more more content
This commit is contained in:
parent
1c028a051d
commit
30341a60a4
2 changed files with 257 additions and 0 deletions
80
src/content/docs/ispmail-bookworm/110-catchall-aliases.mdx
Normal file
80
src/content/docs/ispmail-bookworm/110-catchall-aliases.mdx
Normal file
|
|
@ -0,0 +1,80 @@
|
||||||
|
---
|
||||||
|
title: Catch-all aliases
|
||||||
|
lastUpdated: 2023-10-04
|
||||||
|
slug: ispmail-bookworm/catchall-aliases
|
||||||
|
sidebar:
|
||||||
|
order: 110
|
||||||
|
---
|
||||||
|
|
||||||
|
import { Aside } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
|
<Aside type="tip" title="Optional feature">
|
||||||
|
This page is entirely optional and will not affect your mail server if you skip it.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
|
As explained earlier in the tutorial there is way to forward all email addresses in a domain to a certain destination email address. This is called a _catch-all_ alias. Those aliases catch all emails for a domain if there is no specific virtual user for that email address. Catchalls are considered a bad idea. It is tempting to generally forward all email addresses to one person if e.g. your marketing department requests a new email alias every week. But the drawback is that you will get more spam because spammers will send their stuff to any address of your domain. Or perhaps a sender mixed up the proper spelling of a recipient but the mail server will forward the email instead of rejecting it for a good reason. So think twice before using catchalls.
|
||||||
|
|
||||||
|
You still want to use catch-all addresses? Well, okay. Let’s do it then. A catchall alias looks like “@example.org” and forwards email for the whole domain to other addresses. We have created the `john@example.org` user and would like to forward all other email on the domain to `kerstin@example.com`. So we would add a catchall alias like:
|
||||||
|
|
||||||
|
| source | destination |
|
||||||
|
| -------------- | --------------------- |
|
||||||
|
| `@example.org` | `kerstin@example.com` |
|
||||||
|
|
||||||
|
But there is a small catch. Postfix always checks the _virtual_alias_maps_ mapping before looking up a user in the _virtual_mailbox_maps_. Imagine what happens when Postfix receives an email for ‘john@example.org’. Postfix checks the aliases in the _virtual_alias_maps_ table. It finds the catchall entry as above and since there is no more specific alias the catchall account matches and the email is redirected to ‘kerstin@example.com’.
|
||||||
|
|
||||||
|
In other words: the aliases are always processed first. So a catch-all alias will steal the email. John will never get any email. This is not what you want.
|
||||||
|
|
||||||
|
But imagine that the aliases would contain a second entry like this:
|
||||||
|
|
||||||
|
| email | destination |
|
||||||
|
| ---------------------- | ---------------------- |
|
||||||
|
| `@example.org` | `kerstin@example.com` |
|
||||||
|
| **`john@example.org`** | **`john@example.org`** |
|
||||||
|
|
||||||
|
So any email address on the example.org domain will be forwarded to kerstin's address. But what is that second line? Why should we forward john's emails to himself? That doesn't make any sense.
|
||||||
|
|
||||||
|
Actually it does. Postfix will consider more specific aliases first. And `john@example.org` is more specific than `@example.org`.
|
||||||
|
Consider that someone is trying to reach `john@example.org`'s mailbox.
|
||||||
|
If Postfix read this table just from top to bottom, then it would see `@example.org` first, which would be a match. It would then redirect that email to kerstin. John would never again get an email.
|
||||||
|
|
||||||
|
So to make a mixture of catch-all addresses and specific addresses work, we need this little trickery.
|
||||||
|
|
||||||
|
Postfix will lookup all these mappings for each of:
|
||||||
|
|
||||||
|
- john@example.org (most specific)
|
||||||
|
- @example.org (catchall – least specific)
|
||||||
|
|
||||||
|
This is outlined in the [virtual(5) man page](http://www.postfix.org/virtual.5.html) in the _TABLE SEARCH ORDER_ section.
