review of content is considered one of their roles. If you wish to change these policies, the next two options allow you to. You may 'Allow Aides to Zap (forget) rooms', in which case they may use the `Zap` command just like any other user. Aides may also `.Goto` any private mailbox belonging to any user, using a special room name format.

If your local security and/or privacy policy dictates that you keep a log of all pages (instant messages) that go through the system, then answer Yes to 'Log all pages'. If you answer Yes, you will be prompted for the name of a room to which all pages will be logged. If you answer No, then only the sender and recipient of each individual message will receive a copy.

The next set of options deals with the tuning of your system. It is usually safe to leave these untouched.

    Server connection idle timeout (in seconds) [900]:
    Maximum concurrent sessions [20]:
    Maximum message length [10000000]:
    Minimum number of worker threads [5]:
    Maximum number of worker threads [256]:
    Automatically delete committed database logs [Yes]:

The 'Server connection idle timeout' is for the connection between client and server software. It is not an idle timer for the user interface. 900 seconds (15 minutes) is the default and a sane setting.

'Maximum concurrent sessions' is the highest number of user sessions you wish to allow on your system at any given time. Citadel can scale to hundreds of concurrent users, but if you have limited hardware or (more likely) limited bandwidth, you might wish to set a maximum. You can also set it to zero for no limit.

'Maximum message length' is just that. This could be a good way to prevent enormous multimedia files from finding their way into your message base. This maximum is enforced in all protocols and is also advertised by the ESMTP service.

The minimum and maximum number of worker threads can be tuned to your liking. Citadel will attempt to keep one worker thread running per session, within these constraints. You should be aware that due to the use of the worker thread model, Citadel can handle a large number of concurrent sessions with a much smaller thread pool. If you don't know the programming theory behind multithreaded servers, you should leave these parameters alone.

'Automatically delete committed database logs' is a crucial setting which affects your system's disk utilization and backup recoverability. Please refer to the database maintenance section of this document to learn how the presence or absence of database logs affect your ability to reliably backup your Citadel system.

The next set of options affect how Citadel behaves on a network.

    Server IP address (0.0.0.0 for 'any') [0.0.0.0]:
    POP3 server port (-1 to disable) [110]:
    POP3S server port (-1 to disable) [995]:
    IMAP server port (-1 to disable) [143]:
    IMAPS server port (-1 to disable) [993]:
    SMTP MTA server port (-1 to disable) [25]:
    SMTP MSA server port (-1 to disable) [587]:
    SMTPS server port (-1 to disable) [465]:
    Correct forged From: lines during authenticated SMTP [Yes]:
    Allow unauthenticated SMTP clients to spoof my domains [No]: No
    Instantly expunge deleted IMAP messages [No]: Yes

"Server IP address" refers to the IP address on your server to which Citadel's protocol services should be bound. Normally you will leave this set to 0.0.0.0, which will cause Citadel to listen on all of your server's interfaces. However, if you are running multiple Citadels on a server with multiple IP addresses, this is where you would specify which one to bind this instance of Citadel to.

Then you can specify TCP port numbers for the SMTP, POP3, and IMAP services. For a system being used primarily for Internet e-mail, these are essential, so you'll want to specify the standard port numbers: 25, 110, and 143. If Citadel is running alongside some other mail system, though, then you might want to choose other, unused port numbers, or enter -1 for any protocol to disable it entirely.

You'll also notice that you can specify two port numbers for SMTP: one for MTA (Mail Transport Agent) and one for MSA (Mail Submission Agent). The traditional ports to use for these purposes are 25 and 587. If you are running an external MTA, such as Postfix (which submits mail to Citadel using LMTP) or Sendmail (which submits mail to Citadel using the 'citmail' delivery agent), that external MTA will be running on port 25, and you should specify "-1" for the Citadel MTA port to disable it. The MSA port (again, usually 587) would be the port used by end-user mail client programs such as Aethera, Thunderbird, Eudora, or Outlook, to submit mail into the system. All connections to the MSA port must use Authenticated SMTP.

The protocols ending in "S" (POP3S, IMAPS, and SMTPS) are SSL-encrypted. Although all of these protocols support the STARTTLS command, older client software sometimes requires connecting to "always encrypted" server ports. Usually when you are looking at a client program that gives you a choice of "SSL or TLS," the SSL option will connect to one of these dedicated ports, while the TLS option will connect to the unencrypted port and then issue a STARTTLS command to begin encryption. (It is worth noting that this is not the proper use of the acronyms SSL and TLS, but that's how they're usually used in many client programs.)

All of the default port numbers, including the encrypted ones, are the standard ones.

The question about correcting forged From: lines affects how Citadel behaves with authenticated SMTP clients. Citadel does not ever allow third-party SMTP relaying from unauthenticated clients -- any incoming messages must be addressed to a user on the system or somewhere in a Citadel network. To use Citadel with SMTP client software such as Netscape, Outlook, Eudora, or whatever, users must log in with a username and password. In order to prevent message forgeries, Citadel discards the `From:` line in any message entered by an authenticated user, and replaces it with a `From:` line containing the user's genuine name and e-mail address. Technically, this violates RFC822, because headers are never supposed to be altered, but common sense dictates that this is a good idea. Nevertheless, if you want to suppress this behavior, answer 'No' at the prompt (the default is 'Yes') and the headers will never be altered.

"Instant expunge" affects what happens when IMAP users delete messages. As you may already know, messages are not truly deleted when an IMAP client sends a delete command; they are only marked for deletion. The IMAP client must also send an "expunge" command to actually delete the message. The Citadel server automatically expunges messages when the client logs out or selects a different folder, but if you select the Instant Expunge option, an expunge operation will automatically follow any delete operation (and the client will be notified, preventing any mailbox state problems). This is a good option to select, for example, if you have users who leave their IMAP client software open all the time and are wondering why their deleted messages show up again when they log in from a different location (such as WebCit).

