Installing a new mailserver: Difference between revisions

From Edgar BV Wiki
Jump to navigation Jump to search
← Older editNewer edit →
Visual
(48 intermediate revisions by the same user not shown)
Line 1: Line 1:
apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d
You will need these for the mail server
 
apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d automx


pdnsd - use resolvconf configuration
pdnsd - use resolvconf configuration


= Network =
= Network =
Set up networking in /etc/network/interfaces
[[Debian Network Setup]]
 
Ensure your PTR records are set in DNS
<pre>
<pre>
# The loopback network interface
TXT edgarbv.com v=spf1 mx-all
auto lo
AAAA edgarbv.com IPv6address
iface lo inet loopback
MX 10 mail.edgarbv.com edgarbv.com
A edgarbv.com IPv4address
</pre>


# The primary network interface
Certificates for mail.edgarbv.com - see postfix and dovecot
allow-hotplug eth0
#auto eth0
iface eth0 inet static
        address 192.168.0.112
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
#      gateway 192.168.0.1
        dns-nameservers 213.75.63.36 213.75.63.70 192.168.0.1
#      dns-nameservers 192.168.0.1 192.168.0.2
#      dns-search tripnet.int internal.tripnet.int ops.tripnet.int


auto eth1
= Postfix and Procmail =
iface eth1 inet static
First install [[Postfix]] as the mail transport agent
        address 188.204.140.195
        netmask 255.255.255.224
        network 188.204.140.192
        broadcast 188.204.140.223
        gateway 188.204.140.193
        dns-nameservers 213.75.63.36 213.75.63.70 192.168.0.1
</pre>


= Postfix and Procmail =
= Amavis-new + ClamAV =
First install [[Postfix]]
Amavis functions as a postfix addon that filters mail through ClamAV and Spamassassin. [[Amavis-new and ClamAV]]


= Spamassassin =
= Spamassassin =
Then install [[Spamassassin]]
Then configure [[Spamassassin]]


= Dovecot =
= Dovecot =
== v1 ==
Now install [[ Dovecot ]] as an IMAP / POP3 server
Check the following is set, or dovecot won't let people POP / IMAP in
 
<pre>
= Automx =
protocols = imap imaps pop3 pop3s
[[ automx ]] sets up a webservice that tells Outlook, Thunderbird and mobile clients how to autodetect the right mailserver settings
</pre>
 
= Roundcube webmail =
And install [[ Roundcube ]] for webmail
 
= Converting from mbox to maildir =
Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at [[Converting from mbox to maildir]]
 
= Webmail performance =
package imapproxy implements UP-IMapProxy
 
= Iphone Push =
package imaprowl implements push for Iphone and Gmail


We need to set it to listen on all interfaces, so uncomment
= Mobile settings =
Incoming:
<pre>
<pre>
listen = *
Security type: TLS (Accept all certificates)
Port: 143
</pre>
</pre>


Because we're allowing plaintext auth we need to change
Outgoing:
<pre>
<pre>
disable_plaintext_auth = no
Hostname: mail.edgarbv.com
Security Type: TLS (Accept all certificates)
Port: 587
Require sign in: on
</pre>
</pre>


To set Dovecot to save files in Maildir format and then also use directories to store folders (instead of foldername.mail in one big folder), set NB the documentation says you should use an extra :layout=fs but that breaks just about everything and this way everything is put into subfolders starting with .
Note, TLS will only work for 1 IP adres per hostname. It only gets 1 certificate per IP adres.
<pre>
mail_location = maildir:~/Maildir
</pre>


Ensure the following is set for performance
= Spam protection =
<pre>
https://dmarcguide.globalcyberalliance.org/ tests your SPF / DKIM / DMARC / BIMI and TLS and has guides on how to implement them.
maildir_copy_with_hardlinks = yes
</pre>


Because we're using NFS for mail storage we need to check:
== SPF ==
<pre>
This implements Sender Policy Framework, a method to check if an email's From comes from an authorised server
mmap_disable = yes
http://www.openspf.org/Introduction
dotlock_use_excl = yes # MUST CHECK THIS ONE
mail_nfs_storage = yes
mail_nfs_index = yes
</pre>


== v2 ==
[[Sender Policy Framework / SPF]]
apt-get -t squeeze-backports --no-install-recommends install dovecot-common dovecot-core dovecot-imapd dovecot-pop3d


== DKIM ==
Another trust mechanism http://www.dkim.org/


in /etc/dovecot/dovecot.conf
/etc/opendkim.conf
<pre>
<pre>
listen = *, ::
Syslog                  yes
base_dir = /var/run/dovecot/
SyslogSuccess          yes
</pre>
 
Mode                    sv
SubDomains              no


in /etc/dovecot/conf.d/
# Specify the list of keys
KeyTable file:/etc/dkimkeys/keytable
# Match keys and domains. To use regular expressions in the file, use refile: instead of file:
SigningTable refile:/etc/dkimkeys/signingtable
# Match a list of hosts whose messages will be signed. By default, only localhost is considered as internal host.
InternalHosts refile:/etc/dkimkeys/trustedhosts


10-auth.conf
Socket                  inet:8891@localhost
<pre>
disable_plaintext_auth = no
</pre>
</pre>


10-logging.conf
/etc/dkimkeys/trustedhosts
<pre>
<pre>
log_path = /var/log/mail/dovecot.err
127.0.0.1
info_log_path = /var/log/mail/dovecot.info
10.1.0.0/16
1.2.3.4/24
</pre>
</pre>


10-mail.conf
In /etc/postfix/main.cf
<pre>
<pre>
mail_location = maildir:~/Maildir
#For opendkim
mmap_disable = yes
smtpd_milters = inet:localhost:8891
dotlock_use_excl = yes
non_smtpd_milters = $smtpd_milters
mail_fsync = always
milter_default_action = accept
mail_nfs_storage = yes
mail_nfs_index = yes
maildir_copy_with_hardlinks = yes
</pre>
</pre>


== after installation ==
Generate the key (nb probably don't use '.' in the selector)
Logging:
<pre>
<pre>
log_path = /var/log/mail/dovecot.err
sudo --user opendkim opendkim-genkey -D /etc/dkimkeys -s YYYY_domain_ext -d edgarbv.com
info_log_path = /var/log/mail/dovecot.info
</pre>
<pre>
<pre>
touch /var/log/mail/dovecot.err
or a longer version of this:
touch /var/log/mail/dovecot.info
</pre>
in /etc/logrotate.d/rsyslog add
<pre>
<pre>
/var/log/mail/dovecot.err
sudo --user opendkim opendkim-genkey --directory=/etc/dkimkeys --selector 2025_edgarbv_com --nosubdomains --domain=edgarbv.com
/var/log/mail/dovecot.info
</pre>
</pre>
to the rest of the mail lines


Create a maildir for www-data manually (dovecot has no permissions to create in /var/www)
In /etc/dkimkeys/keytable you need to add all your private keys in the format - this maps the domain txt entry to the keyfile.
<pre>
<pre>
mkdir /var/www/Maildir
selector._domainkey.domain.ext domain.ext:selector:/etc/dkimkeys/selector.private
chown www-data /var/www/Maildir
</pre>
</pre>


To test:
In /etc/dkimkeys/signingtable you map senders (by default, taken from the
From: header field of a message passing through the filter) to which keys will be used to sign their mail.  Wildcards are allowed for each domain
<pre>
<pre>
mutt -f imap://username@localhost
# Domain yourdomain.org
mutt -f pop://username@localhost
*@edgarbv.com 2025_edgarbv_com._domainkey.edgarbv.com
 
# You can specify multiple domains
or to open a user's maildir:
# Example.net www._domainkey.example.net
mutt -m maildir -f ~user/Maildir
</pre>
</pre>


= Roundcube webmail =
reload opendkim
We're going to get the backport version as it's much much better


so in /etc/apt/sources.list add
Add it to your SOA from /etc/dkimkeys/selector.txt (get rid of all " and enters and everything in front of and after the () )
<pre>
<pre>
deb http://backports.debian.org/debian-backports squeeze-backports main
selector._domainkey.domainext TXT v=DKIM1; h=sha256; k=rsa; t=s; v=DKIM1; h=sha256; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmxx3VYFe6f/1aunjZHp4WinOmS29t1EV4VIIvKP7P2aVtlvGxghBluJAkdkhUr20o8Mu/bfyW57JZ0eTKkLS7B0aWVlZlVdb4Qi/gFze3f0fh2ly9SBHRe2FQj4eK4A9Bd+GDBBeS4gQMgeYe38+Pa9LxNQWzyeKv47Isbmk/ffboylhOSKgLO97GHZxl/6qAHUu57bviEtk17/jNRxeBvs7sAqO++3qX/ky5NMObw+sjNa/swD9uG6pIVFpQ7NZbz390UoHj95CuTxZMbtyELRxkcvl0Axq1WXW35M74x2DNOJA0YaJof1X3zbSVSAvwVZ4WvXs7XrZupZ704hVcQIDAQAB
</pre>
</pre>


and to install
check this has gone right by
<pre>
<pre>
apt-get -t squeeze-backports install roundcube roundcube-mysql roundcube-plugins roundcube-plugins-extra
dig selector._domainkey.domain.ext txt
</pre>
</pre>
then


