From db13ca20d8bdde1d90e1c700c86e98d18d70adfe Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Fri, 1 Nov 2024 11:19:28 +0100 Subject: [PATCH] more content --- .../50-types-of-email-domains.mdx | 16 +- .../ispmail-bookworm/60-installing-debian.mdx | 65 ++++++ .../70-install-the-software-packages copy.mdx | 183 ++++++++++++++++ .../ispmail-bookworm/80-tls-certificates.mdx | 196 ++++++++++++++++++ src/styles/custom.css | 25 +++ 5 files changed, 477 insertions(+), 8 deletions(-) create mode 100644 src/content/docs/ispmail-bookworm/60-installing-debian.mdx create mode 100644 src/content/docs/ispmail-bookworm/70-install-the-software-packages copy.mdx create mode 100644 src/content/docs/ispmail-bookworm/80-tls-certificates.mdx diff --git a/src/content/docs/ispmail-bookworm/50-types-of-email-domains.mdx b/src/content/docs/ispmail-bookworm/50-types-of-email-domains.mdx index 22ee1d2..269c3c5 100644 --- a/src/content/docs/ispmail-bookworm/50-types-of-email-domains.mdx +++ b/src/content/docs/ispmail-bookworm/50-types-of-email-domains.mdx @@ -1,6 +1,6 @@ --- title: Types of email domains -lastUpdated: 2023-09-24 +lastUpdated: 2023-09-25 slug: ispmail-bookworm/types-of-email-domains sidebar: order: 50 @@ -104,7 +104,7 @@ Before checking if a specific email address is valid Postfix first checks if it | example.org | Kittens | | example.com | Puppies | -So there are two domains in the left column. But what is that in the right column? Kittens? Really? Well, the truth is: it doesn’t matter. It can be anything. So why is that column there at all? The reason is that _mappings_ always have two columns. Postfix wants a list of domains but it has no concepts for _lists_. So it uses this format and ignores the right column. +So there are two domains in the left column. But what is that in the right column? Kittens? Really? Well, the truth is: it doesn’t matter. It can be anything. So why is that column there at all? The reason is that _mappings_ always have two columns. Postfix wants a list of domains but it has no concepts for one-dimensional _lists_. So it uses this format and ignores the right column. Essentially these two mappings are all we need. Add a little configuration and you can already receive emails. However Postfix provides another useful feature: _aliases_. An alias is a redirection (or _forwarding_) of one email address to one or more other addresses. Possible uses: @@ -113,7 +113,7 @@ Essentially these two mappings are all we need. Add a little configuration and y - forward copies of all your emails to another address - redirect emails meant for a coworker who has left the organisation -As usual Postfix expects a mapping for aliases. Time for another example: +As usual, Postfix expects a mapping for aliases. Time for another example: | Step | Virtual email address (left) | Redirect to (right) | | :--- | :--------------------------- | :---------------------------------------- | @@ -142,12 +142,12 @@ So basically this is the way that Postfix handles aliases: 4. Still nothing found? Then reject the email. ## Database -Did you get the idea of mappings? Two columns? Keys and values? Good. Now how do those mappings work when we want to put the information into an SQL database? +Did you get the idea of mappings? Two columns in a table? Keys and values? Good. Now how do those mappings work when we want to put the information into an SQL database? Basically a relational database works in rows and columns, too. So we can take the format of the tables shown above and put them into database tables. Let’s call these tables… @@ -155,9 +155,9 @@ Basically a relational database works in rows and columns, too. So we can take t - virtual_aliases (for the aliases mapping) - virtual_users (for the email users and their mailboxes respectively) -I won’t bore you with the SQL stuff right now. Let’s do that in a later chapter. Let’s just briefly cover how Postfix can get data from the database. We provide Postfix with configuration files for that purpose. These files often have a “.cf” suffix (**c**onfiguration **f**ile). +I won’t bore you with the SQL stuff right now. We will deal with that in a later chapter. Let’s just briefly cover how Postfix can get data from the database. We provide Postfix with _configuration files_ for that purpose. These files often have a “.cf” suffix (**c**onfiguration **f**ile). -Let’s take the virtual_domains table for example. This is the contents of a file that is located at `/etc/postfix/mysql-virtual-mailbox-maps.cf`: +Let’s take the virtual_domains table for example. This is the content of a file that is located at `/etc/postfix/mysql-virtual-mailbox-maps.cf`: ``` # Information on how to connect to your MySQL server @@ -187,7 +187,7 @@ virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual_mailbox_maps.cf If you find that this mapping is not working as you expected then the “postmap -q” command is your friend. You can ask Postfix what the right-hand side value for a given left-side value is. Say that you are interested in the mailbox_path for the email_address “`john@example.org`”: ``` -postmap -q `john@example.org` mysql:/etc/postfix/mysql-virtual_mailbox_maps.cf +postmap -q john@example.org mysql:/etc/postfix/mysql-virtual_mailbox_maps.cf ``` Postfix will then run the above SQL query with your “`john@example.org`” argument: diff --git a/src/content/docs/ispmail-bookworm/60-installing-debian.mdx b/src/content/docs/ispmail-bookworm/60-installing-debian.mdx new file mode 100644 index 0000000..2c11bff --- /dev/null +++ b/src/content/docs/ispmail-bookworm/60-installing-debian.mdx @@ -0,0 +1,65 @@ +--- +title: Installing Debian +lastUpdated: 2023-09-25 +slug: ispmail-bookworm/install-debian-bookworm-on-your-server +sidebar: + order: 60 +--- + +import { Aside } from "@astrojs/starlight/components"; + +## Option 1: Get a server with Debian Bookworm pre-installed + +If you rent a virtual server at your favorite hosting company it often comes with Debian pre-installed. If you have a chance to change the partitioning then consider the schema shown below. Otherwise feel free to skip this page. + +## Option 2: Get a server with the older Debian Bullseye + +Your hosting company does not offer Debian Bullseye yet but just Debian Bullseye? No big deal. Just change your /etc/apt/sources.list file to: + +``` +deb http://deb.debian.org/debian bookworm main +deb http://deb.debian.org/debian bookworm-updates main +deb http://security.debian.org/debian-security bookworm-security main +``` + +Run “apt update” and “apt dist-upgrade” and you are ready. + +## Option 3: Install Debian yourself + +You have a blank computer or virtual machine? Then simply install Debian Bookworm yourself. Get a boot medium from the [Debian website](https://www.debian.org/distrib/netinst). The smaller _network installer_ is sufficient – it will download all required packages directly from the internet. Make sure you choose ‘English’ as the installation language even if it is not your native language. If you have trouble with the server you will more likely find help when searching for English error messages on the internet. + +Most of the installation is pretty straightforward. You don’t need me holding your hand. I strongly recommend that you use the _logical volume manager_ (LVM) for your partitions to stay flexible if your server grows. See my [article on LVM](https://workaround.org/understanding-lvm/) if you want some help understanding its concept. + +## Partitioning + +The only part that takes some patience is when it comes to partitioning your disk. Throughout this tutorial you will store your users’ emails in the /var/vmail partition. The MariaDB database will live in /var/lib/mysql and is usually pretty small even for a large number of email accounts – so that usually does not require a separate partition. Log files go to /var/log. + +So my recommendation for partitioning: + +- Boot partition, 300 MB, first partition of your disk (e.g. /dev/sda1), mounted at “/boot” +- All the rest of the disk goes into one large LVM _physical volume_, second partition of your disk (e.g. /dev/sda2) + - LVM _volume group_ consisting of that one _physical volume_ + - LVM _logical volume_ for “/”, 20 GB, formatted as ext4 + - LVM _logical volume_ for “/tmp”, 5 GB, formatted as ext4 + - LVM logical volume for “/var/vmail”, formatted as ext4, as much space for mailboxes as you want to start with + +LVM is very flexible. You can enlarge your root partition or “/var/vmail”. You can even add another physical disk and join it into the _volume group_ to get more space. So just start small. + +The Debian installer helps you set up LVM. In a nutshell these are the major steps: + +- Partitioning method: “Manual” +- Select your disk +- Create a new partition table if you get asked +- Create a new partition of “max” size as a _Primary_ partition +- Set the partition to “Use as: physical volume for LVM” +- Choose “Configure the Logical Volume Manager” +- Create a volume group (call it “vg0” if you like) +- Select the partition you created before (e.g. /dev/sda1) +- Create the logical volumes for “root”, “tmp” and “mail”. +- Edit each LV. Set its type to “ext4”. Set the mount points to + - / for root + - /tmp for tmp + - /var/vmail for mail +- Do not add swap space – your server will need very little RAM. You will get asked if you are serious. Yes, you are. + +Write the changes to disk and continue with the rest of the installation. Just make sure that you install the “SSH server” component so that you can login from remote after the installation. diff --git a/src/content/docs/ispmail-bookworm/70-install-the-software-packages copy.mdx b/src/content/docs/ispmail-bookworm/70-install-the-software-packages copy.mdx new file mode 100644 index 0000000..1a796e4 --- /dev/null +++ b/src/content/docs/ispmail-bookworm/70-install-the-software-packages copy.mdx @@ -0,0 +1,183 @@ +--- +title: Install software packages +lastUpdated: 2023-10-03 +slug: ispmail-bookworm/install-the-software-packages +sidebar: + order: 70 +--- + +import { Aside } from "@astrojs/starlight/components"; + +After the basic installation your server will reboot and allow you to login. You can either login at the console (if you have physical access to the system) or using SSH (_secure shell_). + + + +Unless you just installed the server it is a good idea to install all missing updates first: + +``` +apt update +apt upgrade +``` + +## Packages + +Let us install the necessary Debian packages to make it an actual mail server. Take a moment to read through this list of package – we will do the installation afterwards: + +- mariadb-server + The database service that will store information about your email accounts and domains. (If you haven’t heard of MariaDB yet, it is a fork of MySQL after being acquired by Oracle.) +- postfix + The MTA (mail transport agent) that speaks SMTP to receive and send emails. +- postfix-mysql + An extension that allows Postfix to get its information from a MySQL/MariaDB database. +- dovecot-mysql + The IMAP/POP3 mail server including an extension to query information from a MySQL/MariaDB database. +- dovecot-pop3d _(optional)_ + An extension to Dovecot that allows users to fetch emails using the POP3 protocol. (_This is optional. Only few users nowadays still use POP3._) +- dovecot-imapd + An extension to Dovecot that allows users to access emails using the IMAP protocol. +- dovecot-lmtpd + Enables Dovecot to receive [LMTP](https://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol) connections. We will need it later for the internal transfer of emails from Postfix to Dovecot. +- dovecot-managesieved _(optional)_ + An extension to Dovecot that allows users to define filter rules that are automatically run on the server when a new email arrives. +- apache2 and php8.2 + The web server that powers the webmail interface. PHP is the scripting language that the Roundcube webmail software is written in. +- adminer _(optional)_ + A web interface to manage your SQL database if you are not comfortable crafting SQL queries by hand. +- rspamd + A third-party software that deals with spam and handles automatic domain key (DKIM) signing. +- redis-server + A key-value store. It is a simple but fast kind of database service where Rspamd stores training data about spam and ham. +- pwgen + A tool to create random passwords. +- swaks + The _SWiss Army Knife of Smtp_. A utility to send emails through SMTP for testing purposes. +- mutt + A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the functionality of your mail server. +- certbot + A tool that talks to the LetsEncrypt certificate service to request and renew certificates. You will not need it if you have bought a certificate for your webmail server. +- ca-certificates + A set of certificates from common certificate authorities on the internet. It is required for the proper function of _wget_ for example. +- fail2ban _(optional)_ + A daemon that tracks log files to recognize brute force attacks. It can block IP addresses of attackers. We will use it to defend against evil people trying to get into our mail server. + +## pwgen + +Let’s start with the _pwgen_ utility. It helps you create secure passwords. Unless you already have a tool for that… + +``` +apt install -y pwgen +``` +You will need a random passwords later to create a database user for the mail server. Just as an example: to create a secure password having a length of 20 characters you would run: + +``` +pwgen -s 20 1 +``` + +That gets you a string like “W2EzNUFJzjEmA8tQT7A0”. + +## MariaDB server + +If you used MySQL before you may remember that you were forced to specify a password for the ‘root’ _database user_. That has changed with MariaDB in Debian – for the better. Now you can access the database server without any password if you are logged in as ‘root’ on the server. You might as well set a password but it is not necessary. + +Go install the MariaDB server package: + +``` +apt install -y mariadb-server +``` +If all went well you can now run “mysql” and get a connection to your MySQL database: + +``` +root@buster:~# mysql + Welcome to the MariaDB monitor. Commands end with ; or \\g. + Your MariaDB connection id is 30 + Server version: 10.3.18-MariaDB-0+deb10u1 Debian 10 + Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. + Type 'help;' or 'h' for help. Type 'c' to clear the current input statement. + MariaDB \[(none)\]> +``` + +Exit the SQL shell by typing “exit” or pressing CTRL-D. + +## Postfix + +Now on to the Postfix packages: + +``` +apt install -y postfix postfix-mysql +``` +When you get asked for the mail server configuration type please choose “Internet site”. Enter your own mail server name (the fully qualified domain name) or just press enter. The host name and domain does not need to match any of your email domains. + +## Apache and PHP + +To provide a webmail service you need the Apache web server software and the PHP scripting language support: + +``` +apt install -y apache2 php8.2 +``` + + + +## rspamd + +Just like in previous versions of this guide we will deal with spam using _[rspamd](https://rspamd.com/)_. (The rspamd principal developer endorses his [own software packages](https://rspamd.com/downloads.html) but in this guide we will use the packages in Debian for stability.) + +{/* TODO: Using the upstream packages has advantages regarding spam detection. */} + +We also install Redis as a storage backend for Rspamd to store its training data about spam and ham. + +``` +apt install -y rspamd redis-server +``` + +## swaks + +A very useful tool to test email delivery later is [SWAKS](https://www.jetmore.org/john/code/swaks/) (the _SWiss Army Knife for Smtp_): + +``` +apt install -y swaks +``` + +## mutt + +This is a full-featured IMAP mail client. Think of it as the _vi_ of mail clients. It cannot display HTML but it is very helpful to test IMAP mail servers. And some hardcore users still prefer it over any other mail client. + +``` +apt install -y mutt +``` + +## certbot + +You will want to use encrypted connections where possible. So you need a certificate for your services. The _certbot_ software helps you to request and manage [Let’s Encrypt](https://letsencrypt.org/) certificates automatically. + +``` +apt install -y certbot +``` + +## Dovecot + +In addition to Postfix (that handles SMTP communication) you will need [Dovecot](https://dovecot.org/) to store received emails and provide IMAP (and optionally POP3) access for your users: + +``` +apt install -y dovecot-mysql dovecot-pop3d dovecot-imapd dovecot-managesieved dovecot-lmtpd +``` + +## Adminer + +SQL databases are called like that because SQL (_structured query language_) is the way you talk to it. But as we are just puny humans let’s have a more user-friendly way to manage the database. I suggest _Adminer_ which is a tool similar to phpMyAdmin. + +``` +apt install -y adminer +``` + +## ca-certificates + +To avoid errors when downloading files using _wget_ you should install the default set of certificates of common certificate authorities on the internet: + +``` +apt install -y ca-certificates +``` diff --git a/src/content/docs/ispmail-bookworm/80-tls-certificates.mdx b/src/content/docs/ispmail-bookworm/80-tls-certificates.mdx new file mode 100644 index 0000000..c041643 --- /dev/null +++ b/src/content/docs/ispmail-bookworm/80-tls-certificates.mdx @@ -0,0 +1,196 @@ +--- +title: TLS certificate +lastUpdated: 2023-10-03 +slug: ispmail-bookworm/creating-a-tls-encryption-key-and-certificate +sidebar: + order: 80 +--- + +import { Aside } from "@astrojs/starlight/components"; + + + +The internet is not a friendly place where you can trust people. If you send data over the internet there is a pretty good chance someone intercepts it. You don’t want that. Our best weapon against that is transport encryption. All you need is to create an encryption _key_ and a _certificate_ for Postfix (SMTP), Dovecot (IMAP/POP3) and Apache (HTTPS). If you are confused why that requires a key and certificate then please consider reading the Wikipedia about [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography). The single most important detail here: nobody but you must have access to the private key. + + + +## What makes mail clients trust a certificate? + +Your client’s operating system contains a list of “trusted” certificate authorities. Sometimes that list is located in a central location for all applications. And sometimes a browser comes with its own list. A certificate signed by any of those organization is fully trusted. Yes, your browser trusts companies you probably have never heard of. And so does your mail client if you use software like Thunderbird instead of using web mail. The tricky part is not the technology. Everyone with some knowledge about certificates can create their own authority. Mathematically your certificates are just as good as anyone else’s. The tricky part is to convince browser manufacturers to trust them and add your certificates to their trust list. + +Those organization claim to do checks (in exchange for money) whether you are the righteous owner of a certain domain. These checks have sometimes failed so badly that they popped up in the news. Ten years ago a nerd [requested](https://bugzilla.mozilla.org/show_bug.cgi?id=647959) to get trusted by Firefox with his “Honest Achmed’s Used Cars and Certificates” authority. It was fun to watch the developers struggle with arguments why Achmed would be any worse than authorities like [Türktrust](https://arstechnica.com/information-technology/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/) or [Verisign](https://en.wikipedia.org/wiki/Verisign#2001:_Code_signing_certificate_mistake) (who failed so hard one must wonder why they are still in business). + +In 2012 [two Mozilla employees](https://en.wikipedia.org/wiki/Let%27s_Encrypt#History) decided to do something about that. They came up with the idea of a non-profit certificate authority. The world needed encryption everywhere and people should no longer shy away from it because getting certificates cost money. Two years later the service was ready and everyone could get a free certificate valid for 90 days. An automated process renewed the certificate in time so there was no hassle. (They surely deserve a [donation](https://letsencrypt.org/donate/) for the many years of service to the internet community.) + +## Where is the certificate used? + +You guessed it, we will need our own certificate. It will be used in three places: + +1. the webmail interface (driven by the Apache web server) +2. Postfix (to encrypt SMTP communication where possible) +3. Dovecot (to encrypt IMAP/POP3 communication and deny any unencrypted traffic) + +A single certificate (per domain) can and should be used by all three pieces of software. + +## Choosing a hostname for your mail server + +Your mail server will be able to serve emails in many domains. But a certificate is usually issued for a single [fully-qualified domain name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like “mail.example.org”. The _common name_ is an important part of the certificate. That attribute must correspond to the host name you use during communication or else the certificate is rejected. Hmmm, many domains but only one name is allowed on a certificate? How do we deal with that? + +### Option 1: a generic name and a single certificate + +The simple solution is to take a generic name. The German ISP Hetzner for example uses the name “mail.your-server.de” for all customers and their domains. And there are many examples of such an approach. Experience shows that most users do not care about the hostname as long as they get their emails. So I would generally recommend this approach due to its simplicity. + +### Option 2: multiple names/certificates & SNI + +Some people however want to give their mail server as many names as they have domains. Suppose that you have three domains: example.org, example.net and example.com. Users of example.org can use mail.example.org while users of example.net use mail.example.net. As you can imagine this would not work if you had a single certificate. After all which name would you use as a _common name_ there? If you used “mail.example.org” then talking to your server by the name “mail.example.net” would lead to a certificate error. + +So your mail server needs multiple certificates – one for each host name. And depending on how a user connects to your server you need to send the matching certificate. If the user wants to speak to “mail.example.org” then your server needs to send the certificate for “mail.example.org”. Fortunately that problem has been addressed by a technique called [Server Name Indication (SNI)](https://en.wikipedia.org/wiki/Server_Name_Indication). A client talks to the server and even before the encrypted connection is established it tells the server that it expects a certificate for the intended host name. The server can then load the matching certificate and initiate the encryption process. + +SNI has long been a problem for mail servers. The mail user agent (e.g. Thunderbird) needs to support it as well as Postfix and Dovecot. Postfix has finally added SNI in version 3.4 so that we can use it. + +While adding multiple host names needs extra work, it also has a benefit. If you want to move domains to other servers (e.g. when upgrading your server) you can move one domain at a time. + + + +## Preparing the Apache web server for HTTP + +Let’s start with the web server. As an example I will assume that you want to offer a host name **webmail.example.org** to your users. Of course your server will have another name in a domain that you control. I will use that example throughout the tutorial though and keep that name printed in **bold** letters to remind you that you have to use your own host name. + +Do you just want to play around with your new server and not use any real domain yet? No problem. Then use [nip.io](https://nip.io/). If your IP address is 1.2.3.4 then you can use 1.2.3.4.nip.io as a domain name that points to your server. (There used to be another domain xip.io for that purpose but it died in mid-2021.) Another service like that which also supports IPv6 is [sslip.io](https://sslip.io/). + +If you have an actual domain then set up a DNS “A” and “AAAA” (if you use IPv6) record for that host name pointing to your server’s IP address. + +First you need a web root directory for that host name: + +{/* Use a pre block because parts of it are printed in bold letter. */} +
+mkdir /var/www/**webmail.example.org**
+chown www-data:www-data /var/www/**webmail.example.org**
+
+ +Next you need to create a virtual host configuration file. Apache on Debian uses a neat system to manage virtual hosts: + +- `/etc/apache2/sites-available/*.conf` contains the actual configuration files for each virtual host. Putting a file here does not enable that host though. That’s done in the next step. There are two configuration files by default. “000-default.conf” is a HTTP virtual host and “default-ssl.conf” is a HTTPS virtual host. +- `/etc/apache2/sites-enabled/*.conf` contains symbolic links (“symlinks”) pointing to configuration files in the /etc/apache2/sites-available directory. Only *.conf links in this directory will be loaded by Apache. + +This technique allows you to enable and disable virtual hosts without having to destroy any configuration. Debian ships with the “a2ensite” (short for “apache2 enable site”) and “a2dissite” commands. In addition to some sanity checks those commands essentially create or remove symlinks between “sites-available” and “sites-enabled”. + + + +You may remove the default symlinks in `/etc/apache2/sites-enabled/*` unless you use them already. + +Create a new virtual host configuration file /etc/apache2/sites-available/**webmail.example.org**-http.conf and make it contain: + +
+<VirtualHost *:80>
+  ServerName **webmail.example.org**
+  DocumentRoot /var/www/**webmail.example.org**
+</VirtualHost>
+
+ +The simple configuration makes Apache handle HTTP requests (on the standard TCP port 80) if a certain line in the request header from the browser reads “Host: webmail.example.org”. So the browser actually tells your Apache web server which server name it is looking for. That allows for multiple web sites on a single IP address. (Thanks to [Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication) as explained earlier this works well for HTTPS, too.) + +Enable the site: + +
+a2ensite **webmail.example.org**-http
+
+ +You will be told: + +``` +To activate the new configuration, you need to run: + systemctl reload apache2 +``` +Do that. + + + +Let’s check if the configuration works. Put a test file into your web root directory: + +
+echo "Just a test" > /var/www/**webmail.example.org**/test
+
+ +Now when you open the URL http://**webmail.example.org**/test in your browser you should see the text “Just a test”. + +This is enough setup to make LetsEncrypt issue a certificate for you. + +## Getting a LetsEncrypt certificate + +Now you can use the _certbot_ tool to request an encryption certificate from LetsEncrypt. What will happen? + +- certbot creates a _private key_ and a _certificate request_. It sends the _certificate request_ to the LetsEncrypt server. +- the LetsEncrypt server replies with a _challenge_/_token_. +- certbot puts that token into a file in the /var/www/**webmail.example.org**/.well-known/acme-challenge directory. +- the LetsEncrypt server does an HTTP connection to `http://webmail.example.org/.well-known/acme-challenge/…` and expects to find that token. This verifies that you are in charge of the domain and the web server. +- If all works well the LetsEncrypt server signs your _certificate request_ and thus creates the actual _certificate_. +- certbot receives the certificate and puts it into /etc/letsencrypt/archive/**webmail.example.org**/ + +To get a certificate for your domain run: + +
+certbot certonly --webroot --webroot-path /var/www/**webmail.example.org** -d **webmail.example.org**
+
+ +You can use multiple occurences of “-d” here to get a certificate valid for multiple domains. For example: “-d webmail.example.org -d something-else.example.org”. (See also: [https://eff-certbot.readthedocs.io/en/stable/using.html#webroot](https://eff-certbot.readthedocs.io/en/stable/using.html#webroot)) + +The first time you do that you will get asked for your email address so LetsEncrypt can send you reminders if your certificate would expire. You will also have to agree to their terms of service. + +The first time you do that you will get asked for your email address so LetsEncrypt can send you reminders if your certificate would expire. You will also have to agree to their terms of service. + +If everything worked well you should get output like: + +
+Requesting a certificate for webmail.example.org
+
+Successfully received certificate.
+Certificate is saved at: /etc/letsencrypt/live/webmail.example.org/fullchain.pem
+Key is saved at:         /etc/letsencrypt/live/webmail.example.org/privkey.pem
+This certificate expires on 2024-01-02.
+These files will be updated when the certificate renews.
+Certbot has set up a scheduled task to automatically renew this certificate in the background.
+
+ +In /etc/letsencrypt/live/**webmail.example.org** you will find a couple of files now: + +- cert.pem: the certificate file +- chain.pem: the _chaining_ or _intermediate_ certificate. This certificate provides information how the LetsEncrypt certificates are linked to other known certificate authorities. It is generally a good idea to always send this certificate along with your own for clients who may not know LetsEncrypt properly yet. +- fullchain.pem: this file contains a concatenation of the _cert.pem_ and the _chain.pem_. This is the preferred file to use when a piece of software asks where to find the _certificate_. +- privkey.pem: the private key file. Keep it secret. + + + +## Add HTTPS + +Now that you have a valid certificate you can finally enable HTTPS for your web server. Create a new file /etc/apache2/sites-available/**webmail.example.org**-https.conf containing: + +
+<VirtualHost *:443>
+ServerName **webmail.example.org**
+DocumentRoot /var/www/**webmail.example.org**
+SSLEngine on
+SSLCertificateFile /etc/letsencrypt/live/**webmail.example.org**/fullchain.pem
+SSLCertificateKeyFile /etc/letsencrypt/live/**webmail.example.org**/privkey.pem
+</VirtualHost>
+
+ +This virtual host configuration looks suspiciously similar to the HTTP virtual host above. It just listens on port 443 (standard port for HTTPS) instead of port 80. And it uses the “SSLEngine” that handles encryption and gets information about the certificate for your web server (that is shown to your users) and the private key (that the web servers uses to decrypt the user’s communication). diff --git a/src/styles/custom.css b/src/styles/custom.css index f777416..21e09e0 100644 --- a/src/styles/custom.css +++ b/src/styles/custom.css @@ -2,4 +2,29 @@ color: darkgray; padding-top: 1em; font-size: 60%; +} + +li > br { + margin-bottom: 0.2rem !important; +} + +/* Allow PRE tags to scroll like .code blocks */ +.sl-markdown-content > pre { + overflow: scroll; +} + +/* But make them wrap if requested */ +.sl-markdown-content > pre.wrap { + text-wrap: wrap; + overflow: visible; + padding-left: 3em !important; + text-indent: -2em !important; +} + +:root { + --sl-text-code: 0.8rem; +} + +.starlight-aside { + margin-top: 1em !important; } \ No newline at end of file