various changes before release

This commit is contained in:
Christoph Haas 2025-10-31 19:09:17 +01:00
parent 46f4775ee2
commit 582d98f7ee
6 changed files with 76 additions and 69 deletions

View file

@ -41,12 +41,12 @@ for our purpose.
### 10-auth.conf ### 10-auth.conf
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But
want to use the MariaDB database backend so go ahead and **change this block** to: we want to use the MariaDB database backend. Please comment all all include statements:
``` ```text title="Edit your /etc/dovecot/conf.d/10-auth.conf"
#!include auth-system.conf.ext #!include auth-system.conf.ext
!include auth-sql.conf.ext #!include auth-sql.conf.ext
#!include auth-ldap.conf.ext #!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext #!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext #!include auth-checkpassword.conf.ext
@ -55,17 +55,21 @@ want to use the MariaDB database backend so go ahead and **change this block** t
Every line starting with `#` is disabled. Only lines starting with `!` are considered. Every line starting with `#` is disabled. Only lines starting with `!` are considered.
### 10-mail.conf ### 10-mail.conf / 99-ispmail-mail.conf
Edit this file at `/etc/dovecot/conf.d/10-mail.conf`. It contains many settings regarding mailboxes, like where they are The file at `/etc/dovecot/conf.d/10-mail.conf` contains many settings regarding mailboxes, like where they are located,
located, who owns them and what is their layout? Set this: who owns them and what is their layout? Create a new file `/etc/dovecot/conf.d/99-ispmail-mail.conf` that overrides
these defaults:
``` ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-mail.conf << EOF
mail_driver = maildir mail_driver = maildir
mail_home = /var/vmail/%{user | domain}/%{user | username} mail_home = /var/vmail/%{user | domain}/%{user | username}
mail_path = ~/Maildir mail_path = ~/Maildir
mail_uid = vmail mail_uid = vmail
mail_gid = vmail mail_gid = vmail
mail_inbox_path =
EOF
``` ```
This looks more sophisticated than with versions of Dovecot before 2.4. What it means: This looks more sophisticated than with versions of Dovecot before 2.4. What it means:
@ -78,33 +82,37 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
- **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason - **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason
is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox
directory. directory.
- **mail_uid**/**mail_gid**/: All mailboxes are stored on disk under the owner _vmail_. - **mail_uid**/**mail_gid**: All mailboxes will be owned be the user and group `vmail`.
- **mail_inbox_path**: We just un-set this because it would conflict with the _mail_path_ that is set in `10-mail.conf`
### 10-master.conf ### 10-master.conf / 99-ispmail-master.conf
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services. This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's _services_. A _service_ is a part
of Dovecot that listens on a TCP port or a UNIX socket so that other parts of your system can use it. We want Postfix to
use Dovecot for authentication. So we need to change the `service auth` section:
So most settings are sane here and do not have to be changed. However one change is required in the “service auth" ```sh title="Run this on your server"
section because we want Postfix to allow Dovecot as an authentication service. Make it look like this: cat > /etc/dovecot/conf.d/99-ispmail-master.conf << EOF
service auth {
``` unix_listener /var/spool/postfix/private/dovecot-auth {
# Postfix smtp-auth mode = 0660
unix_listener /var/spool/postfix/private/dovecot-auth { user = postfix
mode = 0660 group = postfix
user = postfix }
group = postfix
} }
EOF
``` ```
That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix
to authenticate your users which is relevant later when we set up _relaying_. to authenticate your users which is relevant later when we set up _relaying_.
### 10-ssl.conf ### 10-ssl.conf / 99-ispmail-ssl.conf
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
between the users and your mail server. You need to tell Dovecot where to find these files. Also set between the users and your mail server. You need to tell Dovecot where to find these files. Also set
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
that someone sends their password without encryption. that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to
override the defaults.
<Aside type="danger" title="Important"> <Aside type="danger" title="Important">
@ -112,30 +120,34 @@ Please replace `mail.example.org` by the FQDN you chose.
</Aside> </Aside>
``` ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-ssl.conf << EOF
ssl = required ssl = required
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem
EOF
``` ```
### 20-lmtp.conf ### 20-lmtp.conf / 99-ispmail-lmtp.conf
There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our
setup. So please edit this file and comment out the `auth_username_format` line: setup: `auth_username_format`. So let's override it:
``` ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-username-format.conf << EOF
protocol lmtp { protocol lmtp {
#auth_username_format = %{user | username} auth_username_format =
} }
EOF
``` ```
### auth-sql.conf.ext ### 99-ispmail-sql.conf
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). You can safely Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). There are
replace the content of the `/etc/dovecot/conf.d/auth-sql.conf.ext` file by: suggestions in the `auth-sql.conf.ext` file but we will add our own file:
``` ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-sql.conf << EOF
sql_driver = mysql sql_driver = mysql
mysql /var/run/mysqld/mysqld.sock { mysql /var/run/mysqld/mysqld.sock {
@ -153,18 +165,16 @@ userdb sql {
passdb sql { passdb sql {
query = SELECT password FROM virtual_users where email='%{user}' query = SELECT password FROM virtual_users where email='%{user}'
} }
EOF
# fix permissions
chown root:root /etc/dovecot/conf.d/99-ispmail-sql.conf
chmod go= /etc/dovecot/conf.d/99-ispmail-sql.conf
``` ```
Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) and the user-ID and group-ID are always `vmail` and a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
`vmail`. always `vmail` and `vmail`.
Make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
```sh title="Run this on your server"
chown root:root /etc/dovecot/conf.d/auth-sql.conf.ext
chmod go= /etc/dovecot/conf.d/auth-sql.conf.ext
```
## Restart and test ## Restart and test

View file

@ -12,7 +12,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
<StepListReceive currentStep={5} /> <StepListReceive currentStep={5} />
Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review
the [slideshow](/ispmail-trixie/big-picture/) from earlier in this guide. the [slideshow](/ispmail-trixie/overview/) from earlier in this guide.
As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even
save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main
@ -20,25 +20,29 @@ purpose is to let users fetch their email using the IMAP protocol. But it provid
well. well.
So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will
happen using LMTP the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol). happens using LMTP the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
LMTP is a variant of SMTP with fewer features. It is meant for email communication between internal services that trust LMTP is a lightweight variant of SMTP. It is meant for email communication between internal services that trust each
each other. other.
## Dovecot listens to LMTP ## Dovecot listens to LMTP
Edit the `/etc/dovecot/conf.d/10-master.conf` file and change the section called `service lmtp`: First we need to add a UNIX socket where Dovecot listens for incoming LMTP connections:
``` ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF
service lmtp { service lmtp {
# Used internally by Dovecot
unix_listener lmtp { unix_listener lmtp {
} }
# Listen to LMTP connections from Postfix
unix_listener /var/spool/postfix/private/dovecot-lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600 mode = 0600
user = postfix user = postfix
group = postfix group = postfix
} }
} }
EOF
``` ```
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
@ -60,11 +64,7 @@ postconf virtual_transport=lmtp:unix:private/dovecot-lmtp
The syntax looks crazy, but its actually simple. You just told Postfix to use the LMTP protocol. And that we want to The syntax looks crazy, but its actually simple. You just told Postfix to use the LMTP protocol. And that we want to
use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at
`/var/run/dovecot/lmtp`. `/var/spool/postfix/private/dovecot-lmtp` because `/var/spool/postfix` is the Postfix's home directory.
## Enable server-side mail rules
TODO: move to optional chapter
## Send a test mail locally ## Send a test mail locally
@ -168,8 +168,5 @@ track of the mailbox. You can safely ignore them.
## Your actual domain ## Your actual domain
Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add
your own domain to the database and create a test user. Check the your own domain to the database and create a test user. The later
[section where we created this text user](/ispmail-trixie/database/#example-data-to-play-with) and use it to add your [section on managing users](/ispmail-trixie/managing-users-aliases-and-domains/) will explain that in detail.
own account.
TODO: link to "managing domains and users" later

View file

@ -74,7 +74,7 @@ Please replace `mail.example.org` by the FQDN you chose.
Set this: Set this:
``` ```text title="Edit /etc/apache2/sites-available/000-default-le-ssl.conf"
ServerName mail.example.org ServerName mail.example.org
DocumentRoot /var/lib/roundcube/public_html DocumentRoot /var/lib/roundcube/public_html
Include /etc/roundcube/apache.conf Include /etc/roundcube/apache.conf
@ -88,17 +88,17 @@ Meaning:
And as usual Apache needs to be restarted after the configuration change: And as usual Apache needs to be restarted after the configuration change:
``` ```sh
systemctl restart apache2 systemctl restart apache2
``` ```
Check that Apache is running properly: Check that Apache is running properly:
``` ```sh
systemctl status apache2 systemctl status apache2
``` ```
In case of a problem run `apache2ctl configtest`" to find the cause. In case of a problem run `apache2ctl configtest` to find the cause.
## Limit access to localhost ## Limit access to localhost
@ -112,19 +112,19 @@ Please replace `mail.example.org` by the FQDN you chose.
</Aside> </Aside>
``` ```text title="Edit /etc/roundcube/config.inc.php"
$config['imap_host'] = 'tls://mail.example.org:143'; $config['imap_host'] = 'tls://mail.example.org:143';
$config['smtp_host'] = 'tls://mail.example.org:587'; $config['smtp_host'] = 'tls://mail.example.org:587';
``` ```
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form: So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
![Roundcube login dialog](images/roundcube-login.png)
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
email address as the user name. E.g. `john@example.org` and password `summersun`. email address as the user name. E.g. `john@example.org` and password `summersun`.
TODO: show login dialog If the login fails, check `/var/log/roundcube/errors.log`.
TODO: on errors, check /var/log/roundcube/errors.log
## Plugins ## Plugins
@ -167,15 +167,15 @@ Lets briefly cover the meaning of those lines:
- `$config['password_minimum_length'] = 12;`\ - `$config['password_minimum_length'] = 12;`\
New passwords must be at least 12 characters long. New passwords must be at least 12 characters long.
- `$config['password_force_save'] = true;`\ - `$config['password_force_save'] = true;`\
This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the password This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the
hash by re-encoding it with a better algorithm even if the user chooses to keep his old password. password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
- `$config['password_algorithm'] = 'blowfish-crypt';`\ - `$config['password_algorithm'] = 'blowfish-crypt';`\
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot. The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\ - `$config['password_algorithm_prefix'] = '{CRYPT}';`\
Prepend every password with this string so that Dovecot knows how we encrypted the password. Prepend every password with this string so that Dovecot knows how we encrypted the password.
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\ - `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We cannot Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
use the restricted _mailserver_ user because we have to write the new password to the database. cannot use the restricted _mailserver_ user because we have to write the new password to the database.
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\ - `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
hash. `%u` is the logged-in user and conveniently matches the email address. hash. `%u` is the logged-in user and conveniently matches the email address.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 48 KiB

After

Width:  |  Height:  |  Size: 69 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 11 KiB

After

Width:  |  Height:  |  Size: 12 KiB

Before After
Before After