|
||||||
|
|
||||||
|
We do not want to add that “more specific” entry for each email address manually. Fortunately we can easily automate that. For that “john-to-himself” mapping you need to create another “.cf” file `/etc/postfix/mysql-email2email.cf` for the latter mapping:
|
||||||
|
|
||||||
|
<pre>
|
||||||
|
user = mailserver
|
||||||
|
password = **x893dNj4stkHy1MKQq0USWBaX4ZZdq**
|
||||||
|
hosts = 127.0.0.1
|
||||||
|
dbname = mailserver
|
||||||
|
query = SELECT email FROM virtual_users WHERE email='%s'
|
||||||
|
</pre>
|
||||||
|
|
||||||
|
Check that you get John’s email address back when you ask Postfix if there are any aliases for him:
|
||||||
|
```
|
||||||
|
postmap -q john@example.org mysql:/etc/postfix/mysql-email2email.cf
|
||||||
|
```
|
||||||
|
The result should be the same address:
|
||||||
|
```
|
||||||
|
john@example.org
|
||||||
|
```
|
||||||
|
|
||||||
|
Now you need to tell Postfix that it should check both the aliases and the “john-to-himself”:
|
||||||
|
|
||||||
|
<pre class="wrap">
|
||||||
|
postconf virtual_alias_maps=mysql:/etc/postfix/mysql-virtual-alias-maps.cf,mysql:/etc/postfix/mysql-email2email.cf
|
||||||
|
</pre>
|
||||||
|
|
||||||
|
The order of the two mappings is not important here. Postfix will check all ‘cf’ files anyway and merges what it finds.
|
||||||
|
|
||||||
|
You did it! All mappings are set up and the database is generally ready to be filled with domains and users. Make sure that only ‘root’ and the ‘postfix’ user can read the “.cf” files – after all your database password is stored there:
|
||||||
|
```
|
||||||
|
chgrp postfix /etc/postfix/mysql-*.cf
|
||||||
|
chmod u=rw,g=r,o= /etc/postfix/mysql-*.cf
|
||||||
|
```
|
||||||
177
src/content/docs/ispmail-bookworm/120-setting-up-dovecot.mdx
Normal file
177
src/content/docs/ispmail-bookworm/120-setting-up-dovecot.mdx
Normal file
|
|
@ -0,0 +1,177 @@
|
||||||
|
---
|
||||||
|
title: Setting up Dovecot
|
||||||
|
lastUpdated: 2023-10-04
|
||||||
|
slug: ispmail-bookworm/setting-up-dovecot/
|
||||||
|
sidebar:
|
||||||
|
order: 120
|
||||||
|
---
|
||||||
|
|
||||||
|
import { Aside } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
|
This chapter of our journey leads us to Dovecot – the software that…
|
||||||
|
|
||||||
|
- gets emails destined to your users from Postfix and saves them to disk
|
||||||
|
- executes user-based _sieve_ filter rules (can be used to e.g. move emails to different folders based on certain criteria or to send automated vacation responses)
|
||||||
|
- allows the user to fetch emails using POP3 or IMAP
|
||||||
|
|
||||||
|
Before we get to the actual configuration for security reasons I recommend that you create a new system user that will own all virtual mailboxes. The following shell commands will create a system group “vmail” with GID (group ID) 5000 and a system user “vmail” with UID (user ID) 5000. (Make sure that UID and GID are not yet used or choose another – the number can be anything between 1000 and 65000 that is not yet used):
|
||||||
|
```
|
||||||
|
groupadd -g 5000 vmail
|
||||||
|
useradd -g vmail -u 5000 vmail -d /var/vmail -m
|
||||||
|
```
|
||||||
|
If the /var/vmail directory was already there because you assigned it a dedicated mount point then you should make sure that the permissions are set correctly:
|
||||||
|
```
|
||||||
|
chown -R vmail:vmail /var/vmail
|
||||||
|
```
|
||||||
|
The configuration files for Dovecot are found in `/etc/dovecot/conf.d`/. All these files are loaded by Dovecot. This is done by this magical line at the end of the `/etc/dovecot/dovecot.conf` file:
|
||||||
|
```
|
||||||
|
!include conf.d/*.conf
|
||||||
|
```
|
||||||
|
It loads all files in `/etc/dovecot/conf.d/` that end in “.conf” in alphanumerical order. So “10-auth.conf” is loaded first and “90-sieve-extprograms.conf” is loaded last. The big advantage is that you can edit or replace parts of the configuration without having to overwrite the entire configuration. The main `/etc/dovecot/dovecot.conf` file does not require any changes. Those other files in conf.d/ however do.
|
||||||
|
|
||||||
|
## conf.d/
|
||||||
|
|
||||||
|
### 10-auth.conf
|
||||||
|
|
||||||
|
The most common [authentication mechanism](https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/#authentication-authentication-mechanisms) is called _PLAIN_. However if you have Outl\*\*k users then you may need to add the _LOGIN_ mechanism, too.:
|
||||||
|
```
|
||||||
|
auth_mechanisms = plain login
|
||||||
|
```
|
||||||
|
These two mechanisms would ask for a password without enforcing encryption to secure the password. But don’t worry. By default Dovecot sets `disable_plaintext_auth = yes` which ensures that authentication is only accepted over TLS-encrypted connections.
|
||||||
|
|
||||||
|
At the end of this file you will find various authentication backends that Dovecot ships with. By default it will use system users (those from the /etc/passwd). But we want to use the MariaDB database backend so go ahead and change this block to:
|
||||||
|
|
||||||
|
```
|
||||||
|
#!include auth-system.conf.ext
|
||||||
|
!include auth-sql.conf.ext
|
||||||
|
#!include auth-ldap.conf.ext
|
||||||
|
#!include auth-passwdfile.conf.ext
|
||||||
|
#!include auth-checkpassword.conf.ext
|
||||||
|
#!include auth-static.conf.ext
|
||||||
|
```
|
||||||
|
|
||||||
|
### 10-mail.conf
|
||||||
|
|
||||||
|
Change the mail_location setting to:
|
||||||
|
```
|
||||||
|
mail_location = maildir:~/Maildir
|
||||||
|
```
|
||||||
|
This is the directory where Dovecot will look for the emails of a specific user. The tilde character (~) means the user’s _home directory_. That does not make sense yet. But further down on this page we will tell Dovecot what the _home directory_ is supposed to mean. For example `john@example.org` will have his home directory in /var/vmail/example.org/john.
|
||||||
|
|
||||||
|
Further down in the 10-mail.conf file you will find sections defining the [namespaces](https://doc.dovecot.org/configuration_manual/namespace/). Those are folder structures that your email program sees when connecting to the mail server. If you use POP3 you can only access the “inbox” – which is where all incoming email is stored. Using the IMAP protocol you get access to a hierarchy of folders and subfolders. And you can even share folders between users. Or use a public folder that can be accessed by anyone – even anonymously. So IMAP is generally to be preferred.
|
||||||
|
|
||||||
|
Also edit the “mail_plugins” line to enable the _quota_ plugin we will configure later and turn it into:
|
||||||
|
```
|
||||||
|
mail_plugins = quota
|
||||||
|
```
|
||||||
|
|
||||||
|
<Aside type="danger" title="Check your separator setting!">
|
||||||
|
Migrating from a previous server? Previous versions of this guide told you to set the “separator” to either “.” or “/”. The default leads to a folder structure like:
|
||||||
|
"/var/vmail/example.org/john/Maildir/.INBOX.staff.marketing.simon".
|
||||||
|
|
||||||
|
If you see folders like this…
|
||||||
|
"/var/vmail/example.org/john/Maildir/INBOX/staff/marketing/simon"
|
||||||
|
…then please read Dovecot’s notes on the directory structure and the hierarchy separator. Hint: LAYOUT=fs.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
|
### 10-master.conf
|
||||||
|
|
||||||
|
This configuration file deals with typical service ports like IMAP or POP3.
|
||||||
|
|
||||||
|
<Aside type="tip" title="Plaintext services? Really?">
|
||||||
|
Don’t worry about the standard unencrypted TCP ports 110 (for POP3) and 143 (for IMAP). They can be kept accessible. If a user connects to these ports they will have to issue a _STARTTLS_ command to switch into encrypted mode before they are allowed to send their password. There is basically no difference between using an plaintext port like 110 for POP3 and then using _STARTTLS_ – or connecting to the encrypted 995 port for POP3S (=secure). See the [Dovecot documentation](https://doc.dovecot.org/admin_manual/ssl/) for another explanation.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
|
So most settings are sane here and do not have to be changed. However one change is required in the “service auth” section because we want Postfix to allow Dovecot as an authentication service. Make it look like this:
|
||||||
|
|
||||||
|
```
|
||||||
|
# Postfix smtp-auth
|
||||||
|
unix_listener /var/spool/postfix/private/auth {
|
||||||
|
mode = 0660
|
||||||
|
user = postfix
|
||||||
|
group = postfix
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Well, Postfix runs in a chroot environment located at /var/spool/postfix. It can't access anything outside of that directory. So to allow communication with Postfix we tell Dovecot to place a communication socket into that chroot.
