various changes before release
This commit is contained in:
parent
46f4775ee2
commit
582d98f7ee
6 changed files with 76 additions and 69 deletions
|
|
@ -41,12 +41,12 @@ for our purpose.
|
|||
### 10-auth.conf
|
||||
|
||||
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
|
||||
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
|
||||
want to use the MariaDB database backend so go ahead and **change this block** to:
|
||||
of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But
|
||||
we want to use the MariaDB database backend. Please comment all all include statements:
|
||||
|
||||
```
|
||||
```text title="Edit your /etc/dovecot/conf.d/10-auth.conf"
|
||||
#!include auth-system.conf.ext
|
||||
!include auth-sql.conf.ext
|
||||
#!include auth-sql.conf.ext
|
||||
#!include auth-ldap.conf.ext
|
||||
#!include auth-passwdfile.conf.ext
|
||||
#!include auth-checkpassword.conf.ext
|
||||
|
|
@ -55,17 +55,21 @@ want to use the MariaDB database backend so go ahead and **change this block** t
|
|||
|
||||
Every line starting with `#` is disabled. Only lines starting with `!` are considered.
|
||||
|
||||
### 10-mail.conf
|
||||
### 10-mail.conf / 99-ispmail-mail.conf
|
||||
|
||||
Edit this file at `/etc/dovecot/conf.d/10-mail.conf`. It contains many settings regarding mailboxes, like where they are
|
||||
located, who owns them and what is their layout? Set this:
|
||||
The file at `/etc/dovecot/conf.d/10-mail.conf` contains many settings regarding mailboxes, like where they are located,
|
||||
who owns them and what is their layout? Create a new file `/etc/dovecot/conf.d/99-ispmail-mail.conf` that overrides
|
||||
these defaults:
|
||||
|
||||
```
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-mail.conf << EOF
|
||||
mail_driver = maildir
|
||||
mail_home = /var/vmail/%{user | domain}/%{user | username}
|
||||
mail_path = ~/Maildir
|
||||
mail_uid = vmail
|
||||
mail_gid = vmail
|
||||
mail_inbox_path =
|
||||
EOF
|
||||
```
|
||||
|
||||
This looks more sophisticated than with versions of Dovecot before 2.4. What it means:
|
||||
|
|
@ -78,33 +82,37 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
|
|||
- **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason
|
||||
is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox
|
||||
directory.
|
||||
- **mail_uid**/**mail_gid**/: All mailboxes are stored on disk under the owner _vmail_.
|
||||
- **mail_uid**/**mail_gid**: All mailboxes will be owned be the user and group `vmail`.
|
||||
- **mail_inbox_path**: We just un-set this because it would conflict with the _mail_path_ that is set in `10-mail.conf`
|
||||
|
||||
### 10-master.conf
|
||||
### 10-master.conf / 99-ispmail-master.conf
|
||||
|
||||
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
|
||||
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's _services_. A _service_ is a part
|
||||
of Dovecot that listens on a TCP port or a UNIX socket so that other parts of your system can use it. We want Postfix to
|
||||
use Dovecot for authentication. So we need to change the `service auth` section:
|
||||
|
||||
So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
|
||||
section because we want Postfix to allow Dovecot as an authentication service. Make it look like this:
|
||||
|
||||
```
|
||||
# Postfix smtp-auth
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-master.conf << EOF
|
||||
service auth {
|
||||
unix_listener /var/spool/postfix/private/dovecot-auth {
|
||||
mode = 0660
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix
|
||||
to authenticate your users which is relevant later when we set up _relaying_.
|
||||
|
||||
### 10-ssl.conf
|
||||
### 10-ssl.conf / 99-ispmail-ssl.conf
|
||||
|
||||
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
|
||||
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
|
||||
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
||||
that someone sends their password without encryption.
|
||||
that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to
|
||||
override the defaults.
|
||||
|
||||
<Aside type="danger" title="Important">
|
||||
|
||||
|
|
@ -112,30 +120,34 @@ Please replace `mail.example.org` by the FQDN you chose.
|
|||
|
||||
</Aside>
|
||||
|
||||
```
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-ssl.conf << EOF
|
||||
ssl = required
|
||||
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
|
||||
ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem
|
||||
EOF
|
||||
```
|
||||
|
||||
### 20-lmtp.conf
|
||||
### 20-lmtp.conf / 99-ispmail-lmtp.conf
|
||||
|
||||
There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our
|
||||
setup. So please edit this file and comment out the `auth_username_format` line:
|
||||
setup: `auth_username_format`. So let's override it:
|
||||
|
||||
```
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-username-format.conf << EOF
|
||||
protocol lmtp {
|
||||
#auth_username_format = %{user | username}
|
||||
auth_username_format =
|
||||
}
|
||||
|
||||
EOF
|
||||
```
|
||||
|
||||
### auth-sql.conf.ext
|
||||
### 99-ispmail-sql.conf
|
||||
|
||||
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). You can safely
|
||||
replace the content of the `/etc/dovecot/conf.d/auth-sql.conf.ext` file by:
|
||||
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). There are
|
||||
suggestions in the `auth-sql.conf.ext` file but we will add our own file:
|
||||
|
||||
```
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-sql.conf << EOF
|
||||
sql_driver = mysql
|
||||
|
||||
mysql /var/run/mysqld/mysqld.sock {
|
||||
|
|
@ -153,18 +165,16 @@ userdb sql {
|
|||
passdb sql {
|
||||
query = SELECT password FROM virtual_users where email='%{user}'
|
||||
}
|
||||
EOF
|
||||
|
||||
# fix permissions
|
||||
chown root:root /etc/dovecot/conf.d/99-ispmail-sql.conf
|
||||
chmod go= /etc/dovecot/conf.d/99-ispmail-sql.conf
|
||||
```
|
||||
|
||||
Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
|
||||
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) and the user-ID and group-ID are always `vmail` and
|
||||
`vmail`.
|
||||
|
||||
Make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
|
||||
|
||||
```sh title="Run this on your server"
|
||||
chown root:root /etc/dovecot/conf.d/auth-sql.conf.ext
|
||||
chmod go= /etc/dovecot/conf.d/auth-sql.conf.ext
|
||||
```
|
||||
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
|
||||
always `vmail` and `vmail`.
|
||||
|
||||
## Restart and test
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
|
|||
<StepListReceive currentStep={5} />
|
||||
|
||||
Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review
|
||||
the [slideshow](/ispmail-trixie/big-picture/) from earlier in this guide.
|
||||
the [slideshow](/ispmail-trixie/overview/) from earlier in this guide.
|
||||
|
||||
As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even
|
||||
save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main
|
||||
|
|
@ -20,25 +20,29 @@ purpose is to let users fetch their email using the IMAP protocol. But it provid
|
|||
well.
|
||||
|
||||
So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will
|
||||
happen using LMTP – the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
|
||||
LMTP is a variant of SMTP with fewer features. It is meant for email communication between internal services that trust
|
||||
each other.
|
||||
happens using LMTP – the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
|
||||
LMTP is a lightweight variant of SMTP. It is meant for email communication between internal services that trust each
|
||||
other.
|
||||
|
||||
## Dovecot listens to LMTP
|
||||
|
||||
Edit the `/etc/dovecot/conf.d/10-master.conf` file and change the section called `service lmtp`:
|
||||
First we need to add a UNIX socket where Dovecot listens for incoming LMTP connections:
|
||||
|
||||
```
|
||||
```sh title="Run this on your server"
|
||||
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF
|
||||
service lmtp {
|
||||
# Used internally by Dovecot
|
||||
unix_listener lmtp {
|
||||
}
|
||||
|
||||
# Listen to LMTP connections from Postfix
|
||||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||||
mode = 0600
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
|
||||
|
|
@ -60,11 +64,7 @@ postconf virtual_transport=lmtp:unix:private/dovecot-lmtp
|
|||
|
||||
The syntax looks crazy, but it’s actually simple. You just told Postfix to use the LMTP protocol. And that we want to
|
||||
use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at
|
||||
`/var/run/dovecot/lmtp`.
|
||||
|
||||
## Enable server-side mail rules
|
||||
|
||||
TODO: move to optional chapter
|
||||
`/var/spool/postfix/private/dovecot-lmtp` – because `/var/spool/postfix` is the Postfix's home directory.
|
||||
|
||||
## Send a test mail locally
|
||||
|
||||
|
|
@ -168,8 +168,5 @@ track of the mailbox. You can safely ignore them.
|
|||
## Your actual domain
|
||||
|
||||
Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add
|
||||
your own domain to the database and create a test user. Check the
|
||||
[section where we created this text user](/ispmail-trixie/database/#example-data-to-play-with) and use it to add your
|
||||
own account.
|
||||
|
||||
TODO: link to "managing domains and users" later
|
||||
your own domain to the database and create a test user. The later
|
||||
[section on managing users](/ispmail-trixie/managing-users-aliases-and-domains/) will explain that in detail.
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ Please replace `mail.example.org` by the FQDN you chose.
|
|||
|
||||
Set this:
|
||||
|
||||
```
|
||||
```text title="Edit /etc/apache2/sites-available/000-default-le-ssl.conf"
|
||||
ServerName mail.example.org
|
||||
DocumentRoot /var/lib/roundcube/public_html
|
||||
Include /etc/roundcube/apache.conf
|
||||
|
|
@ -88,17 +88,17 @@ Meaning:
|
|||
|
||||
And as usual Apache needs to be restarted after the configuration change:
|
||||
|
||||
```
|
||||
```sh
|
||||
systemctl restart apache2
|
||||
```
|
||||
|
||||
Check that Apache is running properly:
|
||||
|
||||
```
|
||||
```sh
|
||||
systemctl status apache2
|
||||
```
|
||||
|
||||
In case of a problem run “`apache2ctl configtest`" to find the cause.
|
||||
In case of a problem run `apache2ctl configtest` to find the cause.
|
||||
|
||||
## Limit access to localhost
|
||||
|
||||
|
|
@ -112,19 +112,19 @@ Please replace `mail.example.org` by the FQDN you chose.
|
|||
|
||||
</Aside>
|
||||
|
||||
```
|
||||
```text title="Edit /etc/roundcube/config.inc.php"
|
||||
$config['imap_host'] = 'tls://mail.example.org:143';
|
||||
$config['smtp_host'] = 'tls://mail.example.org:587';
|
||||
```
|
||||
|
||||
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
|
||||
|
||||

|
||||
|
||||
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
|
||||
email address as the user name. E.g. `john@example.org` and password `summersun`.
|
||||
|
||||
TODO: show login dialog
|
||||
|
||||
TODO: on errors, check /var/log/roundcube/errors.log
|
||||
If the login fails, check `/var/log/roundcube/errors.log`.
|
||||
|
||||
## Plugins
|
||||
|
||||
|
|
@ -167,15 +167,15 @@ Let’s briefly cover the meaning of those lines:
|
|||
- `$config['password_minimum_length'] = 12;`\
|
||||
New passwords must be at least 12 characters long.
|
||||
- `$config['password_force_save'] = true;`\
|
||||
This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the password
|
||||
hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
|
||||
This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the
|
||||
password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
|
||||
- `$config['password_algorithm'] = 'blowfish-crypt';`\
|
||||
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
|
||||
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
|
||||
Prepend every password with this string so that Dovecot knows how we encrypted the password.
|
||||
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
|
||||
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We cannot
|
||||
use the restricted _mailserver_ user because we have to write the new password to the database.
|
||||
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
|
||||
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
|
||||
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
|
||||
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
|
||||
hash. `%u` is the logged-in user and conveniently matches the email address.
|
||||
|
|
|
|||
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 69 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB After Width: | Height: | Size: 12 KiB |
Loading…
Add table
Add a link
Reference in a new issue