various typos fixed

This commit is contained in:
Christoph Haas 2025-10-31 11:07:32 +01:00
parent 1b0a9b6ba1
commit 46f4775ee2
10 changed files with 107 additions and 104 deletions

View file

@ -6,12 +6,13 @@ sidebar:
order: 100 order: 100
--- ---
This is the 12th edition of the ISPmail guide. A free guide to setting up a mail server for friends and family using Good to have you here. This is the 12th edition of the ISPmail guide. A free guide to setting up a mail server for
open-source software. Email on the internet nowadays is in the hands of few huge companies. Take back control and host friends and family using open-source software. Email on the internet nowadays is in the hands of few huge companies.
your own mail server. Get a cheap virtual server and read along. This guide is comprehensive and will walk you through Take back control and host your own mail server. Get a cheap virtual server and read along. This guide is comprehensive
everything you need to know. I am publishing this guide without any commercial motives. All you need to invest is your and will walk you through everything you need to know. I am publishing this guide without any commercial motives. All
time. And thanks to Debian you will get automatic security updates and do not have to worry about anything until the you need to invest is your time. And thanks to Debian you will get automatic security updates and do not have to worry
next stable release comes out in 2-3 years. about anything until the next stable release comes out in 2-3 years. And perhaps you come back then to upgrade your
server.
## What your mail server will do ## What your mail server will do
@ -20,10 +21,9 @@ next stable release comes out in 2-3 years.
- **Send** emails out to the internet. Connections will be encrypted when possible. - **Send** emails out to the internet. Connections will be encrypted when possible.
- **Store** as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user. The only - **Store** as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user. The only
limit is the size of your disk. limit is the size of your disk.
- Provide a **webmail** interface so users can access their emails securely from any location using a web browser. - Have a **webmail** interface so users can access their emails securely from any location using a web browser.
- Let your users fetch email using **IMAP** or **POP3** and send email through your servers using **SMTP**. - Let your users fetch email using **IMAP** and send email through your servers using **SMTP**.
- Add automatic cryptographic signatures (**[DKIM / Domain Keys](https://en.wikipedia.org/wiki/DomainKeys)**) to - Add automatic cryptographic signatures using DKIM to outgoing emails to prove that you are the owner of your domain.
outgoing emails to prove that you are the owner of your domain.
- Allow users to manage server-based **filter rules**. Distribute incoming emails to different folders. Forward copies. - Allow users to manage server-based **filter rules**. Distribute incoming emails to different folders. Forward copies.
Or send out-of-office notifications. Or send out-of-office notifications.
- Mitigate **brute force** attacks. - Mitigate **brute force** attacks.
@ -33,21 +33,21 @@ next stable release comes out in 2-3 years.
- **Linux experience**. Preferably a Debian-derivative. No godlike skills required. But know your basics: navigating the - **Linux experience**. Preferably a Debian-derivative. No godlike skills required. But know your basics: navigating the
file system, editing files, watching log files. Have some basic understanding of DNS. Bonus points if you have played file system, editing files, watching log files. Have some basic understanding of DNS. Bonus points if you have played
with an SQL database and know about SELECT, INSERT, rows, columns. with an SQL database and know about SELECT, INSERT, rows, columns.
- **Time**. 2 hours to get the basic service running. Maybe a day if you want all the optional bells and whistles. - **Time**. 2 hours to get the basic service running. Maybe a day if you are not an everyday Debian user.
- A **server** that runs Debian Trixie. 1 GB of RAM and a 20 GB disk/SSD is fine for your friends and family. Rent a - A **server** that runs [Debian Trixie](https://www.debian.org/releases/trixie/). 1 GB of RAM and a 20 GB disk/SSD is
cheap virtual server. Or use a decommissioned laptop. Other distributions than Debian come with other versions of the fine for your friends and family. Just rent a cheap virtual server. Other distributions than Debian come with other
software and have different configurations and paths on disk. It will work but you will need to deviate from this versions of the software and have different configurations and paths on disk. It will work but you will need to
guide. So for the easiest way choose Debian Trixie. deviate from this guide and do some research. So for the smoothest ride go with Debian.