|
||||||
|
|
||||||
|
### 10-ssl.conf
|
||||||
|
|
||||||
|
Earlier in this guide you created both a key and a certificate file to encrypt the communication with POP3, IMAPs and HTTPS between the users and your mail server. You need to tell Dovecot where to find these files:
|
||||||
|
|
||||||
|
<pre>
|
||||||
|
ssl\_cert = \</etc/letsencrypt/live/**webmail.example.org**/fullchain.pem
|
||||||
|
ssl\_key = \</etc/letsencrypt/live/**webmail.example.org**/privkey.pem
|
||||||
|
</pre>
|
||||||
|
|
||||||
|
And enforce TLS encryption by setting:
|
||||||
|
```
|
||||||
|
ssl = required
|
||||||
|
```
|
||||||
|
See the [Dovecot documentation on SSL encryption](https://doc.dovecot.org/admin_manual/ssl/) for more information.
|
||||||
|
|
||||||
|
Next let’s take a look at how Dovecot knows about users and their passwords:
|
||||||
|
|
||||||
|
### auth-sql.conf.ext
|
||||||
|
|
||||||
|
Dovecot reads the `auth-sql.conf.ext` which defines how to find user information in your database. Open the file. There are two sections:
|
||||||
|
|
||||||
|
- userdb: where to find a user’s mailbox in the file system
|
||||||
|
- passdb: where to find the user’s hashed password
|
||||||
|
|
||||||
|
By default Dovecot will run two queries at your database. One for the _userdb_ that gets information like the user ID, group ID, home directory and quota. And another for the _passdb_ that gets the hashed password.
|
||||||
|
|
||||||
|
The “userdb” section already reads:
|
||||||
|
```
|
||||||
|
userdb {
|
||||||
|
driver = sql
|
||||||
|
args = /etc/dovecot/dovecot-sql.conf.ext
|
||||||
|
}
|
||||||
|
```
|
||||||
|
As you can see Dovecot uses an SQL database lookup to get that information. And it refers to the dovecot-sql.conf.ext file for more information. Let’s see…
|
||||||
|
|
||||||
|
## /etc/dovecot/dovecot-sql.conf.ext
|
||||||
|
|
||||||
|
(This configuration file is one level up and not in “conf.d”.)
|
||||||
|
|
||||||
|
You will find this file well documented although all configuration directives are commented out. Add these lines at the bottom of the file:
|
||||||
|
|
||||||
|
<pre>
|
||||||
|
driver = mysql
|
||||||
|
|
||||||
|
connect = \\
|
||||||
|
host=127.0.0.1 \\
|
||||||
|
dbname=mailserver \\
|
||||||
|
user=mailserver \\
|
||||||
|
password=**x893dNj4stkHy1MKQq0USWBaX4ZZdq**
|
||||||
|
|
||||||
|
user_query = SELECT email as user, \\
|
||||||
|
concat('*:bytes=', quota) AS quota_rule, \\
|
||||||
|
'/var/vmail/%d/%n' AS home, \\
|
||||||
|
5000 AS uid, 5000 AS gid \\
|
||||||
|
FROM virtual_users WHERE email='%u'
|
||||||
|
|
||||||
|
password_query = SELECT password FROM virtual_users WHERE email='%u'
|
||||||
|
|
||||||
|
iterate_query = SELECT email AS user FROM virtual_users
|
||||||
|
</pre>
|
||||||
|
|
||||||
|
```
|
||||||
|
driver = mysql
|
||||||
|
|
||||||
|
connect = \\
|
||||||
|
host=127.0.0.1 \\
|
||||||
|
dbname=mailserver \\
|
||||||
|
user=mailserver \\
|
||||||
|
password=**x893dNj4stkHy1MKQq0USWBaX4ZZdq**
|
||||||
|
|
||||||
|
user_query = SELECT email as user, \\
|
||||||
|
concat('*:bytes=', quota) AS quota_rule, \\
|
||||||
|
'/var/vmail/%d/%n' AS home, \\
|
||||||
|
5000 AS uid, 5000 AS gid \\
|
||||||
|
FROM virtual_users WHERE email='%u'
|
||||||
|
|
||||||
|
password_query = SELECT password FROM virtual_users WHERE email='%u'
|
||||||
|
|
||||||
|
iterate_query = SELECT email AS user FROM virtual_users
|
||||||
|
```
|
||||||
Loading…
Add table
Add a link
Reference in a new issue