various typos fixed
This commit is contained in:
parent
1b0a9b6ba1
commit
46f4775ee2
10 changed files with 107 additions and 104 deletions
|
|
@ -6,12 +6,13 @@ sidebar:
|
||||||
order: 100
|
order: 100
|
||||||
---
|
---
|
||||||
|
|
||||||
This is the 12th edition of the ISPmail guide. A free guide to setting up a mail server for friends and family using
|
Good to have you here. This is the 12th edition of the ISPmail guide. A free guide to setting up a mail server for
|
||||||
open-source software. Email on the internet nowadays is in the hands of few huge companies. Take back control and host
|
friends and family using open-source software. Email on the internet nowadays is in the hands of few huge companies.
|
||||||
your own mail server. Get a cheap virtual server and read along. This guide is comprehensive and will walk you through
|
Take back control and host your own mail server. Get a cheap virtual server and read along. This guide is comprehensive
|
||||||
everything you need to know. I am publishing this guide without any commercial motives. All you need to invest is your
|
and will walk you through everything you need to know. I am publishing this guide without any commercial motives. All
|
||||||
time. And thanks to Debian you will get automatic security updates and do not have to worry about anything until the
|
you need to invest is your time. And thanks to Debian you will get automatic security updates and do not have to worry
|
||||||
next stable release comes out in 2-3 years.
|
about anything until the next stable release comes out in 2-3 years. And perhaps you come back then to upgrade your
|
||||||
|
server.
|
||||||
|
|
||||||
## What your mail server will do
|
## What your mail server will do
|
||||||
|
|
||||||
|
|
@ -20,10 +21,9 @@ next stable release comes out in 2-3 years.
|
||||||
- **Send** emails out to the internet. Connections will be encrypted when possible.
|
- **Send** emails out to the internet. Connections will be encrypted when possible.
|
||||||
- **Store** as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user. The only
|
- **Store** as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user. The only
|
||||||
limit is the size of your disk.
|
limit is the size of your disk.
|
||||||
- Provide a **webmail** interface so users can access their emails securely from any location using a web browser.
|
- Have a **webmail** interface so users can access their emails securely from any location using a web browser.
|
||||||
- Let your users fetch email using **IMAP** or **POP3** and send email through your servers using **SMTP**.
|
- Let your users fetch email using **IMAP** and send email through your servers using **SMTP**.
|
||||||
- Add automatic cryptographic signatures (**[DKIM / Domain Keys](https://en.wikipedia.org/wiki/DomainKeys)**) to
|
- Add automatic cryptographic signatures using DKIM to outgoing emails to prove that you are the owner of your domain.
|
||||||
outgoing emails to prove that you are the owner of your domain.
|
|
||||||
- Allow users to manage server-based **filter rules**. Distribute incoming emails to different folders. Forward copies.
|
- Allow users to manage server-based **filter rules**. Distribute incoming emails to different folders. Forward copies.
|
||||||
Or send out-of-office notifications.
|
Or send out-of-office notifications.
|
||||||
- Mitigate **brute force** attacks.
|
- Mitigate **brute force** attacks.
|
||||||
|
|
@ -33,21 +33,21 @@ next stable release comes out in 2-3 years.
|
||||||
- **Linux experience**. Preferably a Debian-derivative. No godlike skills required. But know your basics: navigating the
|
- **Linux experience**. Preferably a Debian-derivative. No godlike skills required. But know your basics: navigating the
|
||||||
file system, editing files, watching log files. Have some basic understanding of DNS. Bonus points if you have played
|
file system, editing files, watching log files. Have some basic understanding of DNS. Bonus points if you have played
|
||||||
with an SQL database and know about SELECT, INSERT, rows, columns.
|
with an SQL database and know about SELECT, INSERT, rows, columns.
|
||||||
- **Time**. 2 hours to get the basic service running. Maybe a day if you want all the optional bells and whistles.
|
- **Time**. 2 hours to get the basic service running. Maybe a day if you are not an everyday Debian user.
|
||||||
- A **server** that runs Debian Trixie. 1 GB of RAM and a 20 GB disk/SSD is fine for your friends and family. Rent a
|
- A **server** that runs [Debian Trixie](https://www.debian.org/releases/trixie/). 1 GB of RAM and a 20 GB disk/SSD is
|
||||||
cheap virtual server. Or use a decommissioned laptop. Other distributions than Debian come with other versions of the
|
fine for your friends and family. Just rent a cheap virtual server. Other distributions than Debian come with other
|
||||||
software and have different configurations and paths on disk. It will work but you will need to deviate from this
|
versions of the software and have different configurations and paths on disk. It will work but you will need to
|
||||||
guide. So for the easiest way choose Debian Trixie.
|
deviate from this guide and do some research. So for the smoothest ride go with Debian.