"Allow spoofing" refers to the security level applied to non-authenticated SMTP clients. Normally, when another host connects to Citadel via SMTP to deliver mail, Citadel will reject any attempt to send mail whose sender (From) address matches one of your host's own domains. This forces your legitimate users to authenticate properly, and prevents foreign hosts (such as spammers) from forging mail from your domains. If, however, this behavior is creating a problem for you, you can select this option to bypass this particular security check.
Connect this Citadel to an LDAP directory [No]: No

The LDAP configuration options are discussed elsewhere in this document.

The final set of options configures system-wide defaults for the auto-purger:

    Default user purge time (days) [120]:
    Default room purge time (days) [30]:
    System default message expire policy (? for list) [0]:
    Keep how many messages online? [150]:
    Mailbox default message expire policy (? for list) [0]:
    How often to run network jobs (in seconds) [1800]:
    Enable full text search index (warning: resource intensive) [Yes]: Yes
    Hour to run purges (0-23) [4]:

    Perform journaling of email messages [No]:
    Perform journaling of non-email messages [No]:
    Email destination of journalized messages [example@example.com]:

Any user who does not log in for the period specified in 'Default user purge time' will be deleted the next time a purge is run. This setting may be modified on a per-user basis.

'Default room purge time' behaves the same way, and may also be modified on a per-room basis.

'System default message expire policy' defines the way in which old messages are expired (purged) off the system. You can specify any of:

- Purge by age (specify in days)
- Purge by message count in the room (specify number of messages)
- Do not purge at all

Again, this setting may be overridden on a per-floor basis, and the floor setting may be overridden on a per-room basis. You'll also notice that you can set a different default for mailbox rooms if you want to. This can allow you, for example, to set a policy under which old messages scroll out of public rooms, but private mail stays online indefinitely until deleted by the mailbox owners.

"How often to run network jobs" refers to the sharing of content on a Citadel network. If your system is on a Citadel network, this configuration item dictates how often the Citadel server will contact other Citadel servers to send and receive messages. In reality, this will happen more frequently than you specify, because other Citadel servers will be contacting yours at regular intervals as well.

"Hour to run purges" determines when expired and/or deleted objects are purged from the database. These purge operations are typically run overnight and automatically, sometime during whatever hour you specify. If your site is much busier at night than during the day, you may choose to have the auto-purger run during the day.

"Enable full text search index," if enabled, instructs the server to build and maintain a searchable index of all messages on the system. This is a time and resource intensive process -- it could take days to build the index if you enable it on a large database. It is also fairly memory intensive; we do not recommend that you enable the index unless your host system has at least 512 MB of memory. Once enabled, however, it will be updated incrementally and will not have any noticeable impact on the interactive response time of your system. The full text index is currently only searchable when using IMAP clients; other search facilities will be made available in the near future.

The "Perform journaling..." options allow you to configure your Citadel server to send an extra copy of every message, along with recipient information if applicable, to the email address of your choice. The journaling destination address may be an account on the local Citadel server, an account on another Citadel server on your network, or an Internet email address. These options, used in conjunction with an archiving service, allow you to build an archive of all messages which flow through your Citadel system. This is typically used for regulatory compliance in industries which require such things. Please refer to the journaling guide for more details on this subject.

Save this configuration? No

When you're done, enter 'Yes' to confirm the changes, or 'No' to discard the changes.

## Configuring Citadel for Internet e-mail

### Introduction

As you know by now, Citadel is a completely self-contained, full-featured Internet e-mail system. When you run Citadel you do not need any other mail software on your host system. This eliminates the need for tedious mucking about with sendmail, qmail, postfix, Cyrus, the UW IMAP server, or any of countless other needlessly complex programs that lead some people to the false assumption that Unix systems are difficult to administer.
Some of the many features supported by Citadel are:

- Built-in SMTP and ESMTP service, for delivering and receiving e-mail on the Internet
- Built-in POP3 service, for remote fetching of messages
- Built-in IMAP service, for access to mail using any standard mail client program
- Web mail (implemented using the "WebCit" middleware, which is installed separately)
- Support for mailing lists, in both "individual message" and "digest" formats
- Multiple/virtual domain support
- Any user may have multiple Internet e-mail addresses, in multiple domains
- Global address book (Users with addresses in a domain may be spread out across many servers on a Citadel network)
- Easy-to-configure integration with SpamAssassin can block spam before it enters the mail system
- Easy-to-configure integration with most Realtime Blackhole Lists (RBL) provide further defense against spammers

This section of the documentation will demonstrate how to configure these features.

### Basic site configuration

Basic configuration of your Citadel system for Internet e-mail begins with the `.Aide System configuration Internet` command:

    Lobby> .Aide System configuration Internet

    ###                    Host or domain                     Record type
    --- -------------------------------------------------- --------------------
      1
    <A>dd <D>elete <S>ave <Q>uit  ->

This is a "clean" setup. For a simple, standalone e-mail system you simply have to enter the `Add` command:

    <A>dd <D>elete <S>ave <Q>uit  -> Add

    Enter host name: schmeep.splorph.com
     (1) localhost       (Alias for this computer)
     (2) gateway domain  (Domain for all Citadel systems)
     (3) smart-host      (Forward all outbound mail to this host)
     (4) directory       (Consult the Global Address Book)
     (5) SpamAssassin    (Address of SpamAssassin server)
     (6) RBL             (domain suffix of spam hunting RBL)

    Which one [1]:

localhost: Basically what you're doing here is telling Citadel what any aliases for your machine are. If your machine were `schmeep.splorph.com` and you also had a DNS entry set up for `blah.com`, you might want to enter '1' and enter `blah.com` as your alias, so that e-mail sent to that address won't bounce.