- The hosting provider you chose to run your server on needs to allow **SMTP send and receive**. These providers are - The hosting provider you chose to run your server on needs to allow **SMTP send and receive**. These providers are
known to be troublesome: known to be troublesome:
- Hetzner (DE, FI, US): Will allow SMTP after a month of paying for their service and per a request issued at - Hetzner (DE, FI, US): Will allow SMTP after a month of paying for their service and per a request issued at
https://console.hetzner.cloud/limits https://console.hetzner.cloud/limits
- DigitalOcean (US): Blocks SMTP and tells you that running your own mail server is a bad idea. Avoid. - DigitalOcean (US): Blocks SMTP and tells you that running your own mail server is a bad idea. Avoid.
- Your server needs to have a public **IP address** that does not belong to a range of typical ISP customers. You - Your server needs to have a public **IP address** that does not belong to a range of typical ISP customers. You
usually cant operate the mail server from a dialup IP address at home because those IP ranges are blacklisted by most usually cant operate the mail server from a residential IP address at home because those IP ranges are blacklisted by
other mail servers. Make sure that your IP address is not [blacklisted](https://multirbl.valli.org/) before you start. most other mail servers. Make sure that your IP address is not [blacklisted](https://multirbl.valli.org/) before you
If you rent a virtual server from your favorite hosting company you probably wont have any problems. But if you want start. If you rent a virtual server from your favorite hosting company you probably wont have any problems. But if
to run the service from your home, this is something you need to check. you want to run the service from your home, this is something you need to check.
- An **internet domain** (or several) to receive emails for. You need to be able to set A, MX and TXT records for that - An **internet domain** (or several) to receive emails for. You need to be able to set A, MX and TXT records for that
domain. You should also be able to set PTR records for your IP address because some mail servers on the internet domain. You should also be able to set PTR records for your IP address because some mail servers on the internet
require you to have matching forward and reverse DNS records. require you to have matching forward and reverse DNS records.
@ -65,6 +65,17 @@ some detail in a complex setup goes wrong and they have no idea how to fix it. E
years. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time years. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time
either taking the supposedly easy route. either taking the supposedly easy route.
## What's new
The last updates to this guide up to Debian Bookworm were mainly minor changes. However this time I have spent many
weeks to improve the guide. Most sections are completely rewritten. Explanations about SMTP versus submission were
added. I dived deep into RFCs and reference documentation. I have used more features of the
[Astro/Starlight](https://starlight.astro.build/) framework (the software that is used to render this guide) to add
visual guides like task lists or image galleries or foldout sections to help you understand what's going on on a mail
server without getting lost. And I have replaced all my configuration examples with blocks that you can copy/paste into
your shell. So this guide is supposed to be shorter and faster to follow while at the same time trying to be more
comprehensive. Please leave your feedback in the comment sections whether this approach appeals to you.
## Ready? ## Ready?
The entire tutorial is split into several pages. You can find the different chapters on the left. The navigation within The entire tutorial is split into several pages. You can find the different chapters on the left. The navigation within

View file

@ -15,13 +15,14 @@ import { Aside } from "@astrojs/starlight/components";
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie. Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.
# Architectural changes ## Architectural changes
In the past I tried to keep things similar to previous versions of this guide. Most of us are happy with their mail I always try to keep things similar to previous versions of this guide. Most of us are happy with their mail servers and
servers and want to change as little as possible when a new Debian release comes along. Just a few improvements: want to change as little as possible when a new Debian release comes along. Just a few changes that come with the newer
software versions:
- **rsyslogd** was a classic choice to write log files like /var/log/mail.log. As Debian is using _systemd_ we no longer - **rsyslogd** was a classic choice to write log files like /var/log/mail.log. As Debian is using _systemd_ we no longer
need rsyslogd and logrotate. The logs can be read using _journalctl_ instead. If you miss it, just need rsyslogd and logrotate. The logs can be read using _journalctl_ instead. If you miss log files, just
`apt install rsyslog`. `apt install rsyslog`.