|
||||||
- The hosting provider you chose to run your server on needs to allow **SMTP send and receive**. These providers are
|
- The hosting provider you chose to run your server on needs to allow **SMTP send and receive**. These providers are
|
||||||
known to be troublesome:
|
known to be troublesome:
|
||||||
- Hetzner (DE, FI, US): Will allow SMTP after a month of paying for their service and per a request issued at
|
- Hetzner (DE, FI, US): Will allow SMTP after a month of paying for their service and per a request issued at
|
||||||
https://console.hetzner.cloud/limits
|
https://console.hetzner.cloud/limits
|
||||||
- DigitalOcean (US): Blocks SMTP and tells you that running your own mail server is a bad idea. Avoid.
|
- DigitalOcean (US): Blocks SMTP and tells you that running your own mail server is a bad idea. Avoid.
|
||||||
- Your server needs to have a public **IP address** that does not belong to a range of typical ISP customers. You
|
- Your server needs to have a public **IP address** that does not belong to a range of typical ISP customers. You
|
||||||
usually can’t operate the mail server from a dialup IP address at home because those IP ranges are blacklisted by most
|
usually can’t operate the mail server from a residential IP address at home because those IP ranges are blacklisted by
|
||||||
other mail servers. Make sure that your IP address is not [blacklisted](https://multirbl.valli.org/) before you start.
|
most other mail servers. Make sure that your IP address is not [blacklisted](https://multirbl.valli.org/) before you
|
||||||
If you rent a virtual server from your favorite hosting company you probably won’t have any problems. But if you want
|
start. If you rent a virtual server from your favorite hosting company you probably won’t have any problems. But if
|
||||||
to run the service from your home, this is something you need to check.
|
you want to run the service from your home, this is something you need to check.
|
||||||
- An **internet domain** (or several) to receive emails for. You need to be able to set A, MX and TXT records for that
|
- An **internet domain** (or several) to receive emails for. You need to be able to set A, MX and TXT records for that
|
||||||
domain. You should also be able to set PTR records for your IP address because some mail servers on the internet
|
domain. You should also be able to set PTR records for your IP address because some mail servers on the internet
|
||||||
require you to have matching forward and reverse DNS records.
|
require you to have matching forward and reverse DNS records.
|
||||||
|
|
@ -65,6 +65,17 @@ some detail in a complex setup goes wrong and they have no idea how to fix it. E
|
||||||
years. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time
|
years. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time
|
||||||
either taking the supposedly easy route.
|
either taking the supposedly easy route.
|
||||||
|
|
||||||
|
## What's new
|
||||||
|
|
||||||
|
The last updates to this guide – up to Debian Bookworm – were mainly minor changes. However this time I have spent many
|
||||||
|
weeks to improve the guide. Most sections are completely rewritten. Explanations about SMTP versus submission were
|
||||||
|
added. I dived deep into RFCs and reference documentation. I have used more features of the
|
||||||
|
[Astro/Starlight](https://starlight.astro.build/) framework (the software that is used to render this guide) to add
|
||||||
|
visual guides like task lists or image galleries or foldout sections to help you understand what's going on on a mail
|
||||||
|
server without getting lost. And I have replaced all my configuration examples with blocks that you can copy/paste into
|
||||||
|
your shell. So this guide is supposed to be shorter and faster to follow while at the same time trying to be more
|
||||||
|
comprehensive. Please leave your feedback in the comment sections whether this approach appeals to you.
|
||||||
|
|
||||||
## Ready?
|
## Ready?
|
||||||
|
|
||||||
The entire tutorial is split into several pages. You can find the different chapters on the left. The navigation within
|
The entire tutorial is split into several pages. You can find the different chapters on the left. The navigation within
|
||||||
|
|
|
||||||
|
|
@ -15,13 +15,14 @@ import { Aside } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.
|
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.
|
||||||
|
|
||||||
# Architectural changes
|
## Architectural changes
|
||||||
|
|
||||||
In the past I tried to keep things similar to previous versions of this guide. Most of us are happy with their mail
|
I always try to keep things similar to previous versions of this guide. Most of us are happy with their mail servers and
|
||||||
servers and want to change as little as possible when a new Debian release comes along. Just a few improvements:
|
want to change as little as possible when a new Debian release comes along. Just a few changes that come with the newer
|
||||||
|
software versions:
|
||||||
|
|
||||||
- **rsyslogd** was a classic choice to write log files like /var/log/mail.log. As Debian is using _systemd_ we no longer
|
- **rsyslogd** was a classic choice to write log files like /var/log/mail.log. As Debian is using _systemd_ we no longer
|
||||||
need rsyslogd and logrotate. The logs can be read using _journalctl_ instead. If you miss it, just
|
need rsyslogd and logrotate. The logs can be read using _journalctl_ instead. If you miss log files, just
|
||||||
`apt install rsyslog`.
|
`apt install rsyslog`.
|
||||||
- **smtpd_tls_security_level** is now only enabled for the `submission` service. That disables authentication for SMTP
|
- **smtpd_tls_security_level** is now only enabled for the `submission` service. That disables authentication for SMTP
|
||||||
connections on port 25. This emphasizes the separation of TCP 25 for server-to-server connections (without
|
connections on port 25. This emphasizes the separation of TCP 25 for server-to-server connections (without
|
||||||
|
|
@ -29,7 +30,7 @@ servers and want to change as little as possible when a new Debian release comes
|
||||||
- **certbot** is now using the `python3-certbot-apache` package. Getting and renewing certificates is now handled
|
- **certbot** is now using the `python3-certbot-apache` package. Getting and renewing certificates is now handled
|
||||||
magically by Apache without any downtime or additional configuration.
|
magically by Apache without any downtime or additional configuration.
|
||||||
|
|
||||||
# Version changes
|
## Version changes
|
||||||
|
|
||||||
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
|
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
|
||||||
have to change:
|
have to change:
|
||||||
|
|
@ -40,10 +41,10 @@ have to change:
|
||||||
- rspamd 3.4.1 -> 3.12.1. No breaking changes.
|
- rspamd 3.4.1 -> 3.12.1. No breaking changes.
|
||||||
- Roundcube 1.6.1 -> 1.6.11. No breaking changes.
|
- Roundcube 1.6.1 -> 1.6.11. No breaking changes.
|
||||||
|
|
||||||
# Fresh installation
|
## Fresh installation
|
||||||
|
|
||||||
Please do not try to upgrade your previous server using `apt-get dist-upgrade`. It is very hard to do the upgrade
|
Do not try to upgrade your existing server using `apt-get dist-upgrade`. There are too many changes especially with
|
||||||
without losing mails. Set up a new server instead. Once you are ready, come back here.
|
Dovecot. Start with a fresh installation on another server and then migrate.
|
||||||
|
|
||||||
## Preparing the DNS/IP switch
|
## Preparing the DNS/IP switch
|
||||||
|
|
||||||
|
|
@ -106,8 +107,9 @@ Details are found in the rspamd chapter.
|
||||||
|
|
||||||
## Migrate the Maildirs hot
|
## Migrate the Maildirs hot
|
||||||
|
|
||||||
Fortunately Dovecot uses the maildir format that stores emails as plain files on disk. Login to the new (Bookworm)
|
(**Hot** means: copy the files why they are still in use and potentially change while you do that.) Fortunately Dovecot
|
||||||
server and use *rsync* to copy over the mails from the old (Bullseye) mail server:
|
uses the maildir format that stores emails as plain files on disk. Login to the new (Trixie) server and use *rsync* to
|
||||||
|
copy over the mails from the old (Bullseye) mail server:
|
||||||
|
|
||||||
```
|
```
|
||||||
rsync -va oldserver:/var/vmail/ /var/vmail/
|
rsync -va oldserver:/var/vmail/ /var/vmail/
|
||||||
|
|
@ -119,9 +121,11 @@ There is no need to shut down Dovecot on your production Bullseye server. Copyin
|
||||||
will not break anything. This is called a “hot copy". It may not be consistent but it will save time during the final
|
will not break anything. This is called a “hot copy". It may not be consistent but it will save time during the final
|
||||||
synchronization.
|
synchronization.
|
||||||
|
|
||||||
## Copy certificates
|
Another way to copy over the emails is using Dovecot's
|
||||||
|
[doveadm-sync](https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) command. It may be especially handy if you
|
||||||
|
need to copy emails from another server where you only have IMAP access but cannot access the files directly.
|
||||||
|
|
||||||
(TODO: ignore with Caddy)
|
## Copy certificates
|
||||||
|
|
||||||
Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server.
|
Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server.
|
||||||
|
|
||||||
|
|
@ -136,8 +140,9 @@ You told your users about the downtime, right? The time has come? Okay. Shut dow
|
||||||
|
|
||||||
## Migrate the emails cold
|
## Migrate the emails cold
|
||||||
|
|
||||||
Let’s synchronize again. *rsync* will only copy those files that have changed which makes it much faster than the first
|
(**Cold** means: the processes have stopped or you made sure that there is no user activity so that the files can be
|
||||||
sync. On your new server run:
|
copied consistently.) Let’s synchronize again. *rsync* will only copy those files that have changed which makes it much
|
||||||
|
faster than the first sync. On your new server run:
|
||||||
|
|
||||||
```
|
```
|
||||||
rsync -va --delete oldserver:/var/vmail/ /var/vmail/
|
rsync -va --delete oldserver:/var/vmail/ /var/vmail/
|
||||||
|
|
@ -146,7 +151,7 @@ rsync -va --delete oldserver:/var/vmail/ /var/vmail/
|
||||||
(The “`--delete`" option makes sure that files that have been removed from the old server will also be deleted from the
|
(The “`--delete`" option makes sure that files that have been removed from the old server will also be deleted from the
|
||||||
new server. So if a user has deleted an email it will be deleted on the new server as well.)
|
new server. So if a user has deleted an email it will be deleted on the new server as well.)
|
||||||
|
|
||||||
# Switch the DNS records
|
## Switch the DNS records
|
||||||
|
|
||||||
For all your domains you will have to change the DNS “MX" or “A" record to point to your new server.
|
For all your domains you will have to change the DNS “MX" or “A" record to point to your new server.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,14 +14,14 @@ import { FileTree } from "@astrojs/starlight/components";
|
||||||
Debian Trixie server, just skip this page.
|
Debian Trixie server, just skip this page.
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
You have a blank computer or virtual machine? Then simply install Debian Bookworm yourself. Get a boot medium from the
|
You have a blank computer or virtual machine? Then simply install Debian Trixie yourself. Get a boot medium from the
|
||||||
[Debian website](https://www.debian.org/distrib/netinst). The smaller _network installer_ is sufficient – it will
|
[Debian website](https://www.debian.org/distrib/netinst). The smaller _network installer_ is sufficient – it will
|
||||||
download all required packages directly from the internet. Make sure you choose ‘English’ as the installation language
|
download all required packages directly from the internet. Make sure you choose ‘English’ as the installation language
|
||||||
even if it is not your native language. If you have trouble with the server you will more likely find help when
|
even if it is not your native language. If you have trouble with the server you will more likely find help when
|
||||||
searching for English error messages on the internet.
|
searching for English error messages on the internet.
|
||||||
|
|
||||||
Most of the installation is pretty straightforward. You don’t need me holding your hand. I strongly recommend that you
|
Most of the installation is pretty straightforward. You don’t need me holding your hand. However I strongly recommend
|
||||||
use the _logical volume manager_ (LVM) for your partitions to stay flexible if your server grows. See my
|
that you use the _logical volume manager_ (LVM) for your partitions to stay flexible if your server grows. See my
|
||||||
[article on LVM](https://workaround.org/understanding-lvm/) if you want some help understanding its concept.
|
[article on LVM](https://workaround.org/understanding-lvm/) if you want some help understanding its concept.
|
||||||
|
|
||||||
## Partitioning
|
## Partitioning
|
||||||
|
|
|
||||||
|
|
@ -18,7 +18,7 @@ DEBIAN_FRONTEND=noninteractive \
|
||||||
apache2 python3-certbot-apache libapache2-mod-php \
|
apache2 python3-certbot-apache libapache2-mod-php \
|
||||||
php-intl php-mbstring php-xml unzip certbot \
|
php-intl php-mbstring php-xml unzip certbot \
|
||||||
roundcube-mysql roundcube roundcube-plugins swaks libnet-ssleay-perl \
|
roundcube-mysql roundcube roundcube-plugins swaks libnet-ssleay-perl \
|
||||||
ufw mutt unattended-upgrades mariadb-server \
|
mutt unattended-upgrades mariadb-server \
|
||||||
rspamd redis-server opendkim-tools bind9-dnsutils pwgen
|
rspamd redis-server opendkim-tools bind9-dnsutils pwgen
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
@ -28,7 +28,7 @@ While the server is downloading and installing the packages, let me give you a q
|
||||||
Postfix is the MTA (mail transport agent) that speaks SMTP to send and receive emails. This package installs Postfix
|
Postfix is the MTA (mail transport agent) that speaks SMTP to send and receive emails. This package installs Postfix
|
||||||
with support for MariaDB databases.
|
with support for MariaDB databases.
|
||||||
- **dovecot** \
|
- **dovecot** \
|
||||||
Dovecot manages the emsrc/content/docs/ispmail-trixie/140-install-packages.mdx emails using IMAP.
|
Dovecot manages the emails on disk and lets users access them via IMAP.
|
||||||
- **-lmtpd** \
|
- **-lmtpd** \
|
||||||
LMTP (Local Mail Transfer Protocol) provides the glue between Postfix and Dovecot.
|
LMTP (Local Mail Transfer Protocol) provides the glue between Postfix and Dovecot.
|
||||||
- **-managesieved** \
|
- **-managesieved** \
|
||||||
|
|
@ -50,8 +50,6 @@ While the server is downloading and installing the packages, let me give you a q
|
||||||
package is needed to test encrypted connections.
|
package is needed to test encrypted connections.
|
||||||
- **certbot** \
|
- **certbot** \
|
||||||
Gets a free TLS certificate from [_Let's Encrypt_](https://letsencrypt.org/) for encrypting network communication.
|
Gets a free TLS certificate from [_Let's Encrypt_](https://letsencrypt.org/) for encrypting network communication.
|
||||||
- **ufw** \
|
|
||||||
Universal FireWall. A simple tool to manage firewall rules to limit access to your server. TODO: omit?
|
|
||||||
- **mutt** \
|
- **mutt** \
|
||||||
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the
|
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the
|
||||||
functionality of your mail server. Think of it as a text-based Thunderbird.
|
functionality of your mail server. Think of it as a text-based Thunderbird.
|
||||||
|
|
|
||||||
|
|
@ -10,7 +10,7 @@ Your mail server will have one fully qualified domain name — for example, `pos
|
||||||
domain is `example.com`. If someone visits `https://example.com/`, they might be greeted by the Roundcube webmail login
|
domain is `example.com`. If someone visits `https://example.com/`, they might be greeted by the Roundcube webmail login
|
||||||
page.
|
page.
|
||||||
|
|
||||||
But your server doesn’t have to handle only one domain. You might have mailboxes like:
|
But your server doesn’t have to handle only one domain. You can have mailboxes on multiple domains like:
|
||||||
|
|
||||||
- `jack@example.com`
|
- `jack@example.com`
|
||||||
- `lucy@example.com`
|
- `lucy@example.com`
|
||||||
|
|
|
||||||
|
|
@ -11,9 +11,7 @@ import { Tabs, TabItem } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
Now it’s time to prepare the MariaDB database that stores the information that controls your mail server. In the process
|
Now it’s time to prepare the MariaDB database that stores the information that controls your mail server. In the process
|
||||||
you will have to enter [SQL](http://en.wikipedia.org/wiki/SQL) queries – the language of relational database servers.
|
you will have to enter [SQL](http://en.wikipedia.org/wiki/SQL) queries – the language of relational database servers.
|
||||||
You may enter them in a terminal window using the ‘mariadb’ command. But if you are less experienced with SQL you may
|
You may enter them in a terminal window using the ‘mariadb’ command.
|
||||||
prefer using a web interface. That’s what you installed _[Adminer](https://www.adminer.org/)_ for. TODO: link to Adminer
|
|
||||||
setup in a later section
|
|
||||||
|
|
||||||
<Aside title="MariaDB versus MySQL">
|
<Aside title="MariaDB versus MySQL">
|
||||||
|
|
||||||
|
|
@ -58,8 +56,8 @@ In this section you will create the basic database `mailserver` and two users:
|
||||||
<Aside type="note" title="About passwords">
|
<Aside type="note" title="About passwords">
|
||||||
|
|
||||||
For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
|
For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
|
||||||
are—it will make copying and pasting the upcoming steps much easier. After you’ve confirmed everything is working
|
are—it will make copying and pasting the upcoming steps much easier. At the end of the tutorial I will help you change
|
||||||
correctly, I’ll show you how to update the passwords securely with a single command.
|
the passwords securely with a single command.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
|
|
@ -147,21 +145,22 @@ represents a domain.
|
||||||
|
|
||||||
### virtual_users
|
### virtual_users
|
||||||
|
|
||||||
The second table contains information about your users. Each mail account requires one row in this table.
|
The second table contains information about your users – or rather: your mailboxes. Each mail account requires one row
|
||||||
|
in this table.
|
||||||
|
|
||||||
- **id**: A unique number identifying each row. It is set automatically.
|
- **id**: A unique number identifying each row. It is set automatically.
|
||||||
- **domain_id**: A [reference](https://en.wikipedia.org/wiki/Foreign_key) to the domain in the `virtual_domains` table.
|
- **domain_id**: A [reference](https://en.wikipedia.org/wiki/Foreign_key) to the domain in the `virtual_domains` table.
|
||||||
So each domain can have many mailboxes.
|
So each domain can have many mailboxes.
|
||||||
- **email**: The email address of the mailbox.
|
- **email**: The email address of the mailbox.
|
||||||
- **password**: The hashed password of the mail account. It is prepended by the
|
- **password**: The hashed password of the mail account. It is prepended by the
|
||||||
[password scheme](https://doc.dovecot.org/main/core/config/auth/schemes.html). By default it is `{BLF-CRYPT}` also
|
[password scheme](https://doc.dovecot.org/2.4.2/core/config/auth/schemes.html#password-schemes). By default it is
|
||||||
known as _bcrypt_ which is considered very secure. Older ISPmail guides used `{SHA256-CRYPT}` or even older crypt
|
`{BLF-CRYPT}` also known as _bcrypt_ which is considered very secure. Older ISPmail guides used `{SHA256-CRYPT}` or
|
||||||
schemes. Prepending the password field the hashing algorithm in curly brackets allows you to have different kinds of
|
even older crypt schemes. Prepending the password field the hashing algorithm in curly brackets allows you to have
|
||||||
hashes. So you can easily migrate your old passwords without locking out users. Users with older schemes should get a
|
different kinds of hashes. So you can easily migrate your old passwords without locking out users. Users with older
|
||||||
new password if possible to increase security.
|
schemes should get a new password if possible to increase security.
|
||||||
- **quota**: The number of bytes that this mailbox can store. You can use this value to limit how much space a mailbox
|
- **quota**: The number of bytes that this mailbox can store. You can use this value to limit how much space a mailbox
|
||||||
can take up. The default value is 0 which means that there is no limit. This is an optional feature that is discussed
|
can take up. The default value is 0 which means that there is no limit. This is an optional feature that is discussed
|
||||||
later. TODO: link
|
later.
|
||||||
|
|
||||||
<Aside type="tip" icon="right-caret" title="Example">
|
<Aside type="tip" icon="right-caret" title="Example">
|
||||||
|
|
||||||
|
|
@ -175,7 +174,7 @@ The second table contains information about your users. Each mail account requir
|
||||||
|
|
||||||
### virtual_aliases
|
### virtual_aliases
|
||||||
|
|
||||||
The third table contain optional forwardings from one email address to another – or several others.
|
The third table contain optional forwardings from one email address to another – or several other – addresses.
|
||||||
|
|
||||||
- **id**: A unique number identifying each row. It is set automatically.
|
- **id**: A unique number identifying each row. It is set automatically.
|
||||||
- **domain_id**: References the domain in the `virtual_domains` table.
|
- **domain_id**: References the domain in the `virtual_domains` table.
|
||||||
|
|
@ -198,8 +197,8 @@ This means:
|
||||||
`info@example.com` is also listed as a destination address, it will keep a copy of the email. Multiple rows for a
|
`info@example.com` is also listed as a destination address, it will keep a copy of the email. Multiple rows for a
|
||||||
source are totally fine – Postfix will consider all matching rows.
|
source are totally fine – Postfix will consider all matching rows.
|
||||||
- (4) Email for `boris-at-home@example.com` is redirected to `bevans@external.address`.
|
- (4) Email for `boris-at-home@example.com` is redirected to `bevans@external.address`.
|
||||||
- (5) Email for any other address in the `example.com` domain is redirected to `joe@example.com`. TODO: link to catchall
|
- (5) Email for any other address in the `example.com` domain is redirected to `joe@example.com`. This is called a
|
||||||
section
|
_catchall_ address.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
|
|
@ -240,20 +239,10 @@ REPLACE INTO virtual_aliases
|
||||||
Do you wonder how I got the long cryptic password? I ran…
|
Do you wonder how I got the long cryptic password? I ran…
|
||||||
|
|
||||||
```
|
```
|
||||||
doveadm pw -s BLF-CRYPT
|
doveadm pw
|
||||||
```
|
```
|
||||||
|
|
||||||
…to create a secure hash of the simple password “summersun". Once you have installed Dovecot you can try that yourself
|
…to create a secure hash of the simple password “summersun". Once you have installed Dovecot you can try that yourself
|
||||||
but you will get a different output. The reason is that the passwords are
|
but you will get a different output. The reason is that the passwords are
|
||||||
[salted](<https://en.wikipedia.org/wiki/Salt_(cryptography)>). Every time you will get a different hash. That prevents
|
[salted](<https://en.wikipedia.org/wiki/Salt_(cryptography)>). Every time you will get a different hash. That prevents
|
||||||
reverse-engineering the original password.
|
reverse-engineering the original password.
|
||||||
|
|
||||||
Remember to remove that sample data before you go live with your mail server. Thanks to the _delete cascade_ you just
|
|
||||||
need to remove the virtual_domain. The alias and the mailbox will be deleted automatically. This would be the SQL query
|
|
||||||
you should run before taking your mail server into production:
|
|
||||||
|
|
||||||
```sql
|
|
||||||
DELETE FROM mailserver.virtual_domains WHERE name='example.org';
|
|
||||||
```
|
|
||||||
|
|
||||||
TODO: move to final step
|
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,6 @@ records:
|
||||||
- **A / AAAA record (`smtp.example.com`)**
|
- **A / AAAA record (`smtp.example.com`)**
|
||||||
The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers
|
The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers
|
||||||
know how to reach it.
|
know how to reach it.
|
||||||
|
|
||||||
- An **A record** maps the hostname to an IPv4 address.
|
- An **A record** maps the hostname to an IPv4 address.
|
||||||
- An **AAAA record** maps the hostname to an IPv6 address.
|
- An **AAAA record** maps the hostname to an IPv6 address.
|
||||||
|
|
||||||
|
|
@ -53,7 +52,7 @@ In zone syntax you would create something like:
|
||||||
```
|
```
|
||||||
@ IN MX 10 smtp
|
@ IN MX 10 smtp
|
||||||
smtp IN A 100.64.17.3
|
smtp IN A 100.64.17.3
|
||||||
smtp IN A fd7a:115c:a1e0::17
|
smtp IN AAAA fd7a:115c:a1e0::17
|
||||||
```
|
```
|
||||||
|
|
||||||
If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail
|
If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail
|
||||||
|
|
@ -64,26 +63,27 @@ servers may be more likely so flag your sent emails as spam if you do not have a
|
||||||
|
|
||||||
Use the `host` command to check your domain's MX record.
|
Use the `host` command to check your domain's MX record.