You will need mysql-server, apache2 and php5 as well.
test by sending an email to check-auth@verifier.port25.com and it should respond with a report


then in /etc/roundcube/apache.conf
and
<pre>
<pre>
uncomment:
opendkim-testkey -v -v
    Alias /roundcube/program/js/tiny_mce/ /usr/share/tinymce/www/
 
    Alias /roundcube /var/lib/roundcube
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: record 0 for 'mail._domainkey.edgarbv.com' retrieved
opendkim-testkey: checking key 'mail._domainkey.edgarbv.com'
opendkim-testkey: key mail._domainkey.edgarbv.com secure
opendkim-testkey: 1 key checked; 1 pass, 0 fail
</pre>
</pre>


in /etc/roundcube/main.inc.php change
If you get
<pre>
<pre>
$rcmail_config['htmleditor'] = 0; to 1
opendkim-testkey: using default configfile /etc/opendkim.conf
$rcmail_config['preview_pane'] = 0; to 1
opendkim-testkey: record 0 for 'mail._domainkey.edgarbv.com' retrieved
$rcmail_config['default_host'] = '127.0.0.1';
opendkim-testkey: checking key 'mail._domainkey.edgarbv.com'
$rcmail_config['language'] = 'nl_NL';
opendkim-testkey: key mail._domainkey.edgarbv.com: keys do not match
opendkim-testkey: key mail._domainkey.edgarbv.com secure
</pre>
</pre>
It is saying that the key information in the key in /etc/dkimkeys is not the same as the DNS record TXT information.


Settings that need looking at and haven't been enabled yet!
[https://wiki.debian.org/opendkim Debian wiki opendkim]
<pre>
$rcmail_config['smtp_server'] = 'localhost';
$rcmail_config['smtp_user'] = '%u';
$rcmail_config['smtp_pass'] = '%p';
</pre>


in /usr/local/etc/php.ini
http://www.opendkim.org/opendkim-README
<pre>
upload_max_filesize = 5M</pre>


== Plugins ==
[https://www.frontline.ro/en/blog/how-to-configure-opendkim-with-postfix-on-debian-12-bookworm] includes a script to spit out the DNS record
=== virtuser_file ===
This comes with the roundcube-plugins package and makes roundcube read the identities (@domain.ext) from a file in the format:


email@domain.ext user
[https://www.server-world.info/en/note?os=Debian_12&p=mail&f=11] shows opendkim-testkey -d srv.world -s 20240712 -vvv use
email2@domain2.ext user2


If a user has multiple @domain.ext set in the file, then it makes multiple entries you can choose from as your from address.
Permissions for keyfiles: 640


Find in /etc/roundcube/main.inc.php
if you want multiple subdomains you need to create the keyfiles multiple times
<pre>
<pre>
$rcmail_config['plugins'] = array('virtuser_file');
opendkim-genkey -D /etc/dkimkeys -d mail.example.com -s mail.example.com
</pre>
opendkim-genkey -D /etc/dkimkeys -d smtp.example.com -s smtp.example.com
To enable it. and then all the way at the bottom set
</pre>https://dmarcguide.globalcyberalliance.org/dkim
<pre>
$rcmail_config['virtuser_file'] = '/etc/postfix/virtual';
</pre>


=== DragnDrop Attachments ===
== DMARC ==
You can find that [https://github.com/strimpak/dragndrop_attachments here]
A system to tell you what to do with reply messages http://www.dmarc.org/overview.html https://www.sonicwall.com/support/knowledge-base/what-is-a-dmarc-record-and-how-do-i-create-it-on-dns-server/170504796167071/  https://dmarcguide.globalcyberalliance.org/#/dmarc/  


download, then unzip and mv to /var/lib/roundcube/plugins/dragndrop_attachments/
_dmarc.edgarbv.com. IN TXT "v=DMARC1; p=none; rua=<nowiki>mailto:dmarc@edgarbv.com</nowiki>; ruf=<nowiki>mailto:dmarc@edgarbv.com</nowiki>; sp=none; ri=86400"


In main.inc.php
== Microsoft JMRP and SNDS ==
<pre>
JMRP (Junk Mail Reporting Partner Program) and SNDS (Smart Network Data Services),
$rcmail_config['plugins'] = array('virtuser_file','vcard_attachments','show_additional_headers','emoticons','jqueryui','dragndrop_attachments', 'vacation');
</pre>


== Vacation autoresponder ==
Enrol here:
Download it from [http://sourceforge.net/projects/rcubevacation/files/ here]


unzip it to /var/lib/roundcube/plugins/vacation/
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0


The config.ini should look like this:
[https://kb.iweb.com/hc/en-us/articles/230267648-Subscribing-to-Microsoft-JMRP-and-SNDS More information about enrolling]
<pre>
[default]
driver = "ftp"
subject = "Afwezig"
body = "default.txt"


[dotforward]
= fail2ban =
binary = "/usr/bin/vacation"
Also see [[Debian Standard Packages to install afterwards#fail2ban]]
flags = ""
message = ".vacation.msg"
database = ".vacation.db"
alias_identities = true
set_envelop_sender = false
always_keep_message = true
</pre>


in Roundcube 0.5 the page layout has changed and the plugin displays incorrectly. To fix this, edit
in /etc/fail2ban/jail.local
 
plugins/vacation/skins/default/vacation.css
 
and add in some padding:
<pre>
<pre>
#pagecontent {
[dovecot]
width: 800px;
enabled = true
padding-top:70px;
logpath = /var/log/mail/dovecot.info
}
</pre>


Also edit plugins/vacation/default.txt
[postfix]
enabled  = true


Note that it won't save the autoresponder message and subject if you don't tick the checkbox on the top of the page (which we've moved down a bit above)
[postfix-rbl]
enabled  = true


Finally, add 'vacation' to the $rcmail_config['plugins'] in roundcube main.inc.php
[postfix-sasl]
 
enabled = true
You can find the auto reply in the settings
findtime = 1d
 
maxretry = 3
NB. when testing, you may need to delete the users from the database to check if certain settings are being set before logging in.
bantime = 5d
 
</pre>
= Converting from mbox to maildir =
Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at [[Converting from mbox to maildir]]
 
= Webmail performance =
package imapproxy implements UP-IMapProxy
 
= Iphone Push =
package imaprowl implements push for Iphone and Gmail

Revision as of 07:19, 30 March 2025

You will need these for the mail server

apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d automx

pdnsd - use resolvconf configuration

Network

Debian Network Setup

Ensure your PTR records are set in DNS 

TXT edgarbv.com v=spf1 mx-all
AAAA edgarbv.com IPv6address
MX 10 mail.edgarbv.com edgarbv.com
A edgarbv.com IPv4address

Certificates for mail.edgarbv.com - see postfix and dovecot

Postfix and Procmail

First install Postfix as the mail transport agent

Amavis-new + ClamAV

Amavis functions as a postfix addon that filters mail through ClamAV and Spamassassin. Amavis-new and ClamAV

Spamassassin

Then configure Spamassassin

Dovecot

Now install Dovecot as an IMAP / POP3 server

Automx

automx sets up a webservice that tells Outlook, Thunderbird and mobile clients how to autodetect the right mailserver settings

Roundcube webmail

And install Roundcube for webmail

Converting from mbox to maildir

Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at Converting from mbox to maildir

Webmail performance

package imapproxy implements UP-IMapProxy

Iphone Push

package imaprowl implements push for Iphone and Gmail

Mobile settings

Incoming: 

Security type: TLS (Accept all certificates)
Port: 143

Outgoing: 

Hostname: mail.edgarbv.com
Security Type: TLS (Accept all certificates)
Port: 587
Require sign in: on

Note, TLS will only work for 1 IP adres per hostname. It only gets 1 certificate per IP adres.

Spam protection

https://dmarcguide.globalcyberalliance.org/ tests your SPF / DKIM / DMARC / BIMI and TLS and has guides on how to implement them.

SPF

This implements Sender Policy Framework, a method to check if an email's From comes from an authorised server http://www.openspf.org/Introduction

Sender Policy Framework / SPF

DKIM

Another trust mechanism http://www.dkim.org/

/etc/opendkim.conf 

Syslog                  yes
SyslogSuccess           yes

Mode                    sv
SubDomains              no

# Specify the list of keys
KeyTable file:/etc/dkimkeys/keytable
# Match keys and domains. To use regular expressions in the file, use refile: instead of file:
SigningTable refile:/etc/dkimkeys/signingtable 
# Match a list of hosts whose messages will be signed. By default, only localhost is considered as internal host.
InternalHosts refile:/etc/dkimkeys/trustedhosts

Socket                  inet:8891@localhost

/etc/dkimkeys/trustedhosts 

127.0.0.1
10.1.0.0/16
1.2.3.4/24

In /etc/postfix/main.cf 

#For opendkim
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

Generate the key (nb probably don't use '.' in the selector) 

sudo --user opendkim opendkim-genkey -D /etc/dkimkeys -s YYYY_domain_ext -d edgarbv.com
<pre>
or a longer version of this:
<pre>
sudo --user opendkim opendkim-genkey --directory=/etc/dkimkeys --selector 2025_edgarbv_com --nosubdomains --domain=edgarbv.com

In /etc/dkimkeys/keytable you need to add all your private keys in the format - this maps the domain txt entry to the keyfile. 

selector._domainkey.domain.ext domain.ext:selector:/etc/dkimkeys/selector.private

In /etc/dkimkeys/signingtable you map senders (by default, taken from the From: header field of a message passing through the filter) to which keys will be used to sign their mail. Wildcards are allowed for each domain 

# Domain yourdomain.org
*@edgarbv.com 2025_edgarbv_com._domainkey.edgarbv.com
# You can specify multiple domains
# Example.net www._domainkey.example.net

reload opendkim

Add it to your SOA from /etc/dkimkeys/selector.txt (get rid of all " and enters and everything in front of and after the () ) 

selector._domainkey.domainext TXT v=DKIM1; h=sha256; k=rsa; t=s; v=DKIM1; h=sha256; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmxx3VYFe6f/1aunjZHp4WinOmS29t1EV4VIIvKP7P2aVtlvGxghBluJAkdkhUr20o8Mu/bfyW57JZ0eTKkLS7B0aWVlZlVdb4Qi/gFze3f0fh2ly9SBHRe2FQj4eK4A9Bd+GDBBeS4gQMgeYe38+Pa9LxNQWzyeKv47Isbmk/ffboylhOSKgLO97GHZxl/6qAHUu57bviEtk17/jNRxeBvs7sAqO++3qX/ky5NMObw+sjNa/swD9uG6pIVFpQ7NZbz390UoHj95CuTxZMbtyELRxkcvl0Axq1WXW35M74x2DNOJA0YaJof1X3zbSVSAvwVZ4WvXs7XrZupZ704hVcQIDAQAB

check this has gone right by 

dig selector._domainkey.domain.ext txt

then

test by sending an email to check-auth@verifier.port25.com and it should respond with a report

and 

opendkim-testkey -v -v

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: record 0 for 'mail._domainkey.edgarbv.com' retrieved
opendkim-testkey: checking key 'mail._domainkey.edgarbv.com'
opendkim-testkey: key mail._domainkey.edgarbv.com secure
opendkim-testkey: 1 key checked; 1 pass, 0 fail

If you get 

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: record 0 for 'mail._domainkey.edgarbv.com' retrieved
opendkim-testkey: checking key 'mail._domainkey.edgarbv.com'
opendkim-testkey: key mail._domainkey.edgarbv.com: keys do not match
opendkim-testkey: key mail._domainkey.edgarbv.com secure

It is saying that the key information in the key in /etc/dkimkeys is not the same as the DNS record TXT information.

Debian wiki opendkim

http://www.opendkim.org/opendkim-README

[1] includes a script to spit out the DNS record

[2] shows opendkim-testkey -d srv.world -s 20240712 -vvv use

Permissions for keyfiles: 640

if you want multiple subdomains you need to create the keyfiles multiple times 

opendkim-genkey -D /etc/dkimkeys -d mail.example.com -s mail.example.com
opendkim-genkey -D /etc/dkimkeys -d smtp.example.com -s smtp.example.com

https://dmarcguide.globalcyberalliance.org/dkim

DMARC

A system to tell you what to do with reply messages http://www.dmarc.org/overview.html https://www.sonicwall.com/support/knowledge-base/what-is-a-dmarc-record-and-how-do-i-create-it-on-dns-server/170504796167071/ https://dmarcguide.globalcyberalliance.org/#/dmarc/

_dmarc.edgarbv.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@edgarbv.com; ruf=mailto:dmarc@edgarbv.com; sp=none; ri=86400"

Microsoft JMRP and SNDS

JMRP (Junk Mail Reporting Partner Program) and SNDS (Smart Network Data Services),

Enrol here:

https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0

More information about enrolling

fail2ban

Also see Debian Standard Packages to install afterwards#fail2ban

in /etc/fail2ban/jail.local 

[dovecot]
enabled = true
logpath = /var/log/mail/dovecot.info

[postfix]
enabled  = true

[postfix-rbl]
enabled  = true

[postfix-sasl]
enabled = true
findtime = 1d
maxretry = 3
bantime = 5d
Retrieved from "http://wiki.edgarbv.com/index.php?title=Installing_a_new_mailserver&oldid=37893"