- **smtpd_tls_security_level** is now only enabled for the `submission` service. That disables authentication for SMTP - **smtpd_tls_security_level** is now only enabled for the `submission` service. That disables authentication for SMTP
connections on port 25. This emphasizes the separation of TCP 25 for server-to-server connections (without connections on port 25. This emphasizes the separation of TCP 25 for server-to-server connections (without
@ -29,7 +30,7 @@ servers and want to change as little as possible when a new Debian release comes
- **certbot** is now using the `python3-certbot-apache` package. Getting and renewing certificates is now handled - **certbot** is now using the `python3-certbot-apache` package. Getting and renewing certificates is now handled
magically by Apache without any downtime or additional configuration. magically by Apache without any downtime or additional configuration.
# Version changes ## Version changes
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
have to change: have to change:
@ -40,10 +41,10 @@ have to change:
- rspamd 3.4.1 -> 3.12.1. No breaking changes. - rspamd 3.4.1 -> 3.12.1. No breaking changes.
- Roundcube 1.6.1 -> 1.6.11. No breaking changes. - Roundcube 1.6.1 -> 1.6.11. No breaking changes.
# Fresh installation ## Fresh installation
Please do not try to upgrade your previous server using `apt-get dist-upgrade`. It is very hard to do the upgrade Do not try to upgrade your existing server using `apt-get dist-upgrade`. There are too many changes especially with
without losing mails. Set up a new server instead. Once you are ready, come back here. Dovecot. Start with a fresh installation on another server and then migrate.
## Preparing the DNS/IP switch ## Preparing the DNS/IP switch
@ -106,8 +107,9 @@ Details are found in the rspamd chapter.
## Migrate the Maildirs hot ## Migrate the Maildirs hot
Fortunately Dovecot uses the maildir format that stores emails as plain files on disk. Login to the new (Bookworm) (**Hot** means: copy the files why they are still in use and potentially change while you do that.) Fortunately Dovecot
server and use *rsync* to copy over the mails from the old (Bullseye) mail server: uses the maildir format that stores emails as plain files on disk. Login to the new (Trixie) server and use *rsync* to
copy over the mails from the old (Bullseye) mail server:
``` ```
rsync -va oldserver:/var/vmail/ /var/vmail/ rsync -va oldserver:/var/vmail/ /var/vmail/
@ -119,9 +121,11 @@ There is no need to shut down Dovecot on your production Bullseye server. Copyin
will not break anything. This is called a “hot copy". It may not be consistent but it will save time during the final will not break anything. This is called a “hot copy". It may not be consistent but it will save time during the final
synchronization. synchronization.
## Copy certificates Another way to copy over the emails is using Dovecot's
[doveadm-sync](https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) command. It may be especially handy if you
need to copy emails from another server where you only have IMAP access but cannot access the files directly.
(TODO: ignore with Caddy) ## Copy certificates
Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server. Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server.
@ -136,8 +140,9 @@ You told your users about the downtime, right? The time has come? Okay. Shut dow
## Migrate the emails cold ## Migrate the emails cold
Lets synchronize again. *rsync* will only copy those files that have changed which makes it much faster than the first (**Cold** means: the processes have stopped or you made sure that there is no user activity so that the files can be
sync. On your new server run: copied consistently.) Lets synchronize again. *rsync* will only copy those files that have changed which makes it much
faster than the first sync. On your new server run:
``` ```
rsync -va --delete oldserver:/var/vmail/ /var/vmail/ rsync -va --delete oldserver:/var/vmail/ /var/vmail/
@ -146,7 +151,7 @@ rsync -va --delete oldserver:/var/vmail/ /var/vmail/
(The “`--delete`" option makes sure that files that have been removed from the old server will also be deleted from the (The “`--delete`" option makes sure that files that have been removed from the old server will also be deleted from the
new server. So if a user has deleted an email it will be deleted on the new server as well.) new server. So if a user has deleted an email it will be deleted on the new server as well.)