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
```sh title="Example"
|
||||||
$> host -t mx example.com
|
dig +short example.com mx
|
||||||
example.com mail is handled by 10 smtp.example.com.
|
# 10 smtp.example.com.
|
||||||
```
|
```
|
||||||
|
|
||||||
Then check if that result resolves to an IP address:
|
Then check if that result resolves to an IP address:
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
```sh title="Example"
|
||||||
$> host smtp.example.com
|
dig +short smtp.example.com a
|
||||||
smtp.example.com has address 49.13.89.249
|
# 49.13.89.249
|
||||||
smtp.example.com has IPv6 address 2a01:4f8:c012:62d1::1
|
dig +short smtp.example.com aaaa
|
||||||
|
# 2a01:4f8:c012:62d1::1
|
||||||
```
|
```
|
||||||
|
|
||||||
Preferably the IP addresses should resolve back to the mail server's name:
|
Preferably the IP addresses should resolve back to the mail server's name:
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
```sh title="Example"
|
||||||
$> host 49.13.89.249
|
dig +short -x 49.13.89.249
|
||||||
249.89.13.49.in-addr.arpa domain name pointer smtp.example.com.
|
# smtp.example.com.
|
||||||
$> host 2a01:4f8:c012:62d1::1
|
dig +short -x 2a01:4f8:c012:62d1::1
|
||||||
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.d.2.6.2.1.0.c.8.f.4.0.1.0.a.2.ip6.arpa domain name pointer smtp.example.com.
|
# smtp.example.com.
|
||||||
```
|
```
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
|
||||||
|
|
@ -19,7 +19,7 @@ Your mail server can't work properly without a valid TLS certificate. It will be
|
||||||
|
|
||||||
Your mail server will be able to host email addresses for many domains. But a TLS certificate is usually issued for a
|
Your mail server will be able to host email addresses for many domains. But a TLS certificate is usually issued for a
|
||||||
single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like `mail.example.org`. That _common name_ is
|
single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like `mail.example.org`. That _common name_ is
|
||||||
an important part of the certificate. It must match the name you use to talk to the server.
|
an important part of the certificate. It must match the name your users use to talk to the server.
|
||||||
|
|
||||||
**Correct**: Your mail server is addressed as `mail.example.org`. The TLS certificate was also issued to
|
**Correct**: Your mail server is addressed as `mail.example.org`. The TLS certificate was also issued to
|
||||||
`mail.example.org`.
|
`mail.example.org`.
|
||||||
|
|
@ -88,13 +88,15 @@ If you like Certbot, please consider supporting our work by:
|
||||||
|
|
||||||
In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files now:
|
In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files now:
|
||||||
|
|
||||||
- cert.pem: the certificate file
|
- **cert.pem**: the certificate file
|
||||||
- chain.pem: the _chaining_ or _intermediate_ certificate. This certificate provides information how the LetsEncrypt
|
- **chain.pem**: the _chaining_ or _intermediate_ certificate. This certificate provides information how the LetsEncrypt
|
||||||
certificates are linked to other known certificate authorities. It is generally a good idea to always send this
|
certificates are linked to other known certificate authorities. It is generally a good idea to always send this
|
||||||
certificate along with your own for clients who may not know LetsEncrypt properly yet.
|
certificate along with your own for clients who may not know LetsEncrypt properly yet.
|
||||||
- fullchain.pem: this file contains a concatenation of the _cert.pem_ and the _chain.pem_. This is the preferred file to
|
- **fullchain.pem**: this file contains a concatenation of the _cert.pem_ and the _chain.pem_. This is the preferred
|
||||||
use when a piece of software asks where to find the _certificate_.
|
file to use when a piece of software asks where to find the _certificate_.
|
||||||
- privkey.pem: the private key file. Keep it secret.
|
- **privkey.pem**: the private key file. Keep it secret.
|
||||||
|
|
||||||
|
Well, actually those are not files but _symbolic links_ pointing to the "archive" directory. But don't worry about that.
|
||||||
|
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
|
|
@ -103,6 +105,15 @@ In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files no
|
||||||
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
|
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
|
||||||
checks your certificate frequently and triggers a renewal one month before it expires.
|
checks your certificate frequently and triggers a renewal one month before it expires.
|
||||||
|
|
||||||
|
It is important that services that use the certificate load the new certificate after an automatic renewal. This shell
|
||||||
|
command will create a file `/etc/letsencrypt/cli.ini` that handles it:
|
||||||
|
|
||||||
|
```sh title="Run this on your server"
|
||||||
|
echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot apache2"
|
||||||
|
```
|
||||||
|
|
||||||
|
Perfect. You won't have to worry about the certificate again.
