various changes before release

This commit is contained in:
Christoph Haas 2025-10-31 19:09:17 +01:00
parent 46f4775ee2
commit 582d98f7ee
6 changed files with 76 additions and 69 deletions

View file

@ -41,12 +41,12 @@ for our purpose.
### 10-auth.conf
The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list
of authentication backends that Dovecot ships with. By default it will use system users (those from /etc/passwd). But we
want to use the MariaDB database backend so go ahead and **change this block** to:
of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But
we want to use the MariaDB database backend. Please comment all all include statements:
```
```text title="Edit your /etc/dovecot/conf.d/10-auth.conf"
#!include auth-system.conf.ext
!include auth-sql.conf.ext
#!include auth-sql.conf.ext
#!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
@ -55,17 +55,21 @@ want to use the MariaDB database backend so go ahead and **change this block** t
Every line starting with `#` is disabled. Only lines starting with `!` are considered.
### 10-mail.conf
### 10-mail.conf / 99-ispmail-mail.conf
Edit this file at `/etc/dovecot/conf.d/10-mail.conf`. It contains many settings regarding mailboxes, like where they are
located, who owns them and what is their layout? Set this:
The file at `/etc/dovecot/conf.d/10-mail.conf` contains many settings regarding mailboxes, like where they are located,
who owns them and what is their layout? Create a new file `/etc/dovecot/conf.d/99-ispmail-mail.conf` that overrides
these defaults:
```
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-mail.conf << EOF
mail_driver = maildir
mail_home = /var/vmail/%{user | domain}/%{user | username}
mail_path = ~/Maildir
mail_uid = vmail
mail_gid = vmail
mail_inbox_path =
EOF
```
This looks more sophisticated than with versions of Dovecot before 2.4. What it means:
@ -78,33 +82,37 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
- **mail_path**: Within the _home_ directory the actual mailbox will live in a subdirectory called `Maildir`. The reason
is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox
directory.
- **mail_uid**/**mail_gid**/: All mailboxes are stored on disk under the owner _vmail_.
- **mail_uid**/**mail_gid**: All mailboxes will be owned be the user and group `vmail`.
- **mail_inbox_path**: We just un-set this because it would conflict with the _mail_path_ that is set in `10-mail.conf`
### 10-master.conf
### 10-master.conf / 99-ispmail-master.conf
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's _services_. A _service_ is a part
of Dovecot that listens on a TCP port or a UNIX socket so that other parts of your system can use it. We want Postfix to
use Dovecot for authentication. So we need to change the `service auth` section:
So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
section because we want Postfix to allow Dovecot as an authentication service. Make it look like this:
```
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/dovecot-auth {
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-master.conf << EOF
service auth {
unix_listener /var/spool/postfix/private/dovecot-auth {
mode = 0660
user = postfix
group = postfix
}
}
EOF
```
That way Dovecot will put a communication socket into `/var/spool/postfix/private/dovecot-auth`. It will allow Postfix
to authenticate your users which is relevant later when we set up _relaying_.
### 10-ssl.conf
### 10-ssl.conf / 99-ispmail-ssl.conf
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
that someone sends their password without encryption.
that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to
override the defaults.
<Aside type="danger" title="Important">
@ -112,30 +120,34 @@ Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-ssl.conf << EOF
ssl = required
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
ssl_server_key_file = /etc/letsencrypt/live/mail.example.org/privkey.pem
EOF
```
### 20-lmtp.conf
### 20-lmtp.conf / 99-ispmail-lmtp.conf
There is one setting in the `/etc/dovecot/conf.d/20-lmtp.conf` that will mess up the recipient's email address in our
setup. So please edit this file and comment out the `auth_username_format` line:
setup: `auth_username_format`. So let's override it:
```
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-username-format.conf << EOF
protocol lmtp {
#auth_username_format = %{user | username}
auth_username_format =
}
EOF
```
### auth-sql.conf.ext
### 99-ispmail-sql.conf
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). You can safely
replace the content of the `/etc/dovecot/conf.d/auth-sql.conf.ext` file by:
Let's tell Dovecot where to find information on an valid users (_userdb_) and their passwords (_passdb_). There are
suggestions in the `auth-sql.conf.ext` file but we will add our own file:
```
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-sql.conf << EOF
sql_driver = mysql
mysql /var/run/mysqld/mysqld.sock {
@ -153,18 +165,16 @@ userdb sql {
passdb sql {
query = SELECT password FROM virtual_users where email='%{user}'
}
EOF
# fix permissions
chown root:root /etc/dovecot/conf.d/99-ispmail-sql.conf
chmod go= /etc/dovecot/conf.d/99-ispmail-sql.conf
```
Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) and the user-ID and group-ID are always `vmail` and
`vmail`.
Make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
```sh title="Run this on your server"
chown root:root /etc/dovecot/conf.d/auth-sql.conf.ext
chmod go= /etc/dovecot/conf.d/auth-sql.conf.ext
```
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
always `vmail` and `vmail`.
## Restart and test

View file

@ -12,7 +12,7 @@ import StepListReceive from "../../../components/StepListReceive.astro";
<StepListReceive currentStep={5} />
Glad to see that you are still with me. We are very close to receiving our first email. If you feel lost, please review
the [slideshow](/ispmail-trixie/big-picture/) from earlier in this guide.
the [slideshow](/ispmail-trixie/overview/) from earlier in this guide.
As explained in the previous section, Postfix speaks SMTP and receives the email from the internet. Postfix could even
save the email to a mailbox on disk. But instead we will use Dovecot for the final delivery. Actually Dovecot's main
@ -20,25 +20,29 @@ purpose is to let users fetch their email using the IMAP protocol. But it provid
well.
So we need tell Postfix to hand over the incoming email to Dovecot. The communication between Postfix and Dovecot will
happen using LMTP the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
LMTP is a variant of SMTP with fewer features. It is meant for email communication between internal services that trust
each other.
happens using LMTP the [local mail transfer protocol](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol).
LMTP is a lightweight variant of SMTP. It is meant for email communication between internal services that trust each
other.
## Dovecot listens to LMTP
Edit the `/etc/dovecot/conf.d/10-master.conf` file and change the section called `service lmtp`:
First we need to add a UNIX socket where Dovecot listens for incoming LMTP connections:
```
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF
service lmtp {
# Used internally by Dovecot
unix_listener lmtp {
}
# Listen to LMTP connections from Postfix
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
}
EOF
```
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
@ -60,11 +64,7 @@ postconf virtual_transport=lmtp:unix:private/dovecot-lmtp
The syntax looks crazy, but its actually simple. You just told Postfix to use the LMTP protocol. And that we want to
use a UNIX socket on the same system (instead of a TCP connection). And the socket file is located at
`/var/run/dovecot/lmtp`.
## Enable server-side mail rules
TODO: move to optional chapter
`/var/spool/postfix/private/dovecot-lmtp` because `/var/spool/postfix` is the Postfix's home directory.
## Send a test mail locally
@ -168,8 +168,5 @@ track of the mailbox. You can safely ignore them.
## Your actual domain
Obviously the previous examples dealt with the `example.org` domain which is not your actual domain. Feel free to add
your own domain to the database and create a test user. Check the
[section where we created this text user](/ispmail-trixie/database/#example-data-to-play-with) and use it to add your
own account.
TODO: link to "managing domains and users" later
your own domain to the database and create a test user. The later
[section on managing users](/ispmail-trixie/managing-users-aliases-and-domains/) will explain that in detail.

View file

@ -74,7 +74,7 @@ Please replace `mail.example.org` by the FQDN you chose.
Set this:
```
```text title="Edit /etc/apache2/sites-available/000-default-le-ssl.conf"
ServerName mail.example.org
DocumentRoot /var/lib/roundcube/public_html
Include /etc/roundcube/apache.conf
@ -88,17 +88,17 @@ Meaning:
And as usual Apache needs to be restarted after the configuration change:
```
```sh
systemctl restart apache2
```
Check that Apache is running properly:
```
```sh
systemctl status apache2
```
In case of a problem run `apache2ctl configtest`" to find the cause.
In case of a problem run `apache2ctl configtest` to find the cause.
## Limit access to localhost
@ -112,19 +112,19 @@ Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```
```text title="Edit /etc/roundcube/config.inc.php"
$config['imap_host'] = 'tls://mail.example.org:143';
$config['smtp_host'] = 'tls://mail.example.org:587';
```
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
![Roundcube login dialog](images/roundcube-login.png)
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
email address as the user name. E.g. `john@example.org` and password `summersun`.
TODO: show login dialog
TODO: on errors, check /var/log/roundcube/errors.log
If the login fails, check `/var/log/roundcube/errors.log`.
## Plugins
@ -167,15 +167,15 @@ Lets briefly cover the meaning of those lines:
- `$config['password_minimum_length'] = 12;`\
New passwords must be at least 12 characters long.
- `$config['password_force_save'] = true;`\
This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the password
hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the
password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
- `$config['password_algorithm'] = 'blowfish-crypt';`\
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
Prepend every password with this string so that Dovecot knows how we encrypted the password.
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We cannot
use the restricted _mailserver_ user because we have to write the new password to the database.
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
hash. `%u` is the logged-in user and conveniently matches the email address.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 48 KiB

After

Width:  |  Height:  |  Size: 69 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 11 KiB

After

Width:  |  Height:  |  Size: 12 KiB

Before After
Before After