# Switch the DNS records ## Switch the DNS records
For all your domains you will have to change the DNS “MX" or “A" record to point to your new server. For all your domains you will have to change the DNS “MX" or “A" record to point to your new server.

View file

@ -14,14 +14,14 @@ import { FileTree } from "@astrojs/starlight/components";
Debian Trixie server, just skip this page. Debian Trixie server, just skip this page.
</Aside> </Aside>
You have a blank computer or virtual machine? Then simply install Debian Bookworm yourself. Get a boot medium from the You have a blank computer or virtual machine? Then simply install Debian Trixie yourself. Get a boot medium from the
[Debian website](https://www.debian.org/distrib/netinst). The smaller _network installer_ is sufficient it will [Debian website](https://www.debian.org/distrib/netinst). The smaller _network installer_ is sufficient it will
download all required packages directly from the internet. Make sure you choose English as the installation language download all required packages directly from the internet. Make sure you choose English as the installation language
even if it is not your native language. If you have trouble with the server you will more likely find help when even if it is not your native language. If you have trouble with the server you will more likely find help when
searching for English error messages on the internet. searching for English error messages on the internet.
Most of the installation is pretty straightforward. You dont need me holding your hand. I strongly recommend that you Most of the installation is pretty straightforward. You dont need me holding your hand. However I strongly recommend
use the _logical volume manager_ (LVM) for your partitions to stay flexible if your server grows. See my that you use the _logical volume manager_ (LVM) for your partitions to stay flexible if your server grows. See my
[article on LVM](https://workaround.org/understanding-lvm/) if you want some help understanding its concept. [article on LVM](https://workaround.org/understanding-lvm/) if you want some help understanding its concept.
## Partitioning ## Partitioning

View file

@ -18,7 +18,7 @@ DEBIAN_FRONTEND=noninteractive \
apache2 python3-certbot-apache libapache2-mod-php \ apache2 python3-certbot-apache libapache2-mod-php \
php-intl php-mbstring php-xml unzip certbot \ php-intl php-mbstring php-xml unzip certbot \
roundcube-mysql roundcube roundcube-plugins swaks libnet-ssleay-perl \ roundcube-mysql roundcube roundcube-plugins swaks libnet-ssleay-perl \
ufw mutt unattended-upgrades mariadb-server \ mutt unattended-upgrades mariadb-server \
rspamd redis-server opendkim-tools bind9-dnsutils pwgen rspamd redis-server opendkim-tools bind9-dnsutils pwgen
``` ```
@ -28,7 +28,7 @@ While the server is downloading and installing the packages, let me give you a q
Postfix is the MTA (mail transport agent) that speaks SMTP to send and receive emails. This package installs Postfix Postfix is the MTA (mail transport agent) that speaks SMTP to send and receive emails. This package installs Postfix
with support for MariaDB databases. with support for MariaDB databases.
- **dovecot** \ - **dovecot** \
Dovecot manages the emsrc/content/docs/ispmail-trixie/140-install-packages.mdx emails using IMAP. Dovecot manages the emails on disk and lets users access them via IMAP.
- **-lmtpd** \ - **-lmtpd** \
LMTP (Local Mail Transfer Protocol) provides the glue between Postfix and Dovecot. LMTP (Local Mail Transfer Protocol) provides the glue between Postfix and Dovecot.
- **-managesieved** \ - **-managesieved** \
@ -50,8 +50,6 @@ While the server is downloading and installing the packages, let me give you a q
package is needed to test encrypted connections. package is needed to test encrypted connections.
- **certbot** \ - **certbot** \
Gets a free TLS certificate from [_Let's Encrypt_](https://letsencrypt.org/) for encrypting network communication. Gets a free TLS certificate from [_Let's Encrypt_](https://letsencrypt.org/) for encrypting network communication.
- **ufw** \
Universal FireWall. A simple tool to manage firewall rules to limit access to your server. TODO: omit?
- **mutt** \ - **mutt** \
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the
functionality of your mail server. Think of it as a text-based Thunderbird. functionality of your mail server. Think of it as a text-based Thunderbird.

View file

@ -10,7 +10,7 @@ Your mail server will have one fully qualified domain name — for example, `pos
domain is `example.com`. If someone visits `https://example.com/`, they might be greeted by the Roundcube webmail login domain is `example.com`. If someone visits `https://example.com/`, they might be greeted by the Roundcube webmail login
page. page.
But your server doesnt have to handle only one domain. You might have mailboxes like: But your server doesnt have to handle only one domain. You can have mailboxes on multiple domains like:
- `jack@example.com` - `jack@example.com`
- `lucy@example.com` - `lucy@example.com`

View file

@ -11,9 +11,7 @@ import { Tabs, TabItem } from "@astrojs/starlight/components";
Now its time to prepare the MariaDB database that stores the information that controls your mail server. In the process Now its time to prepare the MariaDB database that stores the information that controls your mail server. In the process
you will have to enter [SQL](http://en.wikipedia.org/wiki/SQL) queries the language of relational database servers. you will have to enter [SQL](http://en.wikipedia.org/wiki/SQL) queries the language of relational database servers.
You may enter them in a terminal window using the mariadb command. But if you are less experienced with SQL you may You may enter them in a terminal window using the mariadb command.
prefer using a web interface. Thats what you installed _[Adminer](https://www.adminer.org/)_ for. TODO: link to Adminer
setup in a later section
<Aside title="MariaDB versus MySQL"> <Aside title="MariaDB versus MySQL">
@ -58,8 +56,8 @@ In this section you will create the basic database `mailserver` and two users:
<Aside type="note" title="About passwords"> <Aside type="note" title="About passwords">
For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
are—it will make copying and pasting the upcoming steps much easier. After youve confirmed everything is working are—it will make copying and pasting the upcoming steps much easier. At the end of the tutorial I will help you change
correctly, Ill show you how to update the passwords securely with a single command. the passwords securely with a single command.
</Aside> </Aside>
@ -147,21 +145,22 @@ represents a domain.
### virtual_users ### virtual_users
The second table contains information about your users. Each mail account requires one row in this table. The second table contains information about your users or rather: your mailboxes. Each mail account requires one row
in this table.
- **id**: A unique number identifying each row. It is set automatically. - **id**: A unique number identifying each row. It is set automatically.
- **domain_id**: A [reference](https://en.wikipedia.org/wiki/Foreign_key) to the domain in the `virtual_domains` table. - **domain_id**: A [reference](https://en.wikipedia.org/wiki/Foreign_key) to the domain in the `virtual_domains` table.
So each domain can have many mailboxes. So each domain can have many mailboxes.
- **email**: The email address of the mailbox. - **email**: The email address of the mailbox.
- **password**: The hashed password of the mail account. It is prepended by the - **password**: The hashed password of the mail account. It is prepended by the
[password scheme](https://doc.dovecot.org/main/core/config/auth/schemes.html). By default it is `{BLF-CRYPT}` also [password scheme](https://doc.dovecot.org/2.4.2/core/config/auth/schemes.html#password-schemes). By default it is
known as _bcrypt_ which is considered very secure. Older ISPmail guides used `{SHA256-CRYPT}` or even older crypt `{BLF-CRYPT}` also known as _bcrypt_ which is considered very secure. Older ISPmail guides used `{SHA256-CRYPT}` or
schemes. Prepending the password field the hashing algorithm in curly brackets allows you to have different kinds of even older crypt schemes. Prepending the password field the hashing algorithm in curly brackets allows you to have
hashes. So you can easily migrate your old passwords without locking out users. Users with older schemes should get a different kinds of hashes. So you can easily migrate your old passwords without locking out users. Users with older
new password if possible to increase security. schemes should get a new password if possible to increase security.
- **quota**: The number of bytes that this mailbox can store. You can use this value to limit how much space a mailbox - **quota**: The number of bytes that this mailbox can store. You can use this value to limit how much space a mailbox
can take up. The default value is 0 which means that there is no limit. This is an optional feature that is discussed can take up. The default value is 0 which means that there is no limit. This is an optional feature that is discussed
later. TODO: link later.
<Aside type="tip" icon="right-caret" title="Example"> <Aside type="tip" icon="right-caret" title="Example">
@ -175,7 +174,7 @@ The second table contains information about your users. Each mail account requir
### virtual_aliases ### virtual_aliases
The third table contain optional forwardings from one email address to another or several others. The third table contain optional forwardings from one email address to another or several other addresses.
- **id**: A unique number identifying each row. It is set automatically. - **id**: A unique number identifying each row. It is set automatically.
- **domain_id**: References the domain in the `virtual_domains` table. - **domain_id**: References the domain in the `virtual_domains` table.
@ -198,8 +197,8 @@ This means:
`info@example.com` is also listed as a destination address, it will keep a copy of the email. Multiple rows for a `info@example.com` is also listed as a destination address, it will keep a copy of the email. Multiple rows for a
source are totally fine Postfix will consider all matching rows. source are totally fine Postfix will consider all matching rows.
- (4) Email for `boris-at-home@example.com` is redirected to `bevans@external.address`. - (4) Email for `boris-at-home@example.com` is redirected to `bevans@external.address`.
- (5) Email for any other address in the `example.com` domain is redirected to `joe@example.com`. TODO: link to catchall - (5) Email for any other address in the `example.com` domain is redirected to `joe@example.com`. This is called a
section _catchall_ address.
</Aside> </Aside>
@ -240,20 +239,10 @@ REPLACE INTO virtual_aliases
Do you wonder how I got the long cryptic password? I ran… Do you wonder how I got the long cryptic password? I ran…
``` ```
doveadm pw -s BLF-CRYPT doveadm pw
``` ```
…to create a secure hash of the simple password “summersun". Once you have installed Dovecot you can try that yourself …to create a secure hash of the simple password “summersun". Once you have installed Dovecot you can try that yourself
but you will get a different output. The reason is that the passwords are but you will get a different output. The reason is that the passwords are
[salted](<https://en.wikipedia.org/wiki/Salt_(cryptography)>). Every time you will get a different hash. That prevents [salted](<https://en.wikipedia.org/wiki/Salt_(cryptography)>). Every time you will get a different hash. That prevents
reverse-engineering the original password. reverse-engineering the original password.
Remember to remove that sample data before you go live with your mail server. Thanks to the _delete cascade_ you just
need to remove the virtual_domain. The alias and the mailbox will be deleted automatically. This would be the SQL query
you should run before taking your mail server into production:
```sql
DELETE FROM mailserver.virtual_domains WHERE name='example.org';
```
TODO: move to final step

View file

@ -29,7 +29,6 @@ records:
- **A / AAAA record (`smtp.example.com`)** - **A / AAAA record (`smtp.example.com`)**
The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers
know how to reach it. know how to reach it.
- An **A record** maps the hostname to an IPv4 address. - An **A record** maps the hostname to an IPv4 address.
- An **AAAA record** maps the hostname to an IPv6 address. - An **AAAA record** maps the hostname to an IPv6 address.
@ -53,7 +52,7 @@ In zone syntax you would create something like:
``` ```
@ IN MX 10 smtp @ IN MX 10 smtp
smtp IN A 100.64.17.3 smtp IN A 100.64.17.3
smtp IN A fd7a:115c:a1e0::17 smtp IN AAAA fd7a:115c:a1e0::17
``` ```
If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail
@ -64,26 +63,27 @@ servers may be more likely so flag your sent emails as spam if you do not have a
Use the `host` command to check your domain's MX record. Use the `host` command to check your domain's MX record.
```sh title="Run this on your server" ```sh title="Example"
$> host -t mx example.com dig +short example.com mx
example.com mail is handled by 10 smtp.example.com. # 10 smtp.example.com.
``` ```
Then check if that result resolves to an IP address: Then check if that result resolves to an IP address:
```sh title="Run this on your server" ```sh title="Example"
$> host smtp.example.com dig +short smtp.example.com a
smtp.example.com has address 49.13.89.249 # 49.13.89.249
smtp.example.com has IPv6 address 2a01:4f8:c012:62d1::1 dig +short smtp.example.com aaaa
# 2a01:4f8:c012:62d1::1
``` ```
Preferably the IP addresses should resolve back to the mail server's name: Preferably the IP addresses should resolve back to the mail server's name:
```sh title="Run this on your server" ```sh title="Example"
$> host 49.13.89.249 dig +short -x 49.13.89.249
249.89.13.49.in-addr.arpa domain name pointer smtp.example.com. # smtp.example.com.
$> host 2a01:4f8:c012:62d1::1 dig +short -x 2a01:4f8:c012:62d1::1
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.d.2.6.2.1.0.c.8.f.4.0.1.0.a.2.ip6.arpa domain name pointer smtp.example.com. # smtp.example.com.
``` ```
</Aside> </Aside>

View file

@ -19,7 +19,7 @@ Your mail server can't work properly without a valid TLS certificate. It will be
Your mail server will be able to host email addresses for many domains. But a TLS certificate is usually issued for a Your mail server will be able to host email addresses for many domains. But a TLS certificate is usually issued for a
single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like `mail.example.org`. That _common name_ is single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like `mail.example.org`. That _common name_ is
an important part of the certificate. It must match the name you use to talk to the server. an important part of the certificate. It must match the name your users use to talk to the server.
**Correct**: Your mail server is addressed as `mail.example.org`. The TLS certificate was also issued to **Correct**: Your mail server is addressed as `mail.example.org`. The TLS certificate was also issued to
`mail.example.org`. `mail.example.org`.
@ -88,13 +88,15 @@ If you like Certbot, please consider supporting our work by:
In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files now: In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files now:
- cert.pem: the certificate file - **cert.pem**: the certificate file
- chain.pem: the _chaining_ or _intermediate_ certificate. This certificate provides information how the LetsEncrypt - **chain.pem**: the _chaining_ or _intermediate_ certificate. This certificate provides information how the LetsEncrypt
certificates are linked to other known certificate authorities. It is generally a good idea to always send this certificates are linked to other known certificate authorities. It is generally a good idea to always send this
certificate along with your own for clients who may not know LetsEncrypt properly yet. certificate along with your own for clients who may not know LetsEncrypt properly yet.
- fullchain.pem: this file contains a concatenation of the _cert.pem_ and the _chain.pem_. This is the preferred file to - **fullchain.pem**: this file contains a concatenation of the _cert.pem_ and the _chain.pem_. This is the preferred
use when a piece of software asks where to find the _certificate_. file to use when a piece of software asks where to find the _certificate_.
- privkey.pem: the private key file. Keep it secret. - **privkey.pem**: the private key file. Keep it secret.
Well, actually those are not files but _symbolic links_ pointing to the "archive" directory. But don't worry about that.
</details> </details>
@ -103,6 +105,15 @@ In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files no
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_ Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
checks your certificate frequently and triggers a renewal one month before it expires. checks your certificate frequently and triggers a renewal one month before it expires.
It is important that services that use the certificate load the new certificate after an automatic renewal. This shell
command will create a file `/etc/letsencrypt/cli.ini` that handles it:
```sh title="Run this on your server"
echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot apache2"
```
Perfect. You won't have to worry about the certificate again.
<details class="collapsible"> <details class="collapsible">
<summary>Click here to learn how the renewal works…</summary> <summary>Click here to learn how the renewal works…</summary>
@ -118,13 +129,4 @@ systemctl cat certbot.service
_Systemd timers_ are similar to cron jobs. They require more work to set up but have some nice features and make you _Systemd timers_ are similar to cron jobs. They require more work to set up but have some nice features and make you
look cooler. look cooler.
It is important that services that use the certificate load the new certificate after an automatic renewal. This shell
command will create a file `/etc/letsencrypt/cli.ini` that handles it:
```sh title="Run this on your server"
echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot apache2"
```
Perfect. You won't have to worry about the certificate again.
</details> </details>

View file

@ -42,7 +42,7 @@ If the information is **not** available you just get no answer:
In SQL language Postfix has to ask MariaDB the question: In SQL language Postfix has to ask MariaDB the question:
```sql ```sql
SELECT "yes" FROM virtual_domains WHERE name='example.net' SELECT "yes" FROM virtual_domains WHERE name='example.net';
``` ```
Run the following code in your shell to create a configuration file creating that mapping: Run the following code in your shell to create a configuration file creating that mapping:
@ -62,8 +62,6 @@ and `dbname` definitions tell Postfix how to connect to the database. And the `q
domain is present in the database table `virtual_domains`. Using `SELECT 1` we return just the number 1 if such an entry domain is present in the database table `virtual_domains`. Using `SELECT 1` we return just the number 1 if such an entry
was found. In fact it does not matter what we return. Any _answer_ is fine. was found. In fact it does not matter what we return. Any _answer_ is fine.
Don't forget to replace the `MAILSERVER-PASSWORD-HERE` by your own password for the `mailserver` user.
### Virtual Aliases ### Virtual Aliases
Now let's deal with aliases. As shown earlier an alias redirects an email to another email address. So the _question_ Now let's deal with aliases. As shown earlier an alias redirects an email to another email address. So the _question_
@ -112,7 +110,7 @@ specific email address.
Actually the _answer_ is usually not `1` but the path to the mailbox on disk. But that applies only if Postfix would be Actually the _answer_ is usually not `1` but the path to the mailbox on disk. But that applies only if Postfix would be
saving the email to disk on its own. In our setup the email will be passed on to Dovecot in a later step. Dovecot will saving the email to disk on its own. In our setup the email will be passed on to Dovecot in a later step. Dovecot will
then handle the files on disk. Postfix just has to know is whether a mailbox exists. And that's why **any** _answer_ is then handle the files on disk. Postfix just has to know is whether a mailbox exists. And that's why _any_ answer is
sufficient here. sufficient here.
### Tell Postfix ### Tell Postfix
@ -152,6 +150,6 @@ john@example.org
1 1
``` ```
If you get anything else, please check those three config files. Perhaps the database password is wrong? If you get anything else, please check those three config files again.
</Aside> </Aside>

View file

@ -11,7 +11,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
<StepListReceive currentStep={4} /> <StepListReceive currentStep={4} />
In this chapter we will mainly configure Dovecot so that it knows how to deliver incoming emails. In this chapter we will configure Dovecot so that it knows how to deliver incoming emails.
## Setting up the vmail directory ## Setting up the vmail directory
@ -42,7 +42,7 @@ for our purpose.
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
want to use the MariaDB database backend so go ahead and change this block to: want to use the MariaDB database backend so go ahead and **change this block** to:
``` ```
#!include auth-system.conf.ext #!include auth-system.conf.ext