|
||||||
|
|
||||||
<details class="collapsible">
|
<details class="collapsible">
|
||||||
<summary>Click here to learn how the renewal works…</summary>
|
<summary>Click here to learn how the renewal works…</summary>
|
||||||
|
|
||||||
|
|
@ -118,13 +129,4 @@ systemctl cat certbot.service
|
||||||
_Systemd timers_ are similar to cron jobs. They require more work to set up but have some nice features and make you
|
_Systemd timers_ are similar to cron jobs. They require more work to set up but have some nice features and make you
|
||||||
look cooler.
|
look cooler.
|
||||||
|
|
||||||
It is important that services that use the certificate load the new certificate after an automatic renewal. This shell
|
|
||||||
command will create a file `/etc/letsencrypt/cli.ini` that handles it:
|
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
|
||||||
echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot apache2"
|
|
||||||
```
|
|
||||||
|
|
||||||
Perfect. You won't have to worry about the certificate again.
|
|
||||||
|
|
||||||
</details>
|
</details>
|
||||||
|
|
|
||||||
|
|
@ -42,7 +42,7 @@ If the information is **not** available you just get no answer:
|
||||||
In SQL language Postfix has to ask MariaDB the question:
|
In SQL language Postfix has to ask MariaDB the question:
|
||||||
|
|
||||||
```sql
|
```sql
|
||||||
SELECT "yes" FROM virtual_domains WHERE name='example.net'
|
SELECT "yes" FROM virtual_domains WHERE name='example.net';
|
||||||
```
|
```
|
||||||
|
|
||||||
Run the following code in your shell to create a configuration file creating that mapping:
|
Run the following code in your shell to create a configuration file creating that mapping:
|
||||||
|
|
@ -62,8 +62,6 @@ and `dbname` definitions tell Postfix how to connect to the database. And the `q
|
||||||
domain is present in the database table `virtual_domains`. Using `SELECT 1` we return just the number 1 if such an entry
|
domain is present in the database table `virtual_domains`. Using `SELECT 1` we return just the number 1 if such an entry
|
||||||
was found. In fact it does not matter what we return. Any _answer_ is fine.
|
was found. In fact it does not matter what we return. Any _answer_ is fine.
|
||||||
|
|
||||||
Don't forget to replace the `MAILSERVER-PASSWORD-HERE` by your own password for the `mailserver` user.
|
|
||||||
|
|
||||||
### Virtual Aliases
|
### Virtual Aliases
|
||||||
|
|
||||||
Now let's deal with aliases. As shown earlier an alias redirects an email to another email address. So the _question_
|
Now let's deal with aliases. As shown earlier an alias redirects an email to another email address. So the _question_
|
||||||
|
|
@ -112,7 +110,7 @@ specific email address.
|
||||||
|
|
||||||
Actually the _answer_ is usually not `1` but the path to the mailbox on disk. But that applies only if Postfix would be
|
Actually the _answer_ is usually not `1` but the path to the mailbox on disk. But that applies only if Postfix would be
|
||||||
saving the email to disk on its own. In our setup the email will be passed on to Dovecot in a later step. Dovecot will
|
saving the email to disk on its own. In our setup the email will be passed on to Dovecot in a later step. Dovecot will
|
||||||
then handle the files on disk. Postfix just has to know is whether a mailbox exists. And that's why **any** _answer_ is
|
then handle the files on disk. Postfix just has to know is whether a mailbox exists. And that's why _any_ answer is
|
||||||
sufficient here.
|
sufficient here.
|
||||||
|
|
||||||
### Tell Postfix
|
### Tell Postfix
|
||||||
|
|
@ -152,6 +150,6 @@ john@example.org
|
||||||
1
|
1
|
||||||
```
|
```
|
||||||
|
|
||||||
If you get anything else, please check those three config files. Perhaps the database password is wrong?
|
If you get anything else, please check those three config files again.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
|
||||||
|
|
@ -11,7 +11,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
|
||||||
|
|
||||||
<StepListReceive currentStep={4} />
|
<StepListReceive currentStep={4} />
|
||||||
|
|
||||||
In this chapter we will mainly configure Dovecot so that it knows how to deliver incoming emails.
|
In this chapter we will configure Dovecot so that it knows how to deliver incoming emails.
|
||||||
|
|
||||||
## Setting up the vmail directory
|
## Setting up the vmail directory
|
||||||
|
|
||||||
|
|
@ -42,7 +42,7 @@ for our purpose.
|
||||||
|
|
||||||
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
|
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
|
||||||
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
|
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
|
||||||
want to use the MariaDB database backend so go ahead and change this block to:
|
want to use the MariaDB database backend so go ahead and **change this block** to:
|
||||||
|
|
||||||
```
|
```
|
||||||
#!include auth-system.conf.ext
|
#!include auth-system.conf.ext
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue