Migrated articles not directly related to ISPmail

This commit is contained in:
Christoph Haas 2024-12-22 01:29:27 +01:00
parent e27ead3926
commit 24d91bbbbf
15 changed files with 853 additions and 4 deletions

View file

@ -0,0 +1,60 @@
---
title: Monitoring and Backup
slug: ispmail-bookworm/monitoring-and-backup/
sidebar:
order: 230
---
You have come a long way. Glad you made it. So many weird things complicated the journey that evolved from the very beginning of using email roughly 35 years ago. But before you take your much deserved break from these adventures lets take care of some final tasks.
## Monitoring
For me there is nothing more awkward than having your users tell me that my systems are not working properly. As a good sysadmin I should notice outages in advance. The most frequent cause for mail server issues is a disk that is running full. Users are pretty bad with cleaning their mess up. For them the space of their mailbox is infinite. So one way is to use quotas where possible. But at least you should get notified of error conditions on your mail server.
I will not dive into monitoring deeply here. Setting up proper monitoring will easily fill a guide similar to the size of the one you are currently reading. But you should either have your own monitoring system set up or at least use an internet service to check if emails are getting through.
Things I suggest you check frequently:
- Is there enough space on disk? Especially /var/vmail?
- Are the SMTP, Submission, POP and IMAP ports responding from other servers?
- Is your mail servers IP address blacklisted? There [are](http://rbl-check.org/) [several](https://www.debouncer.com/blacklistlookup) [services](https://mxtoolbox.com/blacklists.aspx) [you](https://www.dnsbl.info/) [can](https://dnschecker.org/ip-blacklist-checker.php) use.
- Are any emails coming through? (I just do a simple count like “`grep -c relay= /var/log/mail.log`“)
- Number of emails in the mail queue? (mailq)
- Are your backups restoreable? A propos backups…
## Backup
No matter if you are running your family mail server or are in charge for an organisation nobody likes to lose email. There are many different backup tools for different purposes. Just to name my open-source favorites that ship with Debian:
- [rsnapshot](https://rsnapshot.org/). A simple solution if you want to send backups to other servers using SSH/SCP. You can also keep backups for different points in time on your local server. But if your disk crashes then all would be lost. Also rsnapshot can become slow with many emails because every file is copied as a link. But you can access the files directly without any restore procedure. Its basically a frontend for _rsync_ which is very reliable.
- [borg](https://borgbackup.readthedocs.io/en/stable/). This tools needs to be installed both on the client and the server. Setting up an archive (where backups live) on the server feels a bit weird. But you are rewarded by compression, encryption and deduplication. Also data is stored in chunks which takes less I/O than rsnapshot. It is very efficient.
- [restic](https://restic.net/). Similar to Borg in a way. It also offers deduplication, compression and encryption. Its main advantage is to be able to store backups in S3 buckets. Consider cheap storage providers like [Wasabi](https://wasabi.com/cloud-storage-pricing/) or [Backblaze](https://www.backblaze.com/). However purging old data through S3 is a very resource-intensive job. And Restic generally eats a lot of RAM and disk cache.
- [Bareos](https://www.bareos.org/). Formerly known as Bacula until its author started to have crazy ideas and these guys forked it. This is a full-fledged system to handle many servers in parallel and store things on different media for example LTO magnetic tapes in a big tape library.
- Snapshots. If your mail server is running on a virtual server then check if your ISP is offering snapshot backups. My favorite ISP charges 20% extra costs for the service but it is totally worth it. If you break your server for any reason you can just restore it to the old glory without fiddling with configuration files. It does not replace a file-based backup though. So if a user accidentally deletes an email and wants to get it back then this kind of backup will not be right.
If you cannot backup your entire disk then at least include these directories:
- /etc (configuration)
- /var/vmail (the actual emails)
- /var/log (in case the system breaks you may be able to figure out what happened last)
- /var/backups (for general backups)
- /var/lib/rspamd/dkim/ (private part of the DKIM keys)
Also make sure to exclude:
- /var/lib/mysql
Instead run…
```
mysqldump mailserver > /var/backups/mailserver.sql
```
…daily to get a proper database backup that can be restored later.
I also like to backup the output of these files because they help me figure out the specific layout of a server:
```
fdisk -l
lshw
lsb_release -a
dpkg --get-selections
```
If one of your users just accidentally deleted an email and wants it back then simply get the files from /var/vmail/domain/user/Maildir/… from the backup and put them into the original location. Dovecot will handle everything else. You dont need to restart anything.

View file

@ -0,0 +1,19 @@
---
title: Automatic installation with Ansible
slug: ispmail-bookworm/automatic-installation-with-ansible/
sidebar:
order: 240
---
If you want to set up multiple mail servers then automation is your friend. Nowadays [Ansible](https://docs.ansible.com/) is commonly used for that purpose. If you are dealing with system administration you should have such a tool in your toolbox.
I have created an [Ansible playbook on Github](https://github.com/Signum/ispmail-bookworm-ansible) that you can download and use. Using it is pretty simple:
```
apt install ansible git
git clone https://github.com/Signum/ispmail-bookworm-ansible.git
cd ispmail-bookworm-ansible/ansible
ansible-playbook ispmail.yml -c local
```
Please follow the hints in the README.md within the repository.

View file

@ -0,0 +1,8 @@
---
title: Success stories
slug: ispmail-bookworm/success-stories/
sidebar:
order: 250
---
I would appreciate if you leave a comment here telling others if your mail server is running. Perhaps even a word about the purpose of the mail server and the number of users you have. That allows others to see that their time is well-spent and indeed leads to a working mail server. Thanks for your feedback.

View file

@ -0,0 +1,44 @@
---
title: FAQ (frequently asked questions)
slug: ispmail-bookworm/faq-frequently-asked-questions/
sidebar:
order: 260
---
## Can I use this guide for my own work?
Previously I claimed a copyright on the documentation. However lets make things simpler. This Bullseye guide is using the [Creative Commons BY-NC-SA license](https://creativecommons.org/licenses/by-nc-sa/4.0/). Which means:
- BY = Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- NC = NonCommercial — You may not use the material for commercial purposes. Do what you want with your mail server. But lets keep the knowledge free.
- SA = ShareAlike — If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.
Besides that this guide has been a team effort. Many readers have contributed to it. I may spend the time to turn it into a guide but a lot of good ideas were not mine alone.
## Can I advertise in your guide?
No.
## Why dont you use Nginx/PostgreSQL?
I personally prefer that software, too. Just go for it. But for the sake of consistency lets keep Apache and MySQL as default choices in this guide so that readers upgrading from previous versions dont have to switch.
## Do you offer paid support?
Generally, yes, I am a sysadmin freelancer. If you are just stuck at some point you may want to ask in the [chat](https://riot.im/app/#/room/#ispmail:matrix.org) first though.
## How do I filter out malware?
I understand the need for it. If your users are using low-security operating systems (e.g. those that run EXE files) they are threatened by a lot of security problems. From the perspective of an email provider I would not want to take responsibility for filtering emails. That is only working on symptoms and not addressing the actual issues. Security is a fundamental concept and not something you slap on top of something inherently broken. I would not want to be blamed for a crypto trojan infection because the user relied on me saving them from bad things to happen. Client security in non-free systems is a topic on its own.
## Debian packages are too old and insecure
If you use a Debian stable release you have chosen to stay on a specific software version. “Stable” means “a version that will not change”. Thats the best choice for a server. Those software packages are by no means less secure though because they also get security updates. Debian also has up-to-date packages but you surely dont want to use them for a mail server unless you feel adventurous or have an intense hatred for your users. For a detailed discussion see [this separate article](https://workaround.org/debian-packages-are-so-old/).
## Can I download the guide as one file?
I havent yet found a way to accomplish that. WordPress is not especially good when it comes to structured multi-page documentation. If anyone has a hint Id be grateful.
## Why dont you put the guide on Github as Markdown?
This website runs on WordPress because I wanted something easy to edit and also have discussions on each page. I might be a hardcore terminal user but just sometimes I prefer to have a WYSIWYG editor. I tried several ways to work with multi-file Markdown builders but the workflow was uncomfortable and lead to ugly documentation. Besides we wouldnt have discussions on the pages and Im surely not including Quora for discussions.