reformatting. added tips.
This commit is contained in:
parent
3c390fb1e5
commit
61ac1bb2ed
7 changed files with 61 additions and 22 deletions
|
|
@ -8,9 +8,9 @@ sidebar:
|
|||
|
||||
import { Aside } from "@astrojs/starlight/components";
|
||||
|
||||
<Aside type="caution">
|
||||
This page is only relevant if you already built a mail server using the ISPmail guide for Debian Bookworm. If you are
|
||||
starting from scratch, just skip to the next page.
|
||||
<Aside type="tip">
|
||||
This page is only relevant if you already built a mail server using the previous ISPmail guide for Debian Bookworm. If
|
||||
you are starting from scratch, just skip to the next page.
|
||||
</Aside>
|
||||
|
||||
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ sidebar:
|
|||
import { Aside } from "@astrojs/starlight/components";
|
||||
import { FileTree } from "@astrojs/starlight/components";
|
||||
|
||||
<Aside type="caution">
|
||||
<Aside type="tip">
|
||||
This page is only relevant if you will install Debian yourself. If your data center has provided you with a ready
|
||||
Debian Trixie server, just skip this page.
|
||||
</Aside>
|
||||
|
|
|
|||
|
|
@ -55,13 +55,13 @@ In this section you will create the basic database `mailserver` and two users:
|
|||
| mailserver | read | Used by Postfix/Dovecot |
|
||||
| mailadmin | read/write | Used by you <br/> Used by Roundcube (for password changes) |
|
||||
|
||||
Use the _pwgen_ tool to create two random passwords for these users:
|
||||
<Aside type="note" title="About passwords">
|
||||
|
||||
```sh
|
||||
pwgen -s1 30 2
|
||||
```
|
||||
For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
|
||||
are—it will make copying and pasting the upcoming steps much easier. After you’ve confirmed everything is working
|
||||
correctly, I’ll show you how to update the passwords securely with a single command.
|
||||
|
||||
Take a note of the passwords or store them somewhere safe.
|
||||
</Aside>
|
||||
|
||||
Create the database users:
|
||||
|
||||
|
|
@ -70,7 +70,7 @@ grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'M
|
|||
grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'MAILSERVER-PASSWORD-HERE';
|
||||
```
|
||||
|
||||
<Aside type="note" title="127.0.0.1 versus localhost">
|
||||
<Aside type="tip" title="127.0.0.1 versus localhost">
|
||||
|
||||
Wait a minute. Why is there “127.0.0.1" instead of “localhost" in the second SQL command? Is that a typo? No, it’s not.
|
||||
Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ sidebar:
|
|||
---
|
||||
|
||||
import StepListReceive from "../../../components/StepListReceive.astro";
|
||||
import { Aside } from "@astrojs/starlight/components";
|
||||
|
||||
<StepListReceive currentStep={2} />
|
||||
|
||||
|
|
@ -31,7 +32,13 @@ So choose an FQDN for your mail server. For example I use `webmail.workaround.or
|
|||
## Certbot
|
||||
|
||||
You already have the `certbot` software and the `apache2` web server installed. Requesting a certificate from Let's
|
||||
Encrypt is as simple as running the next command. Please replace `mail.example.org` by the FQDN you chose.
|
||||
Encrypt is as simple as running the next command.
|
||||
|
||||
<Aside type="danger" title="Important">
|
||||
|
||||
Please replace `mail.example.org` by the FQDN you chose.
|
||||
|
||||
</Aside>
|
||||
|
||||
```sh
|
||||
certbot --apache --register-unsafely-without-email --agree-tos -d mail.example.org
|
||||
|
|
@ -96,6 +103,9 @@ In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files no
|
|||
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
|
||||
checks your certificate frequently and triggers a renewal one month before it expires.
|
||||
|
||||
<details class="collapsible">
|
||||
<summary>Click here to learn how the renewal works…</summary>
|
||||
|
||||
These commands will show you the definition and status of the timer and the renewal service:
|
||||
|
||||
```sh
|
||||
|
|
@ -116,3 +126,5 @@ echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot ap
|
|||
```
|
||||
|
||||
Perfect. You won't have to worry about the certificate again.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -82,8 +82,6 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
|
|||
|
||||
### 10-master.conf
|
||||
|
||||
TODO: not needed. /var/run/dovecot/auth-userdb is created automatically.
|
||||
|
||||
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
|
||||
|
||||
So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
|
||||
|
|
@ -108,6 +106,12 @@ between the users and your mail server. You need to tell Dovecot where to find t
|
|||
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
||||
that someone sends their password without encryption.
|
||||
|
||||
<Aside type="danger" title="Important">
|
||||
|
||||
Please replace `mail.example.org` by the FQDN you chose.
|
||||
|
||||
</Aside>
|
||||
|
||||
```
|
||||
ssl = required
|
||||
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ service lmtp {
|
|||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you
|
||||
|
|
|
|||
|
|
@ -64,7 +64,15 @@ HTTPS have been adapted already:
|
|||
- **000-default-le-ssl.conf**: This is the HTTPS virtual host.
|
||||
|
||||
So to get Apache to serve the Roundcube application you need to edit the
|
||||
`/etc/apache2/sites-available/000-default-le-ssl.conf` file and add/set:
|
||||
`/etc/apache2/sites-available/000-default-le-ssl.conf` file.
|
||||
|
||||
<Aside type="danger" title="Important">
|
||||
|
||||
Please replace `mail.example.org` by the FQDN you chose.
|
||||
|
||||
</Aside>
|
||||
|
||||
Set this:
|
||||
|
||||
```
|
||||
ServerName mail.example.org
|
||||
|
|
@ -96,10 +104,16 @@ In case of a problem run “`apache2ctl configtest`" to find the cause.
|
|||
|
||||
The main configuration file of Roundcube is located at `/etc/roundcube/config.inc.php`. Feel free to customize the file.
|
||||
Fortunately nowadays the basic settings are already as we need them. However these two settings need to be changed by
|
||||
you:
|
||||
you.
|
||||
|
||||
<Aside type="danger" title="Important">
|
||||
|
||||
Please replace `mail.example.org` by the FQDN you chose.
|
||||
|
||||
</Aside>
|
||||
|
||||
```
|
||||
$config['imap_host'] = "tls://mail.example.org:143";
|
||||
$config['imap_host'] = 'tls://mail.example.org:143';
|
||||
$config['smtp_host'] = 'tls://mail.example.org:587';
|
||||
```
|
||||
|
||||
|
|
@ -108,6 +122,10 @@ So now when your users enter `https://webmail.example.org/` in their browser the
|
|||
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
|
||||
email address as the user name. E.g. `john@example.org` and password `summersun`.
|
||||
|
||||
TODO: show login dialog
|
||||
|
||||
TODO: on errors, check /var/log/roundcube/errors.log
|
||||
|
||||
## Plugins
|
||||
|
||||
Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password**
|
||||
|
|
@ -126,7 +144,7 @@ Plugins are configured through files located in the `/etc/roundcube/plugins` dir
|
|||
password plugin:
|
||||
|
||||
```sh
|
||||
cat > /etc/roundcube/plugins/password/config.inc.php << EOF
|
||||
cat > /etc/roundcube/plugins/password/config.inc.php << 'EOF'
|
||||
<?php
|
||||
$config['password_driver'] = 'sql';
|
||||
$config['password_minimum_length'] = 12;
|
||||
|
|
@ -170,4 +188,8 @@ Try it. Log into Roundcube as `john@example.org` with password ‘summersun’.
|
|||
Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new
|
||||
password. Does it work? Great.
|
||||
|
||||
Before you get overly enthusiastic: you can't send emails from Roundcube yet.
|
||||
<Aside type="tip" title="Important">
|
||||
|
||||
Before you get overly enthusiastic: you can't send emails from Roundcube yet. We will fix that now.
|
||||
|
||||
</Aside>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue