various changes before release
This commit is contained in:
parent
46f4775ee2
commit
582d98f7ee
6 changed files with 76 additions and 69 deletions
|
|
@ -41,12 +41,12 @@ for our purpose.
|
||||||
### 10-auth.conf
|
### 10-auth.conf
|
||||||
|
|
||||||
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
|
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
|
||||||
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
|
of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But
|
||||||
want to use the MariaDB database backend so go ahead and **change this block** to:
|
we want to use the MariaDB database backend. Please comment all all include statements:
|
||||||
|
|
||||||
```
|
```text title="Edit your /etc/dovecot/conf.d/10-auth.conf"
|
||||||
#!include auth-system.conf.ext
|
#!include auth-system.conf.ext
|
||||||
!include auth-sql.conf.ext
|
#!include auth-sql.conf.ext
|
||||||
#!include auth-ldap.conf.ext
|
#!include auth-ldap.conf.ext
|
||||||
#!include auth-passwdfile.conf.ext
|
#!include auth-passwdfile.conf.ext
|
||||||
#!include auth-checkpassword.conf.ext
|
#!include auth-checkpassword.conf.ext
|
||||||
|
|
@ -55,17 +55,21 @@ want to use the MariaDB database backend so go ahead and **change this block** t
|
||||||
|
|
||||||
Every line starting with `#` is disabled. Only lines starting with `!` are considered.
|
Every line starting with `#` is disabled. Only lines starting with `!` are considered.
|
||||||
|
|
||||||
### 10-mail.conf
|
### 10-mail.conf / 99-ispmail-mail.conf
|
||||||
|
|
||||||
Edit this file at `/etc/dovecot/conf.d/10-mail.conf`. It contains many settings regarding mailboxes, like where they are
|
The file at `/etc/dovecot/conf.d/10-mail.conf` contains many settings regarding mailboxes, like where they are located,
|
||||||
located, who owns them and what is their layout? Set this:
|
who owns them and what is their layout? Create a new file `/etc/dovecot/conf.d/99-ispmail-mail.conf` that overrides
|
||||||
|
these defaults:
|
||||||
|
|
||||||
```
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-mail.conf << EOF
|
||||||
mail_driver = maildir
|
mail_driver = maildir
|
||||||
mail_home = /var/vmail/%{user | domain}/%{user | username}
|
mail_home = /var/vmail/%{user | domain}/%{user | username}
|
||||||
mail_path = ~/Maildir
|
mail_path = ~/Maildir
|
||||||
mail_uid = vmail
|
mail_uid = vmail
|
||||||
mail_gid = vmail
|
mail_gid = vmail
|
||||||
|
mail_inbox_path =
|
||||||
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
This looks more sophisticated than with versions of Dovecot before 2.4. What it means:
|
This looks more sophisticated than with versions of Dovecot before 2.4. What it means:
|
||||||
|
|
@ -78,33 +82,37 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
|
||||||
- **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason
|
- **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason
|
||||||
is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox
|
is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox
|
||||||
directory.
|
directory.
|
||||||
- **mail_uid**/**mail_gid**/: All mailboxes are stored on disk under the owner _vmail_.
|
- **mail_uid**/**mail_gid**: All mailboxes will be owned be the user and group `vmail`.
|
||||||
|
- **mail_inbox_path**: We just un-set this because it would conflict with the _mail_path_ that is set in `10-mail.conf`
|
||||||
|
|
||||||
### 10-master.conf
|
### 10-master.conf / 99-ispmail-master.conf
|
||||||
|
|
||||||
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
|
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's _services_. A _service_ is a part
|
||||||
|
of Dovecot that listens on a TCP port or a UNIX socket so that other parts of your system can use it. We want Postfix to
|
||||||
|
use Dovecot for authentication. So we need to change the `service auth` section:
|
||||||
|
|
||||||
So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
|
```sh title="Run this on your server"
|
||||||
section because we want Postfix to allow Dovecot as an authentication service. Make it look like this:
|
cat > /etc/dovecot/conf.d/99-ispmail-master.conf << EOF
|
||||||
|
service auth {
|
||||||
```
|
|
||||||
# Postfix smtp-auth
|
|
||||||
unix_listener /var/spool/postfix/private/dovecot-auth {
|
unix_listener /var/spool/postfix/private/dovecot-auth {
|
||||||
mode = 0660
|
mode = 0660
|
||||||
user = postfix
|
user = postfix
|
||||||
group = postfix
|
group = postfix
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix
|
That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix
|
||||||
to authenticate your users which is relevant later when we set up _relaying_.
|
to authenticate your users which is relevant later when we set up _relaying_.
|
||||||
|
|
||||||
### 10-ssl.conf
|
### 10-ssl.conf / 99-ispmail-ssl.conf
|
||||||
|
|
||||||
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
|
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
|
||||||
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
|
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
|
||||||
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
||||||
that someone sends their password without encryption.
|
that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to
|
||||||
|
override the defaults.
|
||||||
|
|
||||||
<Aside type="danger" title="Important">
|
<Aside type="danger" title="Important">
|
||||||
|
|
||||||
|
|
@ -112,30 +120,34 @@ Please replace `mail.example.org` by the FQDN you chose.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
```
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-ssl.conf << EOF
|
||||||
ssl = required
|
ssl = required
|
||||||
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
|
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
|
||||||
ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem
|
ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem
|
||||||
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
### 20-lmtp.conf
|
### 20-lmtp.conf / 99-ispmail-lmtp.conf
|
||||||
|
|
||||||
There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our
|
There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our
|
||||||
setup. So please edit this file and comment out the `auth_username_format` line:
|
setup: `auth_username_format`. So let's override it:
|
||||||
|
|
||||||
```
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-username-format.conf << EOF
|
||||||
protocol lmtp {
|
protocol lmtp {
|
||||||
#auth_username_format = %{user | username}
|
auth_username_format =
|
||||||
}
|
}
|
||||||
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
### auth-sql.conf.ext
|
### 99-ispmail-sql.conf
|
||||||
|
|
||||||
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). You can safely
|
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). There are
|
||||||
replace the content of the `/etc/dovecot/conf.d/auth-sql.conf.ext` file by:
|
suggestions in the `auth-sql.conf.ext` file but we will add our own file:
|
||||||
|
|
||||||
```
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-sql.conf << EOF
|
||||||
sql_driver = mysql
|
sql_driver = mysql
|
||||||
|
|
||||||
mysql /var/run/mysqld/mysqld.sock {
|
mysql /var/run/mysqld/mysqld.sock {
|
||||||
|
|
@ -153,18 +165,16 @@ userdb sql {
|
||||||
passdb sql {
|
passdb sql {
|
||||||
query = SELECT password FROM virtual_users where email='%{user}'
|
query = SELECT password FROM virtual_users where email='%{user}'
|
||||||
}
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# fix permissions
|
||||||
|
chown root:root /etc/dovecot/conf.d/99-ispmail-sql.conf
|
||||||
|
chmod go= /etc/dovecot/conf.d/99-ispmail-sql.conf
|
||||||
```
|
```
|
||||||
|
|
||||||
Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
|
Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
|
||||||
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) and the user-ID and group-ID are always `vmail` and
|
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
|
||||||
`vmail`.
|
always `vmail` and `vmail`.
|
||||||
|
|
||||||
Make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
|
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
|
||||||
chown root:root /etc/dovecot/conf.d/auth-sql.conf.ext
|
|
||||||
chmod go= /etc/dovecot/conf.d/auth-sql.conf.ext
|
|
||||||
```
|
|
||||||
|
|
||||||
## Restart and test
|
## Restart and test
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -12,7 +12,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
|
||||||
<StepListReceive currentStep={5} />
|
<StepListReceive currentStep={5} />
|
||||||
|
|
||||||
Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review
|
Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review
|
||||||
the [slideshow](/ispmail-trixie/big-picture/) from earlier in this guide.
|
the [slideshow](/ispmail-trixie/overview/) from earlier in this guide.
|
||||||
|
|
||||||
As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even
|
As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even
|
||||||
save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main
|
save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main
|
||||||
|
|
@ -20,25 +20,29 @@ purpose is to let users fetch their email using the IMAP protocol. But it provid
|
||||||
well.
|
well.
|
||||||
|
|
||||||
So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will
|
So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will
|
||||||
happen using LMTP – the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
|
happens using LMTP – the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
|
||||||
LMTP is a variant of SMTP with fewer features. It is meant for email communication between internal services that trust
|
LMTP is a lightweight variant of SMTP. It is meant for email communication between internal services that trust each
|
||||||
each other.
|
other.
|
||||||
|
|
||||||
## Dovecot listens to LMTP
|
## Dovecot listens to LMTP
|
||||||
|
|
||||||
Edit the `/etc/dovecot/conf.d/10-master.conf` file and change the section called `service lmtp`:
|
First we need to add a UNIX socket where Dovecot listens for incoming LMTP connections:
|
||||||
|
|
||||||
```
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF
|
||||||
service lmtp {
|
service lmtp {
|
||||||
|
# Used internally by Dovecot
|
||||||
unix_listener lmtp {
|
unix_listener lmtp {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Listen to LMTP connections from Postfix
|
||||||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||||||
mode = 0600
|
mode = 0600
|
||||||
user = postfix
|
user = postfix
|
||||||
group = postfix
|
group = postfix
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
|
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
|
||||||
|
|
@ -60,11 +64,7 @@ postconf virtual_transport=lmtp:unix:private/dovecot-lmtp
|
||||||
|
|
||||||
The syntax looks crazy, but it’s actually simple. You just told Postfix to use the LMTP protocol. And that we want to
|
The syntax looks crazy, but it’s actually simple. You just told Postfix to use the LMTP protocol. And that we want to
|
||||||
use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at
|
use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at
|
||||||
`/var/run/dovecot/lmtp`.
|
`/var/spool/postfix/private/dovecot-lmtp` – because `/var/spool/postfix` is the Postfix's home directory.
|
||||||
|
|
||||||
## Enable server-side mail rules
|
|
||||||
|
|
||||||
TODO: move to optional chapter
|
|
||||||
|
|
||||||
## Send a test mail locally
|
## Send a test mail locally
|
||||||
|
|
||||||
|
|
@ -168,8 +168,5 @@ track of the mailbox. You can safely ignore them.
|
||||||
## Your actual domain
|
## Your actual domain
|
||||||
|
|
||||||
Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add
|
Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add
|
||||||
your own domain to the database and create a test user. Check the
|
your own domain to the database and create a test user. The later
|
||||||
[section where we created this text user](/ispmail-trixie/database/#example-data-to-play-with) and use it to add your
|
[section on managing users](/ispmail-trixie/managing-users-aliases-and-domains/) will explain that in detail.
|
||||||
own account.
|
|
||||||
|
|
||||||
TODO: link to "managing domains and users" later
|
|
||||||
|
|
|
||||||
|
|
@ -74,7 +74,7 @@ Please replace `mail.example.org` by the FQDN you chose.
|
||||||
|
|
||||||
Set this:
|
Set this:
|
||||||
|
|
||||||
```
|
```text title="Edit /etc/apache2/sites-available/000-default-le-ssl.conf"
|
||||||
ServerName mail.example.org
|
ServerName mail.example.org
|
||||||
DocumentRoot /var/lib/roundcube/public_html
|
DocumentRoot /var/lib/roundcube/public_html
|
||||||
Include /etc/roundcube/apache.conf
|
Include /etc/roundcube/apache.conf
|
||||||
|
|
@ -88,17 +88,17 @@ Meaning:
|
||||||
|
|
||||||
And as usual Apache needs to be restarted after the configuration change:
|
And as usual Apache needs to be restarted after the configuration change:
|
||||||
|
|
||||||
```
|
```sh
|
||||||
systemctl restart apache2
|
systemctl restart apache2
|
||||||
```
|
```
|
||||||
|
|
||||||
Check that Apache is running properly:
|
Check that Apache is running properly:
|
||||||
|
|
||||||
```
|
```sh
|
||||||
systemctl status apache2
|
systemctl status apache2
|
||||||
```
|
```
|
||||||
|
|
||||||
In case of a problem run “`apache2ctl configtest`" to find the cause.
|
In case of a problem run `apache2ctl configtest` to find the cause.
|
||||||
|
|
||||||
## Limit access to localhost
|
## Limit access to localhost
|
||||||
|
|
||||||
|
|
@ -112,19 +112,19 @@ Please replace `mail.example.org` by the FQDN you chose.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
```
|
```text title="Edit /etc/roundcube/config.inc.php"
|
||||||
$config['imap_host'] = 'tls://mail.example.org:143';
|
$config['imap_host'] = 'tls://mail.example.org:143';
|
||||||
$config['smtp_host'] = 'tls://mail.example.org:587';
|
$config['smtp_host'] = 'tls://mail.example.org:587';
|
||||||
```
|
```
|
||||||
|
|
||||||
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
|
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
|
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
|
||||||
email address as the user name. E.g. `john@example.org` and password `summersun`.
|
email address as the user name. E.g. `john@example.org` and password `summersun`.
|
||||||
|
|
||||||
TODO: show login dialog
|
If the login fails, check `/var/log/roundcube/errors.log`.
|
||||||
|
|
||||||
TODO: on errors, check /var/log/roundcube/errors.log
|
|
||||||
|
|
||||||
## Plugins
|
## Plugins
|
||||||
|
|
||||||
|
|
@ -167,15 +167,15 @@ Let’s briefly cover the meaning of those lines:
|
||||||
- `$config['password_minimum_length'] = 12;`\
|
- `$config['password_minimum_length'] = 12;`\
|
||||||
New passwords must be at least 12 characters long.
|
New passwords must be at least 12 characters long.
|
||||||
- `$config['password_force_save'] = true;`\
|
- `$config['password_force_save'] = true;`\
|
||||||
This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the password
|
This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the
|
||||||
hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
|
password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
|
||||||
- `$config['password_algorithm'] = 'blowfish-crypt';`\
|
- `$config['password_algorithm'] = 'blowfish-crypt';`\
|
||||||
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
|
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
|
||||||
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
|
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
|
||||||
Prepend every password with this string so that Dovecot knows how we encrypted the password.
|
Prepend every password with this string so that Dovecot knows how we encrypted the password.
|
||||||
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
|
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
|
||||||
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We cannot
|
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
|
||||||
use the restricted _mailserver_ user because we have to write the new password to the database.
|
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
|
||||||
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
|
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
|
||||||
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
|
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
|
||||||
hash. `%u` is the logged-in user and conveniently matches the email address.
|
hash. `%u` is the logged-in user and conveniently matches the email address.
|
||||||
|
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 69 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB After Width: | Height: | Size: 12 KiB |
Loading…
Add table
Add a link
Reference in a new issue