Important tip: if your system is known by one name and only one domain, you might not even need to do this at all. You will recall that you entered your system's fully qualified domain name earlier when you went through the `.Aide System configuration General` command. The domain name you entered there is automatically considered by Citadel to be a 'localhost' entry in your Internet mail configuration. It does not hurt to enter it in both locations, though.

gateway domain: this is a simple way of mapping various Citadel hosts in an Internet domain. For example, if you enter `bar.com` as a gateway domain, then mail to users at `foo.bar.com` will be forwarded to the host called `foo` on a Citadel network, mail to users at `kunst.bar.com` will be delivered to the Citadel server called `kunst`, etc. This feature has limited usefulness; if you are operating a network of Citadel servers, it is more likely that you will use the 'directory' feature, explained below.

smart-host: Normally, Citadel sends outbound Internet e-mail directly to its destination. This may not be appropriate for some sites; you may require (due to local convention, security policy, or whatever) that all outbound mail be sent to an SMTP relay or forwarder. To configure this functionality, simply enter the domain name or IP address of your relay as a 'smart-host' entry.

If your relay server is running on a port other than the standard SMTP port 25, you can also specify the port number using "host:port" syntax; i.e. `relay99.myisp.com:2525`

Furthermore, if your relay server requires authentication, you can specify it using username:password@host or username:password@host:port syntax; i.e. `jsmith:pass123@relay99.myisp.com:25`

directory: a domain for which you are participating in directory services across any number of Citadel nodes. For example, if users who have addresses in the domain `citadel.org` are spread out across multiple Citadel servers on your network, then enter `citadel.org` as a 'directory' entry. For this to work, all Citadel servers participating in directory service must carry and share the `Global Address Book>` room.

spamassassin: if you are running a SpamAssassin service anywhere on your local network, enter its name or IP address as a 'spamassassin' entry. This may be (and, in fact, will usually be) `127.0.0.1` to specify that the service is running on the same host computer as the Citadel server.

Please install SpamAssassin as per its own documentation. You will want to run SpamAssassin in client/server mode, where a `spamd` daemon is always running on your computer. Citadel does not utilize the `spamc` client; instead, it implements SpamAssassin's protocol on its own.

Connecting to a SpamAssassin service across a wide area network is strongly discouraged. In order to determine whether an incoming e-mail is spam, Citadel must feed the entire message to the SpamAssassin service. Doing this over a wide area network would consume time and bandwidth, which would affect performance.

Citadel invokes the SpamAssassin service when incoming messages are arriving via SMTP. Before a message is accepted, it is submitted to SpamAssassin. If SpamAssassin determines that the message is spam, the Citadel SMTP service rejects the message, causing a delivery failure on the sending host. This is superior to software which files away spam in a separate folder, because delivery failures will cause some spammers to assume the address is invalid and remove it from their mailing lists.

RBL: Realtime Blackhole Lists (RBL's) provide defense against spammers based on their source IP address. There are many such lists available on the Internet, some of which may be utilized free of charge. Since they are DNS based, the lists do not require storage on your server -- they are queried during the SMTP conversation.

Citadel can utilize any RBL that uses the `z.y.x.w.nameoflist.org` syntax, where `w.x.y.z` is the source IP address which is attempting to deliver mail to your server. For example, SpamCop would use the query `2.0.0.127.bl.spamcop.net` to determine whether the host at `127.0.0.2` is a known spammer or open relay. In this case, you simply select option '6' to add an RBL entry, and provide it with the domain suffix of `bl.spamcop.net` (the IP address and extra dot will be automatically prepended for each query).

Now select `Save` and you are just about ready for Internet e-mail.

### Enabling the Internet mail protocols

As previously mentioned, Citadel contains its own SMTP, POP3, and IMAP services. Enabling them is simple.

Check for the existance of a current MTA (sendmail, qmail, etc.) by connecting to port 25 on your host. If you see something similar to the following you're running an MTA already and you'll need to shut it down:

    smw @ pixel % telnet localhost 25
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    220 pixel.citadel.org ESMTP Sendmail 8.9.3/8.9.3; Wed, 15 Mar 2000 19:00:53 -0500

In the above example, we see that the host already has Sendmail listening on port 25. Before Citadel can use port 25, Sendmail must be shut off. Please consult the documentation for your operating system for instructions on how to do this. (On a Red Hat Linux system, for example, you can run the `ntsysv` utility, un-checking `sendmail` to disable it at the next reboot; then, run `service sendmail stop` to shut off the currently running service.)

If you get a 'connection refused' message when you telnet to port 25 there's nothing running and you should be able to continue. You might also want to turn off POP (try the above test substituting 110 for 25) and IMAP (port 143) and use Citadel's POP and IMAP services.

Citadel will look for an existing pop/smtp server on startup. If they don't exist (and you've configured them properly) then Citadel should enable them at startup. You can check your logs to be sure, or you can start the server from a shell and watch it load. It might look something like this:

    smw @ pixel % ./citserver

    Multithreaded message server for Citadel
    Copyright (C) 1987-2003 by the Citadel development team.
    Citadel is open source, covered by the GNU General Public License, and
    you are welcome to change it and/or distribute copies of it under certain
    conditions.  There is absolutely no warranty for this software.  Please
    read the 'COPYING.txt' file for details.

    Loading citadel.config
    Opening databases
    This is GDBM version 1.8.0, as of May 19, 1999.
    Checking floor reference counts
    Creating base rooms (if necessary)
    Registered a new service (TCP port 504)
    Registered a new service (TCP port 0)
    Initializing loadable modules
    Registered server command CHAT (Begin real-time chat)
    Registered server command PEXP (Poll for instant messages)
    Registered server command GEXP (Get instant messages)
    Registered server command SEXP (Send an instant message)
    Registered server command DEXP (Disable instant messages)
    Registered a new session function (type 0)
    Registered a new x-msg function (priority 0)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Registered a new session function (type 1)
    Registered a new message function (type 201)
    Registered a new message function (type 202)
    Registered server command REGI (Enter registration info)
    Registered server command GREG (Get registration info)
    Registered a new user function (type 100)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Server-hosted upgrade level is 5.62
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Registered server command EXPI (Expire old system objects)
    Registered server command FSCK (Check message ref counts)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    citserver: Can't bind: Address already in use
    ERROR: could not bind to TCP port 25.
    Registered a new service (TCP port 0)
    Registered a new session function (type 50)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    citserver: Can't bind: Address already in use
    ERROR: could not bind to TCP port 110.
    Registered a new session function (type 0)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Registered a new message function (type 202)Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Registered server command RWHO (Display who is online)
    Registered server command HCHG (Masquerade hostname)
    Registered server command RCHG (Masquerade roomname)
    Registered server command UCHG (Masquerade username)
    Registered server command STEL (Enter/exit stealth mode)
    Loaded module: $Id: citadel.html 4538 2006-07-09 14:05:59Z ajc $
    Changing uid to 513
    Starting housekeeper thread

The lines emphasized in boldface in the above log output tell you that Citadel "can't bind" to various ports. The error 'address already in use' generally means that something else is already running on the requested port. Make SURE you've followed the above steps to remove sendmail/pop and start your Citadel server again.

### Using Citadel in conjunction with another MTA

Occationally it is not practical to remove a non-Citadel MTA on your host system. For example, you might have multiple groups of users, some of which are using Citadel and some of which are using a legacy Unix mail spool. This type of configuration is discouraged, but two tools are provided to allow it.

The tool is called `citmail` and it is, quite simply, a local MDA (Mail Delivery Agent) which you can configure into your MTA for final delivery of incoming messages to Citadel users. A full discussion of the finer points of complex Sendmail configurations is beyond the scope of this document; however, you might want to visit Pixel BBS where some useful HOWTO documents are provided.

The other tool is an RFC2033 compliant LMTP service running on a local socket. If you're running a mailer that speaks LMTP (such as Postfix), you can simply point your mailer at the socket called citadel.socket in your Citadel directory. For example, in Postfix you might put the following line into main.cf in order to tell it to use Citadel to deliver mail to local recipients:

    local_transport = lmtp:unix:/usr/local/citadel/lmtp.socket

Postfix also has something called a "fallback transport" which can be used to implement Citadel as a "secondary" mail system on your server, while keeping the existing Unix mailboxes intact. However, it is beyond the scope of this document to detail the finer points of the configuration of Postfix or any other mailer, so refer to the documentation to those programs and keep in mind that Citadel has LMTP support.

There are actually two LMTP sockets. One is called `lmtp.socket` and the other is called `lmtp-unfiltered.socket` (both are found in your Citadel directory). The difference should be obvious: messages submitted via `lmtp.socket` are subject to any spam filtering you may have configured (such as SpamAssassin), while messages submitted via `lmtp-unfiltered.socket` will bypass the filters. You would use the filtered socket when receiving mail from an external MTA such as Postfix, but you might want to use the unfiltered socket with utilities such as fetchmail.

For outbound mail, you can either allow Citadel to perform deliveries directly (this won't affect your other mail system because outbound mail doesn't tie up port 25) or enter `127.0.0.1` as your smart-host, which will tell Citadel to forward all of its outbound mail to your other mail system.

### Hosting an Internet mailing list

Citadel has built in mailing list service (known in the 'net vernacular as "listserv") functionality. You can turn any room into a mailing list. Users can then choose how they participate -- by logging on to your Citadel server directly, or by having the room's contents mailed to them somewhere else. Configuring this is easy.

Citadel supports two modes of mailing list delivery:

- "List mode" -- each individual message is delivered as a single e-mail to each list mode recipient. The "From:" header will display the address of the message's original author.
- "Digest mode" -- groups of one or more messages are delivered to digest mode recipients. The number of messages in the group depends on how many new messages arrived since the last batch was delivered. The "From:" header will display the address of the room itself, which allows replies to be posted back to the room.

A room may have any combination of list mode and digest mode recipients.

As alluded to above, every room on your Citadel system has an Internet e-mail address of its own. Messages sent to that address will be posted in the room (and sent back out to mailing list recipients, as well as to any other Citadels you share the room with). The address format is `room_` plus the name of the room, with any spaces replaced by underscores, followed by `@` and your hostname. For example, if your system is known as `phlargmalb.orc.org` on the Internet, and you have a room called `Bubblegum Collectors`, you can post to that room from anywhere on the Internet simply by sending an e-mail to `room_bubblegum_collectors@phlargmalb.orc.org`. When the message arrives, it's automatically posted in that room.

To manually edit the list of "list mode" recipients, simply enter the `.Aide mailing List management` command. Your text editor will open up and you will be able to create or edit a list of recipients, one per line. Lines beginning with a hash (`#`) are comments.

To manually edit the list of "digest mode" recipients, enter the `.Aide mailing list Digest recipients` command. As with the previous command, the text editor will open up and you can edit the list of digest mode recipients, one per line.

Citadel also has a facility which allows users to subscribe or unsubscribe to mailing lists using a web browser. In order to do this, WebCit must also be running on your server in addition to Citadel. WebCit is obtained and installed separately from the rest of the Citadel system.

In order to prevent "just anyone" from subscribing to any room on your system, there is a setting in the `.Aide Edit room` command:

    CitaNews} . Aide Edit this room

    Room name [CitaNews]:

    (lots of other stuff omitted for brevity...)

    Self-service list subscribe/unsubscribe [No]: Yes

When you answer "Yes" to self-service list subscribe/unsubscribe, you are enabling that feature. Now, all you have to do is tell the world about the web page they need to visit. It looks like this:

`http://foobar.baz.org:2000/listsub`

In this example, the server is called `foobar.baz.org` and WebCit is running on port 2000. Edit appropriately.

Citadel offers a subscribe/unsubscribe facility that is more intuitive than other listservs. With most systems, sending commands to the listserv requires that you e-mail it commands in a special format. It's easy to get it wrong. Citadel simply uses your web browser. You select the list you want to subscribe or unsubscribe (hint: it's the list of rooms you've enabled self-service for), select whether you want list mode or digest mode, and enter your e-mail address. For security purposes, a confirmation message is sent to the address you enter. But you don't have to reply to the message in a weird format, either: the confirmation contains another URL which you simply click on (or paste into your browser if you can't click on URL's in your e-mail software) and the confirmation is automatically completed.

## Building or joining a Citadel network

### Overview

If you are running Citadel as a BBS or other forum type of application, one way to 'keep the conversation going' is to share rooms with other Citadel systems. In a shared room, a message posted to the room is automatically propagated to every system on the network. It's kind of like a UseNet newsgroup, but without the spam.

If you are using Citadel as the e-mail and groupware platform for a large organization, you can use its networking features to build a large network of Citadel servers which share content (think of rooms as public folders), redistribute e-mail throughout the organization, and integrate the global address book. It might make sense, for example, in a large corporation to give each department or location its own Citadel server. Thanks to Citadel's global address book features, you could still have all of the users share a single e-mail domain.

Obviously, the first thing you have to do is find another Citadel to share rooms with, and make arrangements with them. The following Citadels are a good place to start:

- UNCENSORED! - uncensored.citadel.org
- The Dog Pound II - dogpound2.citadel.org
- PixelBBS - pixel.citadel.org

You don't have to be a part of the citadel.org domain to participate in the public Citadel network, but the DNS service is provided free of charge by the Citadel community if you wish to do this.

### Conventions and etiquette when connecting to the public Citadel network

Before we get into the technical nitty gritty, there are two points of etiquette to keep in mind. The first thing to keep in mind is that the operator of any particular Citadel may not be willing to share some of his/her rooms. Some sites are proud to offer exclusive content in certain areas. Chances are, if a room is already being shared on the network, it's available for anyone to share; if not, it can't hurt to ask -- but take care not to demand it of them. Ask if you may share the room instead of telling them that you wish to share the room. When looking at a `K`nown rooms list, network rooms are the ones ending in parentheses instead of angle brackets. For example, `Gateway)` would be a network room, `Lobby>` would not.

The other point of etiquette to remember is that you should be making the arrangements in advance, and then set it up. It is extremely rude to simply begin networking with another Citadel, or unilaterally start sharing a new room, without first obtaining permission from its operator. Always ask first. Most Citadel operators are more than happy to network with you. Also, if later on you decide to take your system down, please take the time to notify the operators of any other Citadels you network with, so they can unconfigure their end.

### Getting ready to join the network

Ok, first things first. On a Citadel room sharing network, the first thing you need to know is your own system's node name. Presumably you set this up during installation, but if you want to change it you can do so using the `.Aide Sysconfig General` command:

    Lobby> . Aide System configuration General
    Node name [uncnsrd]:
    Fully qualified domain name [uncensored.citadel.org]:
    Human readable node name [Uncensored]:

The "node name" is important, it's how the network identifies messages coming from your system. The "human readable node name" is simply a label; it shows up in messages coming from your system. "Fully qualified domain name" is your DNS name; it's used for routing messages on the Internet. In the above example, the node name is "uncnsrd".

### Defining neighbor nodes

The next thing you need to do is configure your neighbor node(s). You need to do this for each node you network with. Let's say you wanted to talk to a Citadel system called "frobozz". Use the `.Aide Sysconfig Network` command:

    Lobby> . Aide System configuration Network
    ###    Node            Secret                   Host or IP             Port#
    --- ---------------- ---------------- -------------------------------- -----
    <A>dd <D>elete <S>ave <Q>uit  -> Add

    Enter node name    : frobozz
    Enter shared secret: frotz
    Enter host or IP   : frobozz.magick.org
    Enter port number  :  [504]: 504

    ###    Node            Secret                   Host or IP             Port#
    --- ---------------- ---------------- -------------------------------- -----
      1 frobozz          frotz            frobozz.magick.org               504
    <A>dd <D>elete <S>ave <Q>uit  -> Save

    Lobby>

As you can see in the above example, you have to enter the Citadel node name, the DNS name or IP address of the server, and the port number the Citadel service is running on. The "shared secret" is a password to allow the two Citadel nodes to connect to each other to exchange network data. The password must be identical on both ends of the connection -- when the operator of the other Citadel node sets up the connection with your system, he/she must use the same password.

### Sharing rooms

Now you're ready to share rooms. You have to do this for each room you want to share, and you have to do it from BOTH ENDS -- again, when you share a room with another Citadel, they must share it with you as well. Let's say you have a room called "Quiche Recipes>" and you want to share it with the node you set up above. First, edit the room and flag it as a network room:

    Quiche Recipes> . Aide Edit this room
    Room name [Quiche Recipes]:
    Private room  [No]: No
    Preferred users only  [No]: No
    Read-only room  [No]: No
    Directory room  [No]: No
    Permanent room  [No]: No
    Network shared room  [No]: Yes
    Automatically make all messages anonymous  [No]: No
    Ask users whether to make messages anonymous  [No]: No
    Listing order [64]:
    Room aide (or 'none') [none]:
    Message expire policy (? for list) [0]:
    Save changes (y/n)? Yes
    Ok

    Quiche Recipes)

Notice how the prompt changed? It was > before, but it's ) now. That means it's a network room. Now you can tell Citadel that you want to share the room with frobozz. Enter this command:

    Quiche Recipes) . Aide Network room sharing

Your text editor will pop up (you did configure Citadel to use your favorite text editor, right?) with a screen that looks like this:

    # Configuration for room: Quiche Recipes
    # Nodes with which we share this room
    # Specify one per line.

All you have to do is enter the name of the other Citadel node (i.e. "frobozz" in our example) on a line by itself. As usual, lines starting with a "#" are comments. Just go to the end of the file, type "frobozz" (without the quotes), save the file... and you're done!

At this point, you just sit back and enjoy. Your Citadel and the other one will begin polling each other at regular intervals (once per hour by default) and sharing messages.

### Sending mail

You can send mail to any user on any node of your Citadel network. It may take a little while for your system to learn the entire node list, though, as this is done by watching incoming messages on the network and learning which nodes are out there.

To send a private message, just enter `user @ host` as the recipient:

    Mail> Enter message
    Enter recipient: Some other user @ frobozz
     Feb 11 2003 11:36pm from I. M. Me to Some other user @ frobozz
    type message here...

    Entry command (? for options)  ->

### Changing the polling interval

As previously mentioned, Citadel will poll other Citadel nodes for messages once per hour. If this is not an acceptable interval, you can change it using the `.Aide System configuration General` command. Enter this command and look for the option:

    How often to run network jobs (in seconds) [3600]:

Change it to whatever you like. For example, 15 minutes is 900 seconds. So if you changed the default value to 900, network polling would occur every 15 minutes.

## Database maintenance

### Introduction

The data store used by Citadel is reliable and self-maintaining. It requires very little maintenance. This is primarily due to its use of the Berkeley DB record manager. It is robust, high-performance, and transactional.
A few small data files are kept in your main Citadel directory, but the databases are in the `data/` subdirectory. The files with names that begin with "cdb" are the databases themselves; the files with names that begin with "log" are the logs (sometimes referred to as "journals"). Log files will continue to appear as you use your system; each will grow to approximately 10 megabytes in size before a new one is started. There is a system configuration setting (found in .Aide System-configuration General in the text mode client, or in Administration --> Edit site-wide configuration --> Tuning in the WebCit client) which specifies "Automatically delete committed database logs." If you have this option enabled, Citadel will automatically delete any log files whose contents have been fully committed to the database files.
For more insight into how the database and log files work, you may wish to read the Berkeley DB documentation on this subject.

### Backing up your Citadel database

Please read this section carefully.
There are two backup strategies you can use, depending on your site's availability requirements and disk space availability.

##### Strategy #1: Standard backup

The standard (or "offline") backup is used when your Citadel server is configured to automatically delete committed database logs. The backup procedure is as follows:

1. Shut down the Citadel server.
2. Back up all files (database files, log files, etc.) to tape or some other backup media.
3. Start the Citadel server.

Advantage: very little disk space is consumed by the logs.
Disadvantage: Citadel is not available during backups.

##### Strategy #2: "Hot" backup

The "hot backup" procedure is used when your Citadel server is configured not to automatically delete committed database logs. The backup procedure is as follows:

1. Back up all files. Make sure the database files (cdb.*) are backed up before the log files (log.*). This will usually be the case, because the database files tend to appear first in both alphabetical and on-disk ordering of the data/ directory.
2. After verifying that your backup completed successfully, delete the committed log files with a command like this:

/usr/local/citadel/sendcommand "CULL"
Advantage: Citadel continues to run normally during backups.
Disadvantage: Much disk space is consumed by the log files, particularly if the full text indexer is turned on.
It is up to you to decide which backup strategy to use. Warning: if you configure Citadel to automatically delete committed database logs, and do not shut the Citadel service down during backups, there is no guarantee that your backups will be usable!

### Database repair

Although Citadel's data store is quite reliable, database corruption can occur in rare instances. External factors such as an operating system crash or an unexpected loss of power might leave the database in an unknown state. A utility is provided which may be able to repair your database if this occurs. If you find that your Citadel server is not running, and reading the logs shows that it is crashing because of an inability to validate a database, follow these steps:

1. Edit `/etc/inittab` and switch the Citadel service from "respawn" to "off." Type `init q` to make this setting permanent.
2. Make a backup of your data. Either write it out to tape or copy it to another directory, or a tarball.
3. `cd` to your Citadel directory and type `./database_cleanup.sh`
4. Let the cleanup script run. Do not interrupt this process for any reason.
5. Edit `/etc/inittab` and switch the Citadel service from "off" to "respawn". Type `init q` to activate your changes.

If this procedure does not work, you must restore from your most recent backup.

### Importing/Exporting your Citadel database

Citadel contains an importer/exporter module, affectionately known as the "Art Vandelay" module (a not-so-obscure Seinfeld reference). It allows you to export the entire contents of your Citadel databases to a flat file, which may then be imported on another system. (This procedure is also known as "dump and load" to database gurus.)

Why would you want to do this? Here are some scenarios:

- You are moving a Citadel installation to another computer, which uses a different CPU. Since Citadel stores data in an architecture-dependent format, the data files wouldn't work on the new computer as-is.
- Your computer crashed, lost power, etc. and you suspect that your databases have become corrupted.
- You want to switch to a different back-end data store. (For example, from GDBM to Berkeley DB)

So ... how do we work this magic? Follow these steps exactly as documented and you should be able to do it all with very little trouble.

1. This should be obvious, but it's still worth mentioning: Make sure you have a backup of everything before you start this! You're performing a major operation here. Don't risk it.
2. First, get all the users logged off from your system. Disconnect it from the network if possible. You don't want anyone logging in while you're doing this.
3. Log on as root, or some other user that has read/write access to all relevant files.
4. Go to the directory that Citadel is installed in. For example, issue a command like `cd /usr/local/citadel`
5. Export the databases with the following command:
   `./sendcommand "ARTV export" >exported.dat`
   This command may run for a while. On a very large system it could take an hour or more. Please be patient!
6. When the export completes, check to make sure that `exported.dat` exists and has some data in it. (Type "ls -l exported.dat")
7. Shut down the Citadel server. If you have a line in `/etc/inittab` that reads like this:
   `c1:2345:respawn:/usr/local/citadel/citserver -h/usr/local/citadel`
   ...then you should change the `respawn` to `off` and then type `/sbin/init q` to make the changes take effect.
8. Now it's time to delete your current binary databases. Type:
   `rm -f citadel.config citadel.control data/*`
9. If you're moving Citadel to another computer, you should move the entire directory over at this time. `exported.dat` only contains the information that was in the binary databases. Information which was stored in portable formats doesn't need to be exported/imported, so you must bring it all over in its current form.
10. Now get Citadel running on the new computer (or whatever). Run `setup` and turn the service back on (from `/etc/inittab`) but DO NOT log in.
11. As root, run the import command:
    `./sendcommand "ARTV import" <exported.dat`
    This will import your databases. Again, it may run for a long time.
12. Restart the Citadel server. You can do this any way you like. From the command line, you can do it with a command like:
    `./sendcommand "DOWN"`
13. Now you're finished. Log in and test everything. You may delete exported.dat at this time, or you might want to save it somewhere as a sort of pseudo-backup.

## Cryptography support (TLS/SSL)

### Overview

Citadel provides built-in support for encryption using Transport Layer Security (TLS) for ESMTP, IMAP, POP3, and the Citadel client protocol. A simple cryptographic configuration is installed automatically when you bring the system online. The remainder of this section describes how this configuration is built, and what you can do to make changes to it.

Encryption files are kept in the `keys/` directory. The three files used by Citadel are:

- `citadel.key` - Contains your system's RSA private key. Citadel generates a new key automatically if one is not found.
- `citadel.csr` - Contains a Certificate Signing Request (CSR) for your system. Citadel generates a new CSR automatically, using your private key, if one is not found.
- `citadel.cer` - Contains the public certificate for your system. The public key in the certificate must correspond with the private key in `citadel.key`, otherwise encryption will not function properly. Citadel will generate a self-signed certificate, again using your private key, if a certificate is not found.

### Generating and installing a Trusted Certificate

If you wish to interact with 3rd party clients that have hard coded lists of acceptable Certificate Authorities, and you do not want annoying dialog boxes popping up for the user on the first (or all) connections, then you will have to have your key signed by a valid Certificate Authority.

It is beyond the scope of this document to provide a complete tutorial on SSL certificates. Here are the general rules to follow:

- Generally, the Certificate Signing Requeste which is automatically generated by Citadel will not contain enough information for any Certificate Authority to sign it. Generate a new CSR with the following commands:
  `cd keys`
  `openssl req -new -key citadel.key -out citadel.csr`
  Answer all questions (your geographic location, organization name, etc.) and then send the new `citadel.csr` to your Certificate Authority when you order the certificate.
- When the certificate is received, simply save it as `citadel.cer` and restart the Citadel server.
- If your certificate authority delivers a 'chained' certificate (one with intermediate certificate authorities), simply append the intermediate certificate after your server's own certificate in the `citadel.cer` file.

## LDAP (Directory) Support

### Introduction

LDAP (Lightweight Directory Access Protocol) has become the open standard protocol for directory access. There are many client programs which are capable of making use of an LDAP directory service. Therefore it may be beneficial for some sites to have a directory available which is populated with Citadel user information.
Citadel does not contain its own LDAP service, because that would eliminate its ability to coexist with any existing directory you may already have in place at your organization. Instead, we provide the LDAP Connector for Citadel, which allows the Citadel service to populate an external LDAP directory. If you do not already have an LDAP directory in place, you can use the OpenLDAP server, which is probably already present in your operating system, or at least can be loaded from the installation CD's. The supplied configuration file `citadel-slapd.conf` can be used as a starting point to get your LDAP server running.

### Preparing your LDAP server for Citadel connections

It is difficult to find a commonly accepted LDAP scheme. It seems, most real life LDAP installations go for the domain oriented apporach and lay out the structure after an existing domain/subdomain structure.

The most widely accepted and standardized object for storing personal data clearly is "inetOrgPerson". Citadel therefore extends this standard schema with an object class called "citadelInetOrgPerson".

If you are using OpenLDAP as your directory server, you should choose options similar to the following:

    include         /etc/openldap/schema/core.schema
    include         /etc/openldap/schema/cosine.schema
    include         /etc/openldap/schema/inetorgperson.schema
    include         /etc/openldap/schema/rfc2739.schema
    include         /etc/openldap/schema/citadel.schema

    ...

    database        bdb
    suffix          "dc=example,dc=com"
    rootdn          "cn=manager,dc=example,dc=com"
    rootpw          secret
    directory       /var/openldap-data

Notes on this configuration:

- Obviously, you can make your suffix and rootdn whatever you wish, but in most cases you'd simply follow a DC path that looks similar to your DNS domain.
- In earlier versions of OpenLDAP, you could use the option schemacheck off to make life easier by relaxing the strict schema checking. This option has been removed from OpenLDAP, so now you must install the supplied schema extensions. `rfc2739.schema` and `citadel.schema` are included with the Citadel distribution.
- Your rootdn and rootpw can be whatever you want. Usually the rootdn is cn=manager, followed by your usual suffix. Please don't use secret as your password, as in this example. Select a new password for your site.

Your LDAP service must be up and running before you attempt to connect Citadel to it.

### Configuring the LDAP Connector for Citadel

Once you've located or installed your LDAP server, connecting Citadel to it is easily completed with the .A ide System-configuration General command:

    Lobby> . Aide System configuration General

    (lots of other stuff omitted for brevity...)

    Connect this Citadel to an LDAP directory [Yes]: Yes
    Host name of LDAP server []: 127.0.0.1
    Port number of LDAP service [389]: 389
    Base DN []: dc=servername,dc=domain,dc=org
    Bind DN []: cn=manager,dc=servername,dc=domain,dc=org
    Password for bind DN []: secret

    (more questions omitted...)

    Save this configuration? Yes

Once you've done this, restart your Citadel service with the .A ide Terminate-server Now command. When Citadel restarts, it will connect to your LDAP directory. Note that we gave Citadel the same Base DN, Bind DN, and password that was in our LDAP server configuration example. Obviously, everything needs to be identical on both sides or the connection will be refused. 127.0.0.1 is the loopback address, and 389 is the standard port number for LDAP, so this would be the proper host and port combination for an LDAP service running on your local server. It could just as easily be on another server, for example an organization-wide directory server.
You can also configure the LDAP Connector for Citadel from a WebCit session. Log on as an Aide and click on Advanced Options --> Edit Site-Wide Configuration --> Directory, and you will be presented with the same set of questions.
So, what kind of information will be entered into LDAP? As a rule, anything that gets saved to your Global Address Book room will also be saved to LDAP. Citadel will set up OU's (Organizational Units) for each node on your Citadel network, so if you are running multiple Citadel servers in an organization, you will automatically have a hierarchial view built for you. Below the OU's will be an entry for each user who has a vCard registered on the system. Citadel automatically translates vCard information to LDAP.
If you already have a Global Address Book full of existing information, you can execute an IGAB (Initialize Global Address Book) server command to rebuild it. In addition to performing its usual function of rebuilding the internal Internet e-mail address mapping table, Citadel will also repopulate LDAP with all existing vCards. You should be aware, however, that existing LDAP entries will not be cleared from your directory server. If your directory contains only Citadel data, you can safely delete your database and start over, because it will be repopulated. Otherwise, Citadel will merely update any existing records with fresh information.
The LDAP Connector for Citadel is a recent development, so expect more functionality in this space in the near future.

## Utilities

### Overview

The following utilities will be discussed:

- aidepost - Post standard input to the Aide> room
- whobbs - Who is on the system
- msgform - Format a binary message to the screen (stdin or in a file)
- userlist - Print the userlist
- sendcommand - Send a server command

It is up to you to decide which utilities should be made accessible only to system administrators. It is important that you set the file permissions correctly. All utilities should have access to the Citadel data files. We will attempt to address each program individually.

### aidepost

The nature of this program is rather simple. Standard input (stdin) is converted into a message, filed in the main message store, and posted in the Aide> room. This is useful for keeping transcripts of system activity that has to do with Citadel operations. You might even elect to send all of your system logs there, too.

`aidepost` also accepts the usage `aidepost -rTargetRoom`, where TargetRoom is the name of a room to which you'd like the message to be sent.

### whobbs

This program is similar to the `who` command. It lists all of the users who are currently connected to your Citadel server, either locally or across a network. Unless you're running a standalone system, `who` and `whobbs` will probably not have a one-to-one correspondence. Remember that you will see sessions for SMTP, POP, and IMAP users, as well as users running a Citadel client.

One thing to keep in mind is that the `whobbs` utility actually opens a connection to the server. If the server is maxed out, `whobbs` will still be able to provide a listing, because it doesn't need to log in to execute the `RWHO` command. Note that whobbs does not list its own session.

The `whobbs` utility is smart enough to know when it is being invoked by a web server as a CGI program. In this situation, it will output its listing as a nicely formatted web page instead of plain text. This makes it easy to just put a link to the whobbs binary in your cgi-bin directory, allowing a quick and easy way for web surfers to see who is online.

Running the `Who is online` command from the Citadel client does not call this utility. It has this functionality built in.

### msgform

The `msgform` utility reads its standard input (stdin) looking for Citadel messages stored in the internal format used on disk and over the network, and sends them in a human-readable format to standard output (stdout). There is no longer much use for this program, but it is included for hack value.

### userlist

This is a program to print the userlist. There are two flags that may be set when running this program. When called without any arguments, `userlist` will display all users (except those who have chosen to be unlisted), their user numbers, times called, messages posted, screen width, and date of their most recent call.

`userlist` is simply the same user listing code that is in the client, made into a standalone utility for convenience.

### sendcommand

`sendcommand` will interpret its arguments (except for `-hDIRNAME`) as a server command, which is sent to the server. Commands which require textual input will read it from stdin. Commands which generate textual output will be sent to stdout.

This utility is intended to be used to enable Citadel server commands to be executed from shell scripts.

NOTE: be sure that this utility is not world-executable. It connects to the server in privileged mode, and therefore could present a security hole if not properly restricted.