From 96c00a065049077ecc83bb5018c72adce77cbded Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 2 Nov 2025 21:20:55 +0100 Subject: [PATCH 01/35] rewording --- src/components/Banner.astro | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/components/Banner.astro b/src/components/Banner.astro index 21f2314..e065214 100644 --- a/src/components/Banner.astro +++ b/src/components/Banner.astro @@ -26,7 +26,8 @@ const isBookworm = Astro.url.pathname.startsWith("/ispmail-bookworm/"); { isBookworm && (
- ⚠️ This section is outdated. Please use the guide for Debian Trixie. + ⚠️ This page is part of the ISPmail guide for Debian Bookworm. Please use the newer guide for{" "} + Debian Trixie.
) } From 935bbd2a6fc7e148a591326cf6e26e2e8ade2dfa Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 2 Nov 2025 21:21:06 +0100 Subject: [PATCH 02/35] typos --- src/content/docs/ispmail-trixie/110-upgrading.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/content/docs/ispmail-trixie/110-upgrading.mdx b/src/content/docs/ispmail-trixie/110-upgrading.mdx index 037f782..ac4d7d1 100644 --- a/src/content/docs/ispmail-trixie/110-upgrading.mdx +++ b/src/content/docs/ispmail-trixie/110-upgrading.mdx @@ -65,7 +65,7 @@ You need to copy the database that contains the control data about your email do (Bookworm) server as root and back up the *mailserver* database. That is as easy as running… ``` -mysqldump mailserver > mailserver.sql +mariadb-dump mailserver > mailserver.sql ``` Copy that file to the new server (using *scp*) and import it there: @@ -83,7 +83,7 @@ If your users are using Roundcube as a webmail interface then you should migrate Dump the SQL from the old server: ``` -mysqldump roundcube > roundcube.sql +mariadb-dump roundcube > roundcube.sql ``` Copy that file to the new server and import it: @@ -109,7 +109,7 @@ Details are found in the rspamd chapter. (**Hot** means: copy the files why they are still in use and potentially change while you do that.) Fortunately Dovecot uses the maildir format that stores emails as plain files on disk. Login to the new (Trixie) server and use *rsync* to -copy over the mails from the old (Bullseye) mail server: +copy over the mails from the old (Bookworm) mail server: ``` rsync -va oldserver:/var/vmail/ /var/vmail/ @@ -117,7 +117,7 @@ rsync -va oldserver:/var/vmail/ /var/vmail/ (Note the trailing slashes. Type them exactly as shown above or your files will end up in wrong places.) -There is no need to shut down Dovecot on your production Bullseye server. Copying the files while Dovecot is running +There is no need to shut down Dovecot on your production Bookworm server. Copying the files while Dovecot is running will not break anything. This is called a “hot copy". It may not be consistent but it will save time during the final synchronization. From 370e684f06b3c2425b431e536a0229ce57cea5ac Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 3 Nov 2025 09:03:19 +0100 Subject: [PATCH 03/35] add info on redis --- .../docs/ispmail-trixie/110-upgrading.mdx | 27 ++++++++++++++++--- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/src/content/docs/ispmail-trixie/110-upgrading.mdx b/src/content/docs/ispmail-trixie/110-upgrading.mdx index ac4d7d1..03cd3ce 100644 --- a/src/content/docs/ispmail-trixie/110-upgrading.mdx +++ b/src/content/docs/ispmail-trixie/110-upgrading.mdx @@ -103,7 +103,15 @@ UPDATE users SET mail_host='new.mail.server'; ## Migrate rspamd spam training data If you have been using rspamd with the Redis backend then copy over the Redis database from your previous server. -Details are found in the rspamd chapter. + +Stop rspamd on both the old and the new server. Then: + +```sh +rsync -va oldserver:/var/lib/redis/ /var/lib/redis/ +``` + +Once the redis database is started again on the new server, `rspamc stat` should show you that the training data is +found. ## Migrate the Maildirs hot @@ -129,9 +137,10 @@ need to copy emails from another server where you only have IMAP access but cann Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server. -``` -rsync -va oldserver:/etc/letsencrypt/ /etc/letsencrypt/ +```sh +rsync -va oldserver:/etc/letsencrypt/archive/ /etc/letsencrypt/archive/ rsync -va oldserver:/var/lib/rspamd/dkim/ /var/lib/rspamd/dkim/ +rsync -v oldserver:/etc/rspamd/dkim_selectors.map /etc/rspamd ``` ## Downtime @@ -144,7 +153,7 @@ You told your users about the downtime, right? The time has come? Okay. Shut dow copied consistently.) Let’s synchronize again. *rsync* will only copy those files that have changed which makes it much faster than the first sync. On your new server run: -``` +```sh rsync -va --delete oldserver:/var/vmail/ /var/vmail/ ``` @@ -177,3 +186,13 @@ postconf soft_bounce=no ## Shut down the old server If possible do a final backup of the old server. If users are not complaining then dismiss the old system after a week. + +## Unsolved issues + +You may see error messages like: + +``` +Error: sieve: binary /var/vmail/example.org/user/.dovecot.svbin: read: binary stored with different major version 2.0 (!= 3.0; automatically fixed when re-compiled) +``` + +You may need to run `sievec` on those files. From 1695df72a9a2d696996404ef83b6dc28114e5855 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 3 Nov 2025 22:45:40 +0100 Subject: [PATCH 04/35] replace matomo by rybbit --- astro.config.mjs | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/astro.config.mjs b/astro.config.mjs index 8e4eaac..c06acf9 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -10,6 +10,16 @@ export default defineConfig({ site: "https://workaround.org", integrations: [ starlight({ + head: [ + { + tag: "script", + attrs: { + src: "https://rybbit.workaround.org/api/script.js", + "data-site": "1", + defer: true, + }, + }, + ], expressiveCode: { frames: { removeCommentsWhenCopyingTerminalFrames: false, // keep the commented lines when copying shell snippets @@ -55,17 +65,17 @@ export default defineConfig({ }, }), // https://github.com/felix-berlin/astro-matomo - matomo({ - enabled: import.meta.env.PROD, // Only load in production - host: "https://matomo.workaround.org/", - setCookieDomain: "*.workaround.org", - trackerUrl: "js/", // defaults to matomo.php - srcUrl: "js/", // defaults to matomo.js - siteId: 1, - heartBeatTimer: 5, - disableCookies: true, - debug: false, - }), + // matomo({ + // enabled: import.meta.env.PROD, // Only load in production + // host: "https://matomo.workaround.org/", + // setCookieDomain: "*.workaround.org", + // trackerUrl: "js/", // defaults to matomo.php + // srcUrl: "js/", // defaults to matomo.js + // siteId: 1, + // heartBeatTimer: 5, + // disableCookies: true, + // debug: false, + // }), sitemap(), ], From 107816711fe846a134d87c5765c75bd87347d579 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 3 Nov 2025 22:55:58 +0100 Subject: [PATCH 05/35] fix rybbit reference --- astro.config.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/astro.config.mjs b/astro.config.mjs index c06acf9..6f9568f 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -15,7 +15,8 @@ export default defineConfig({ tag: "script", attrs: { src: "https://rybbit.workaround.org/api/script.js", - "data-site": "1", + "data-site-id": "1", + async: true, defer: true, }, }, From 852f5e78321a1f5aad5d3ed94e5bc5dd8e894f0c Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 3 Nov 2025 23:42:43 +0100 Subject: [PATCH 06/35] Restart Dovecot after adding lmtp. Thanks, Josef --- src/content/docs/ispmail-trixie/167-lmtp.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/content/docs/ispmail-trixie/167-lmtp.mdx b/src/content/docs/ispmail-trixie/167-lmtp.mdx index 44e4649..81e4de5 100644 --- a/src/content/docs/ispmail-trixie/167-lmtp.mdx +++ b/src/content/docs/ispmail-trixie/167-lmtp.mdx @@ -29,6 +29,7 @@ other. First we need to add a UNIX socket where Dovecot listens for incoming LMTP connections: ```sh title="Run this on your server" +# Add an LMTP listening socket in Dovecot cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF service lmtp { # Used internally by Dovecot @@ -43,6 +44,9 @@ service lmtp { } } EOF + +# Restart Dovecot +systemctl restart dovecot ``` The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you From 3a13a742ea53c439b4f7903215364644748c0e72 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 00:04:02 +0100 Subject: [PATCH 07/35] typo fixed --- src/content/docs/ispmail-trixie/165-dovecot.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/ispmail-trixie/165-dovecot.mdx b/src/content/docs/ispmail-trixie/165-dovecot.mdx index 8f99d78..a0b475f 100644 --- a/src/content/docs/ispmail-trixie/165-dovecot.mdx +++ b/src/content/docs/ispmail-trixie/165-dovecot.mdx @@ -42,7 +42,7 @@ for our purpose. The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But -we want to use the MariaDB database backend. Please comment all all include statements: +we want to use the MariaDB database backend. Please comment out all include statements: ```text title="Edit your /etc/dovecot/conf.d/10-auth.conf" #!include auth-system.conf.ext From f873ebe49a3fcf2a556f1bd598c5de7c4bdf4fb6 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 22:00:31 +0100 Subject: [PATCH 08/35] add hint on weak password schemes --- .../docs/ispmail-trixie/110-upgrading.mdx | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/content/docs/ispmail-trixie/110-upgrading.mdx b/src/content/docs/ispmail-trixie/110-upgrading.mdx index 03cd3ce..4f0732f 100644 --- a/src/content/docs/ispmail-trixie/110-upgrading.mdx +++ b/src/content/docs/ispmail-trixie/110-upgrading.mdx @@ -77,18 +77,32 @@ mariadb mailserver < mailserver.sql Obviously any database changes on the old server from now on will have to be done on the new server as well until the migration is done. +## Weak password schemes + +Please check if any of your users have hashed passwords that are considered +[weak](https://doc.dovecot.org/2.4.2/core/config/auth/schemes.html) by Dovecot. Those passwords using a `PLAIN-MD5` +scheme are not accepted by Dovecot by default. But you can enable them again using: + +```sh +cat > 99-ispmail-weak-schemes.conf << EOF +auth_allow_weak_schemes = yes +EOF +``` + +Your users should change their passwords using Roundcube. That way a new hash with a more secure schema is created. + ## Roundcube contacts If your users are using Roundcube as a webmail interface then you should migrate their data like their contact lists. Dump the SQL from the old server: -``` +```sh mariadb-dump roundcube > roundcube.sql ``` Copy that file to the new server and import it: -``` +```sh mariadb roundcube < roundcube.sql ``` @@ -187,7 +201,7 @@ postconf soft_bounce=no If possible do a final backup of the old server. If users are not complaining then dismiss the old system after a week. -## Unsolved issues +## Further issues You may see error messages like: From 19f1d792c9802bc0d03d4279c3ef9d67280f3449 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 22:00:36 +0100 Subject: [PATCH 09/35] add managesieve plugin --- src/content/docs/ispmail-trixie/170-webmail.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/src/content/docs/ispmail-trixie/170-webmail.mdx b/src/content/docs/ispmail-trixie/170-webmail.mdx index cae8826..a5b7f2d 100644 --- a/src/content/docs/ispmail-trixie/170-webmail.mdx +++ b/src/content/docs/ispmail-trixie/170-webmail.mdx @@ -137,6 +137,7 @@ plugins change it to: ``` $config['plugins'] = array( 'password', + 'managesieve', ); ``` From f5997c3495595d55edd648f101575f226ed298c1 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 23:31:10 +0100 Subject: [PATCH 10/35] fix big-picture images for dark mode --- drawio/big-picture.drawio | 276 +++++++++++++++--------------- public/big-picture-receive/01.svg | 2 +- public/big-picture-receive/02.svg | 2 +- public/big-picture-receive/03.svg | 2 +- public/big-picture-receive/04.svg | 2 +- public/big-picture-receive/05.svg | 2 +- public/big-picture-receive/06.svg | 2 +- public/big-picture-receive/07.svg | 2 +- public/big-picture-receive/08.svg | 2 +- public/big-picture-receive/09.svg | 2 +- public/big-picture-receive/10.svg | 2 +- public/big-picture-receive/11.svg | 2 +- public/big-picture-receive/12.svg | 2 +- public/big-picture-receive/13.svg | 2 +- public/big-picture-receive/14.svg | 2 +- public/big-picture-receive/15.svg | 2 +- public/big-picture-receive/16.svg | 2 +- public/big-picture-receive/17.svg | 3 +- public/big-picture-receive/18.svg | 2 +- public/big-picture-receive/19.svg | 2 +- public/big-picture-receive/20.svg | 2 +- public/big-picture-receive/21.svg | 2 +- public/big-picture-receive/22.svg | 2 +- public/big-picture-receive/23.svg | 3 +- public/big-picture-receive/24.svg | 2 +- 25 files changed, 162 insertions(+), 164 deletions(-) diff --git a/drawio/big-picture.drawio b/drawio/big-picture.drawio index e73dbe9..1243783 100644 --- a/drawio/big-picture.drawio +++ b/drawio/big-picture.drawio @@ -1,34 +1,34 @@ - + - + - + - + - + - + - + - + - + - + - + @@ -37,40 +37,40 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -78,25 +78,25 @@ - + - + - + - + - + - + @@ -104,16 +104,16 @@ - + - + - + - + @@ -122,16 +122,16 @@ - + - + - + - + @@ -140,19 +140,19 @@ - + - + - + - + - + @@ -161,19 +161,19 @@ - + - + - + - + - + @@ -182,19 +182,19 @@ - + - + - + - + - + @@ -203,22 +203,22 @@ - + - + - + - + - + - + @@ -227,19 +227,19 @@ - + - + - + - + - + @@ -248,25 +248,25 @@ - + - + - + - + - + - + - + @@ -278,22 +278,22 @@ - + - + - + - + - + - + @@ -307,25 +307,25 @@ - + - + - + - + - + - + - + @@ -337,25 +337,25 @@ - + - + - + - + - + - + - + @@ -369,46 +369,46 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -416,22 +416,22 @@ - + - + - + - + - + - + @@ -443,25 +443,25 @@ - + - + - + - + - + - + - + @@ -475,25 +475,25 @@ - + - + - + - + - + - + @@ -502,61 +502,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + diff --git a/public/big-picture-receive/01.svg b/public/big-picture-receive/01.svg index 8f8ccbe..8dd8a9c 100644 --- a/public/big-picture-receive/01.svg +++ b/public/big-picture-receive/01.svg @@ -1,3 +1,3 @@ -
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file +
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file diff --git a/public/big-picture-receive/02.svg b/public/big-picture-receive/02.svg index ac055cd..5b372bf 100644 --- a/public/big-picture-receive/02.svg +++ b/public/big-picture-receive/02.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file diff --git a/public/big-picture-receive/03.svg b/public/big-picture-receive/03.svg index c480263..a0dc63c 100644 --- a/public/big-picture-receive/03.svg +++ b/public/big-picture-receive/03.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file diff --git a/public/big-picture-receive/04.svg b/public/big-picture-receive/04.svg index 19589eb..32cda2e 100644 --- a/public/big-picture-receive/04.svg +++ b/public/big-picture-receive/04.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file diff --git a/public/big-picture-receive/05.svg b/public/big-picture-receive/05.svg index 767508a..1f41582 100644 --- a/public/big-picture-receive/05.svg +++ b/public/big-picture-receive/05.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file diff --git a/public/big-picture-receive/06.svg b/public/big-picture-receive/06.svg index 3eba5f0..934413a 100644 --- a/public/big-picture-receive/06.svg +++ b/public/big-picture-receive/06.svg @@ -1,3 +1,3 @@ -
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/07.svg b/public/big-picture-receive/07.svg index b789615..c050719 100644 --- a/public/big-picture-receive/07.svg +++ b/public/big-picture-receive/07.svg @@ -1,3 +1,3 @@ -
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file +
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file diff --git a/public/big-picture-receive/08.svg b/public/big-picture-receive/08.svg index 3c7531e..65560ba 100644 --- a/public/big-picture-receive/08.svg +++ b/public/big-picture-receive/08.svg @@ -1,3 +1,3 @@ -
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file +
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file diff --git a/public/big-picture-receive/09.svg b/public/big-picture-receive/09.svg index 3eb2182..f67015f 100644 --- a/public/big-picture-receive/09.svg +++ b/public/big-picture-receive/09.svg @@ -1,3 +1,3 @@ -
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file +
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file diff --git a/public/big-picture-receive/10.svg b/public/big-picture-receive/10.svg index 21fc955..03a5f48 100644 --- a/public/big-picture-receive/10.svg +++ b/public/big-picture-receive/10.svg @@ -1,3 +1,3 @@ -
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file +
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file diff --git a/public/big-picture-receive/11.svg b/public/big-picture-receive/11.svg index 2a4441a..72d52a0 100644 --- a/public/big-picture-receive/11.svg +++ b/public/big-picture-receive/11.svg @@ -1,3 +1,3 @@ -
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file +
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file diff --git a/public/big-picture-receive/12.svg b/public/big-picture-receive/12.svg index 4da2ab0..8c606fe 100644 --- a/public/big-picture-receive/12.svg +++ b/public/big-picture-receive/12.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/13.svg b/public/big-picture-receive/13.svg index b19a405..2a03896 100644 --- a/public/big-picture-receive/13.svg +++ b/public/big-picture-receive/13.svg @@ -1,3 +1,3 @@ -
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file +
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file diff --git a/public/big-picture-receive/14.svg b/public/big-picture-receive/14.svg index 8eec544..e211a06 100644 --- a/public/big-picture-receive/14.svg +++ b/public/big-picture-receive/14.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file diff --git a/public/big-picture-receive/15.svg b/public/big-picture-receive/15.svg index e64758b..0b5e5b4 100644 --- a/public/big-picture-receive/15.svg +++ b/public/big-picture-receive/15.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file diff --git a/public/big-picture-receive/16.svg b/public/big-picture-receive/16.svg index 163078f..79c7d6b 100644 --- a/public/big-picture-receive/16.svg +++ b/public/big-picture-receive/16.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file diff --git a/public/big-picture-receive/17.svg b/public/big-picture-receive/17.svg index 886c091..2b476e3 100644 --- a/public/big-picture-receive/17.svg +++ b/public/big-picture-receive/17.svg @@ -1,4 +1,3 @@ - -
Postfix
mail server
Other
mail server
MariaDB
database
Yes, I found it in my virtual_users table
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_users table
Yes, I found it in my...
\ No newline at end of file diff --git a/public/big-picture-receive/18.svg b/public/big-picture-receive/18.svg index c30a144..1c5fd4d 100644 --- a/public/big-picture-receive/18.svg +++ b/public/big-picture-receive/18.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file diff --git a/public/big-picture-receive/19.svg b/public/big-picture-receive/19.svg index cb513b5..8369b29 100644 --- a/public/big-picture-receive/19.svg +++ b/public/big-picture-receive/19.svg @@ -1,3 +1,3 @@ -
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file +
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file diff --git a/public/big-picture-receive/20.svg b/public/big-picture-receive/20.svg index 8645424..2e32357 100644 --- a/public/big-picture-receive/20.svg +++ b/public/big-picture-receive/20.svg @@ -1,3 +1,3 @@ -
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file +
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file diff --git a/public/big-picture-receive/21.svg b/public/big-picture-receive/21.svg index 9375170..1164e01 100644 --- a/public/big-picture-receive/21.svg +++ b/public/big-picture-receive/21.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file diff --git a/public/big-picture-receive/22.svg b/public/big-picture-receive/22.svg index 3543078..5173cc2 100644 --- a/public/big-picture-receive/22.svg +++ b/public/big-picture-receive/22.svg @@ -1,3 +1,3 @@ -
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file +
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file diff --git a/public/big-picture-receive/23.svg b/public/big-picture-receive/23.svg index 609be6e..32974ce 100644 --- a/public/big-picture-receive/23.svg +++ b/public/big-picture-receive/23.svg @@ -1,4 +1,3 @@ - -
LMTP
Postfix
mail server
Please save this new email for john@example.org
Dovecot
IMAP server
\ No newline at end of file +
LMTP
LMTP
Postfix
mail server
Postfix...
Please save this new email for john@example.org
Please save this new e...
Dovecot
IMAP server
Dovecot...
\ No newline at end of file diff --git a/public/big-picture-receive/24.svg b/public/big-picture-receive/24.svg index 49fcf86..2a6ff2b 100644 --- a/public/big-picture-receive/24.svg +++ b/public/big-picture-receive/24.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file +
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file From e962886ee6cd05558238b47b3dcc4550314ace91 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 23:31:44 +0100 Subject: [PATCH 11/35] same --- drawio/big-picture.drawio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drawio/big-picture.drawio b/drawio/big-picture.drawio index 1243783..6800b7e 100644 --- a/drawio/big-picture.drawio +++ b/drawio/big-picture.drawio @@ -13,7 +13,7 @@ - + From 5bf9c487f41a8a78019fa1da194c60d9f1520286 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 4 Nov 2025 23:48:07 +0100 Subject: [PATCH 12/35] export from drawio with transparent background for better display in firefox --- public/big-picture-receive/01.svg | 2 +- public/big-picture-receive/02.svg | 2 +- public/big-picture-receive/03.svg | 2 +- public/big-picture-receive/04.svg | 2 +- public/big-picture-receive/05.svg | 2 +- public/big-picture-receive/06.svg | 2 +- public/big-picture-receive/07.svg | 2 +- public/big-picture-receive/08.svg | 2 +- public/big-picture-receive/09.svg | 2 +- public/big-picture-receive/10.svg | 2 +- public/big-picture-receive/11.svg | 2 +- public/big-picture-receive/12.svg | 2 +- public/big-picture-receive/13.svg | 2 +- public/big-picture-receive/14.svg | 2 +- public/big-picture-receive/15.svg | 2 +- public/big-picture-receive/16.svg | 2 +- public/big-picture-receive/17.svg | 2 +- public/big-picture-receive/18.svg | 2 +- public/big-picture-receive/19.svg | 2 +- public/big-picture-receive/20.svg | 2 +- public/big-picture-receive/21.svg | 2 +- public/big-picture-receive/22.svg | 2 +- public/big-picture-receive/23.svg | 2 +- public/big-picture-receive/24.svg | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/public/big-picture-receive/01.svg b/public/big-picture-receive/01.svg index 8dd8a9c..b81ca4c 100644 --- a/public/big-picture-receive/01.svg +++ b/public/big-picture-receive/01.svg @@ -1,3 +1,3 @@ -
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file +
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file diff --git a/public/big-picture-receive/02.svg b/public/big-picture-receive/02.svg index 5b372bf..6831ec9 100644 --- a/public/big-picture-receive/02.svg +++ b/public/big-picture-receive/02.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file diff --git a/public/big-picture-receive/03.svg b/public/big-picture-receive/03.svg index a0dc63c..b4c8b40 100644 --- a/public/big-picture-receive/03.svg +++ b/public/big-picture-receive/03.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file diff --git a/public/big-picture-receive/04.svg b/public/big-picture-receive/04.svg index 32cda2e..203357b 100644 --- a/public/big-picture-receive/04.svg +++ b/public/big-picture-receive/04.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file diff --git a/public/big-picture-receive/05.svg b/public/big-picture-receive/05.svg index 1f41582..d04d3e4 100644 --- a/public/big-picture-receive/05.svg +++ b/public/big-picture-receive/05.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file diff --git a/public/big-picture-receive/06.svg b/public/big-picture-receive/06.svg index 934413a..af43a7e 100644 --- a/public/big-picture-receive/06.svg +++ b/public/big-picture-receive/06.svg @@ -1,3 +1,3 @@ -
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/07.svg b/public/big-picture-receive/07.svg index c050719..e248e60 100644 --- a/public/big-picture-receive/07.svg +++ b/public/big-picture-receive/07.svg @@ -1,3 +1,3 @@ -
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file +
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file diff --git a/public/big-picture-receive/08.svg b/public/big-picture-receive/08.svg index 65560ba..4eb096c 100644 --- a/public/big-picture-receive/08.svg +++ b/public/big-picture-receive/08.svg @@ -1,3 +1,3 @@ -
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file +
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file diff --git a/public/big-picture-receive/09.svg b/public/big-picture-receive/09.svg index f67015f..6c79fc9 100644 --- a/public/big-picture-receive/09.svg +++ b/public/big-picture-receive/09.svg @@ -1,3 +1,3 @@ -
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file +
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file diff --git a/public/big-picture-receive/10.svg b/public/big-picture-receive/10.svg index 03a5f48..a5fc61f 100644 --- a/public/big-picture-receive/10.svg +++ b/public/big-picture-receive/10.svg @@ -1,3 +1,3 @@ -
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file +
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file diff --git a/public/big-picture-receive/11.svg b/public/big-picture-receive/11.svg index 72d52a0..96e7d27 100644 --- a/public/big-picture-receive/11.svg +++ b/public/big-picture-receive/11.svg @@ -1,3 +1,3 @@ -
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file +
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file diff --git a/public/big-picture-receive/12.svg b/public/big-picture-receive/12.svg index 8c606fe..5f4a28a 100644 --- a/public/big-picture-receive/12.svg +++ b/public/big-picture-receive/12.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/13.svg b/public/big-picture-receive/13.svg index 2a03896..4ea1440 100644 --- a/public/big-picture-receive/13.svg +++ b/public/big-picture-receive/13.svg @@ -1,3 +1,3 @@ -
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file +
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file diff --git a/public/big-picture-receive/14.svg b/public/big-picture-receive/14.svg index e211a06..3d44682 100644 --- a/public/big-picture-receive/14.svg +++ b/public/big-picture-receive/14.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file diff --git a/public/big-picture-receive/15.svg b/public/big-picture-receive/15.svg index 0b5e5b4..4c93635 100644 --- a/public/big-picture-receive/15.svg +++ b/public/big-picture-receive/15.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file diff --git a/public/big-picture-receive/16.svg b/public/big-picture-receive/16.svg index 79c7d6b..470b01b 100644 --- a/public/big-picture-receive/16.svg +++ b/public/big-picture-receive/16.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file diff --git a/public/big-picture-receive/17.svg b/public/big-picture-receive/17.svg index 2b476e3..33bca2a 100644 --- a/public/big-picture-receive/17.svg +++ b/public/big-picture-receive/17.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_users table
Yes, I found it in my...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_users table
Yes, I found it in my...
\ No newline at end of file diff --git a/public/big-picture-receive/18.svg b/public/big-picture-receive/18.svg index 1c5fd4d..74d239b 100644 --- a/public/big-picture-receive/18.svg +++ b/public/big-picture-receive/18.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file diff --git a/public/big-picture-receive/19.svg b/public/big-picture-receive/19.svg index 8369b29..a91c7ab 100644 --- a/public/big-picture-receive/19.svg +++ b/public/big-picture-receive/19.svg @@ -1,3 +1,3 @@ -
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file +
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file diff --git a/public/big-picture-receive/20.svg b/public/big-picture-receive/20.svg index 2e32357..fd0f66f 100644 --- a/public/big-picture-receive/20.svg +++ b/public/big-picture-receive/20.svg @@ -1,3 +1,3 @@ -
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file +
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file diff --git a/public/big-picture-receive/21.svg b/public/big-picture-receive/21.svg index 1164e01..4316f8d 100644 --- a/public/big-picture-receive/21.svg +++ b/public/big-picture-receive/21.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file diff --git a/public/big-picture-receive/22.svg b/public/big-picture-receive/22.svg index 5173cc2..1302dd3 100644 --- a/public/big-picture-receive/22.svg +++ b/public/big-picture-receive/22.svg @@ -1,3 +1,3 @@ -
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file +
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file diff --git a/public/big-picture-receive/23.svg b/public/big-picture-receive/23.svg index 32974ce..07935e8 100644 --- a/public/big-picture-receive/23.svg +++ b/public/big-picture-receive/23.svg @@ -1,3 +1,3 @@ -
LMTP
LMTP
Postfix
mail server
Postfix...
Please save this new email for john@example.org
Please save this new e...
Dovecot
IMAP server
Dovecot...
\ No newline at end of file +
LMTP
LMTP
Postfix
mail server
Postfix...
Please save this new email for john@example.org
Please save this new e...
Dovecot
IMAP server
Dovecot...
\ No newline at end of file diff --git a/public/big-picture-receive/24.svg b/public/big-picture-receive/24.svg index 2a6ff2b..8a5c994 100644 --- a/public/big-picture-receive/24.svg +++ b/public/big-picture-receive/24.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file +
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file From 0f4d71fd5f4497b9cf641434b2fc9895d18b59ee Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 9 Nov 2025 22:30:56 +0100 Subject: [PATCH 13/35] add newlines --- .../docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx index 372ee84..b79be0e 100644 --- a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx +++ b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx @@ -311,11 +311,11 @@ You could either just send an email from your mail client (or Roundcube) through address. Or you could use swaks. Use your own addresses and password of course: ```sh title="Run this on your server" -swaks --server localhost:587 - --from some.address@example.org - --to some.external.address@example.net - -tls - --auth-user some.address@example.org +swaks --server localhost:587 \ + --from some.address@example.org \ + --to some.external.address@example.net \ + -tls \ + --auth-user some.address@example.org \ --auth-password your_secreet_password ``` From 0951a2c96fadd3c41133fedf72ac512c169204fd Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Wed, 12 Nov 2025 00:26:06 +0100 Subject: [PATCH 14/35] typo fixed --- src/content/docs/ispmail-trixie/180-relaying.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index dd0400c..1b16aee 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -86,7 +86,7 @@ submission inet n - y - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot - -o smtpd_sasl_path=private/auth + -o smtpd_sasl_path=private/dovecot-auth -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject ``` From b77088a0f722a5cefd4fd9b3144a726aac7e8673 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Wed, 12 Nov 2025 00:37:16 +0100 Subject: [PATCH 15/35] typo of a2enconf versus a2ensite --- src/content/docs/ispmail-trixie/170-webmail.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/ispmail-trixie/170-webmail.mdx b/src/content/docs/ispmail-trixie/170-webmail.mdx index a5b7f2d..423237a 100644 --- a/src/content/docs/ispmail-trixie/170-webmail.mdx +++ b/src/content/docs/ispmail-trixie/170-webmail.mdx @@ -52,7 +52,7 @@ There are two directories dealing with virtual hosts: The actual file containing the configuration lives in _sites-available_. If that configuration should be active, then a symbolic link (symlink) is added to the _sites-enabled_ directory pointing to the file in the _sites-available_ directory. That way you can switch sites on and off without deleting the actual configuration file. You can enable a -site using the `a2enconf` (apache2 enable config) command or disable it using `a2disconf`. +site using the `a2ensite` (apache2 enable config) command or disable it using `a2dissite`. From 6fd3a74ff1f7749faa03dd5f73b958e6a6ce5de9 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Fri, 14 Nov 2025 16:13:36 +0100 Subject: [PATCH 16/35] typo fixed. Thanks to Burps --- src/content/docs/ispmail-trixie/165-dovecot.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/ispmail-trixie/165-dovecot.mdx b/src/content/docs/ispmail-trixie/165-dovecot.mdx index a0b475f..15aefe0 100644 --- a/src/content/docs/ispmail-trixie/165-dovecot.mdx +++ b/src/content/docs/ispmail-trixie/165-dovecot.mdx @@ -113,7 +113,7 @@ to authenticate your users which is relevant later when we set up _relaying_. Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS between the users and your mail server. You need to tell Dovecot where to find these files. Also set [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent -that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to +that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to override the defaults. ```sh title="Run this on your server" -postconf smtp_tls_security_level=may -postconf smtpd_tls_security_level=may +postconf smtp_tls_security_level=encrypt +postconf smtpd_tls_security_level=encrypt +postconf smtp_tls_mandatory_protocols=">=TLSv1.2" +postconf smtpd_tls_mandatory_protocols=">=TLSv1.2" +postconf smtp_tls_mandatory_ciphers=high +postconf smtpd_tls_mandatory_ciphers=high postconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem ``` @@ -152,12 +156,24 @@ postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem What it means: - **smtp_tls_security_level**: \ - Allow encrypted _outgoing_ SMTP connections but do not enforce it. + Enforce encrypted _outgoing_ SMTP connections. - **smtpd_tls_security_level**: \ - Allow encrypted _incoming_ SMTP connections but do not enforce it. + Enforce encrypted _incoming_ SMTP connections. +- **smtp_tls_mandatory_protocols** / **smtpd_tls_mandatory_protocols**: \ + Only allow recommended versions of [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security). Version 1.2 has been + introduced 2008. Version 1.3 is from 2018. +- **smtp_tls_mandatory_ciphers** / **smtpd_tls_mandatory_ciphers**: \ + The list of encryption algorithms that you allow for communnication. Default is _medium_. - **smtpd_tls_cert_file** and **smtpd_tls_key_file**: \ Where to find the private key and certificate for encryption. + + Please note that configuration in `main.cf` applies to all Postfix services. So the above configuration enabled encryption for both server-to-server and human-to-server (`submission`) services. The `smtpd_sasl_auth_enable` will only be set for the `submission` service to enable authentication there.[^1] From 8080437ae329de5690459645d993707d6f338bc6 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 14:13:34 +0100 Subject: [PATCH 22/35] add hint on $mydestinaton --- src/content/docs/ispmail-trixie/180-relaying.mdx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index 0d0065e..67535c4 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -277,6 +277,13 @@ If you want to allow that, create a new \*.cf file with a mapping query like thi + + ## Test it ### No encryption, no authentication From fa48d825799ff2d21a280ef11a77df4c2fcb5769 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 17:26:10 +0100 Subject: [PATCH 23/35] imprints added for the German bureaucrats --- src/components/Footer.astro | 2 +- src/content/docs/imprints.mdx | 55 +++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 src/content/docs/imprints.mdx diff --git a/src/components/Footer.astro b/src/components/Footer.astro index 04d9de7..ca2e700 100644 --- a/src/components/Footer.astro +++ b/src/components/Footer.astro @@ -16,6 +16,6 @@ import Default from "@astrojs/starlight/components/Footer.astro"; This guide is maintained by Christoph Haas since 2003. All content on workaround.org can be used under the terms of the Creative Commons BY-NC-SA license. - Penguin image based on AI art because I suck at drawing. + Penguin image based on AI art because I suck at drawing. Imprints. diff --git a/src/content/docs/imprints.mdx b/src/content/docs/imprints.mdx new file mode 100644 index 0000000..3921a61 --- /dev/null +++ b/src/content/docs/imprints.mdx @@ -0,0 +1,55 @@ +--- +title: Legal Notice +--- + +## English Section + +**Responsible for Content** + +``` +Christoph Haas +c/o PIA Media GmbH +Gorch-Fock-Wall 1a +20354 Hamburg +Germany +postmaster@christoph-haas.de +``` + +**Liability for Content** +As a service provider, we are responsible for our own content on these pages under § 7 (1) TMG. However, we do not +guarantee the accuracy, completeness, or timeliness of the content. + +**Liability for External Links** +This website contains links to external third-party websites over which we have no control. Therefore, we cannot assume +any liability for such external content. + +**Open-Source Notice** +The source code of this project is published under an open-source license. Details can be found in the respective +repository at https://github.com/Signum/ispmail-workaround-org + +--- + +## Deutsche Sektion + +**Verantwortlich für den Inhalt** + +``` +Christoph Haas +c/o PIA Media GmbH +Gorch-Fock-Wall 1a +20354 Hamburg +Germany +postmaster@christoph-haas.de +``` + +**Haftung für Inhalte** +Als Diensteanbieter sind wir gemäß § 7 Abs. 1 TMG für eigene Inhalte auf diesen Seiten verantwortlich. Für die +Richtigkeit, Vollständigkeit und Aktualität der Inhalte übernehmen wir jedoch keine Gewähr. + +**Haftung für Links** +Diese Website enthält Links zu externen Websites Dritter, auf deren Inhalte wir keinen Einfluss haben. Daher können wir +für diese fremden Inhalte keine Gewähr übernehmen. + +**Open-Source-Hinweis** +Der Quellcode des Projekts ist unter einer Open-Source-Lizenz veröffentlicht. Details finden Sie im entsprechenden +Repository unter https://github.com/Signum/ispmail-workaround-org From fd70990a60143dda9a516903e08c6312a49bb6d7 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 18:41:44 +0100 Subject: [PATCH 24/35] use online-impressum --- src/content/docs/imprints.mdx | 51 +++++++++-------------------------- 1 file changed, 13 insertions(+), 38 deletions(-) diff --git a/src/content/docs/imprints.mdx b/src/content/docs/imprints.mdx index 3921a61..30e4620 100644 --- a/src/content/docs/imprints.mdx +++ b/src/content/docs/imprints.mdx @@ -1,55 +1,30 @@ --- -title: Legal Notice +title: Legal Notice / Imprints --- -## English Section - -**Responsible for Content** +## Responsible for Content ``` Christoph Haas -c/o PIA Media GmbH -Gorch-Fock-Wall 1a -20354 Hamburg +c/o Online-Impressum.de #5172 +Europaring 90 +53757 Sankt Augustin Germany -postmaster@christoph-haas.de ``` -**Liability for Content** +Email: online-impreessum@christoph-haas.de + +## Liability for Content + As a service provider, we are responsible for our own content on these pages under § 7 (1) TMG. However, we do not guarantee the accuracy, completeness, or timeliness of the content. -**Liability for External Links** +## Liability for External Links + This website contains links to external third-party websites over which we have no control. Therefore, we cannot assume any liability for such external content. -**Open-Source Notice** +## Open-Source Notice + The source code of this project is published under an open-source license. Details can be found in the respective repository at https://github.com/Signum/ispmail-workaround-org - ---- - -## Deutsche Sektion - -**Verantwortlich für den Inhalt** - -``` -Christoph Haas -c/o PIA Media GmbH -Gorch-Fock-Wall 1a -20354 Hamburg -Germany -postmaster@christoph-haas.de -``` - -**Haftung für Inhalte** -Als Diensteanbieter sind wir gemäß § 7 Abs. 1 TMG für eigene Inhalte auf diesen Seiten verantwortlich. Für die -Richtigkeit, Vollständigkeit und Aktualität der Inhalte übernehmen wir jedoch keine Gewähr. - -**Haftung für Links** -Diese Website enthält Links zu externen Websites Dritter, auf deren Inhalte wir keinen Einfluss haben. Daher können wir -für diese fremden Inhalte keine Gewähr übernehmen. - -**Open-Source-Hinweis** -Der Quellcode des Projekts ist unter einer Open-Source-Lizenz veröffentlicht. Details finden Sie im entsprechenden -Repository unter https://github.com/Signum/ispmail-workaround-org From f7f672fbc80c2f76d0126ef0ec5586c34c7ede71 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 23:05:28 +0100 Subject: [PATCH 25/35] added secondary contact form --- src/content/docs/imprints.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/content/docs/imprints.mdx b/src/content/docs/imprints.mdx index 30e4620..9aa7fe1 100644 --- a/src/content/docs/imprints.mdx +++ b/src/content/docs/imprints.mdx @@ -14,6 +14,8 @@ Germany Email: online-impreessum@christoph-haas.de +Or via [contact form](https://mein.online-impressum.de/workaround-org/#Zweiter_Kontaktweg) + ## Liability for Content As a service provider, we are responsible for our own content on these pages under § 7 (1) TMG. However, we do not From 4f159716ef5fd324ed6a37fbc00d6dd42fc3634f Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 23:05:50 +0100 Subject: [PATCH 26/35] legal stuff --- src/components/Footer.astro | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/components/Footer.astro b/src/components/Footer.astro index ca2e700..0acbd23 100644 --- a/src/components/Footer.astro +++ b/src/components/Footer.astro @@ -16,6 +16,6 @@ import Default from "@astrojs/starlight/components/Footer.astro"; This guide is maintained by Christoph Haas since 2003. All content on workaround.org can be used under the terms of the Creative Commons BY-NC-SA license. - Penguin image based on AI art because I suck at drawing. Imprints. + Penguin image based on AI art because I suck at drawing. Imprints and legal notice.. From df1d49afdf81cbdbfe2a46971d0113e029932b0e Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 23:37:00 +0100 Subject: [PATCH 27/35] add external contact form and secondary email address --- src/content/docs/imprints.mdx | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/src/content/docs/imprints.mdx b/src/content/docs/imprints.mdx index 9aa7fe1..82789bc 100644 --- a/src/content/docs/imprints.mdx +++ b/src/content/docs/imprints.mdx @@ -12,18 +12,17 @@ Europaring 90 Germany ``` -Email: online-impreessum@christoph-haas.de - -Or via [contact form](https://mein.online-impressum.de/workaround-org/#Zweiter_Kontaktweg) +Contact: postmaster@christoph-haas.de or christoph.haas@gmail.com or via +[contact form](https://mein.online-impressum.de/workaround-org/) ## Liability for Content -As a service provider, we are responsible for our own content on these pages under § 7 (1) TMG. However, we do not -guarantee the accuracy, completeness, or timeliness of the content. +As a service provider, I am responsible for my own content on these pages under German law § 7 (1) Telemediengesetz. +However, I do not guarantee the accuracy, completeness, or timeliness of the content. ## Liability for External Links -This website contains links to external third-party websites over which we have no control. Therefore, we cannot assume +This website contains links to external third-party websites over which I have no control. Therefore, I cannot assume any liability for such external content. ## Open-Source Notice From 912492287d5d021d910903ada1d67d63476ad3ff Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 9 Dec 2025 00:57:52 +0100 Subject: [PATCH 28/35] restrict managesieve port - thank you Thomas Gauweiler --- .../docs/ispmail-trixie/165-dovecot.mdx | 30 +++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/src/content/docs/ispmail-trixie/165-dovecot.mdx b/src/content/docs/ispmail-trixie/165-dovecot.mdx index 15aefe0..d6aa83d 100644 --- a/src/content/docs/ispmail-trixie/165-dovecot.mdx +++ b/src/content/docs/ispmail-trixie/165-dovecot.mdx @@ -113,8 +113,8 @@ to authenticate your users which is relevant later when we set up _relaying_. Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS between the users and your mail server. You need to tell Dovecot where to find these files. Also set [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent -that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to -override the defaults. +that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to override +the defaults.