Installing a new mailserver: Difference between revisions

From Edgar BV Wiki
Jump to navigation Jump to search
← Older edit
VisualWikitext
 
(27 intermediate revisions by the same user not shown)
Line 1: Line 1:
apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d
You will need these for the mail server
 
apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d automx


pdnsd - use resolvconf configuration
pdnsd - use resolvconf configuration


= Network =
= Network =
Set up networking in /etc/network/interfaces
[[Debian Network Setup]]
 
Ensure your PTR records are set in DNS
<pre>
<pre>
# The loopback network interface
TXT edgarbv.com v=spf1 mx-all
auto lo
AAAA edgarbv.com IPv6address
iface lo inet loopback
MX 10 mail.edgarbv.com edgarbv.com
A edgarbv.com IPv4address
</pre>


# The primary network interface
Certificates for mail.edgarbv.com - see postfix and dovecot
allow-hotplug eth0
#auto eth0
iface eth0 inet static
        address 192.168.0.112
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
#      gateway 192.168.0.1
        dns-nameservers 213.75.63.36 213.75.63.70 192.168.0.1
#      dns-nameservers 192.168.0.1 192.168.0.2
#      dns-search tripnet.int internal.tripnet.int ops.tripnet.int


auto eth1
= Postfix and Procmail =
iface eth1 inet static
First install [[Postfix]] as the mail transport agent
        address 188.204.140.195
        netmask 255.255.255.224
        network 188.204.140.192
        broadcast 188.204.140.223
        gateway 188.204.140.193
        dns-nameservers 213.75.63.36 213.75.63.70 192.168.0.1
</pre>


= Postfix and Procmail =
= Amavis-new + ClamAV =
First install [[Postfix]]
Amavis functions as a postfix addon that filters mail through ClamAV and Spamassassin. [[Amavis-new and ClamAV]]


= Spamassassin =
= Spamassassin =
Then install [[Spamassassin]]
Then configure [[Spamassassin]]


= Dovecot =
= Dovecot =
== v1 ==
Now install [[ Dovecot ]] as an IMAP / POP3 server
Check the following is set, or dovecot won't let people POP / IMAP in
<pre>
protocols = imap imaps pop3 pop3s
</pre>


We need to set it to listen on all interfaces, so uncomment
= Automx =
<pre>
[[ automx ]] sets up a webservice that tells Outlook, Thunderbird and mobile clients how to autodetect the right mailserver settings
listen = *
</pre>


Because we're allowing plaintext auth we need to change
= Roundcube webmail =
<pre>
And install [[ Roundcube ]] for webmail
disable_plaintext_auth = no
</pre>


To set Dovecot to save files in Maildir format and then also use directories to store folders (instead of foldername.mail in one big folder), set NB the documentation says you should use an extra :layout=fs but that breaks just about everything and this way everything is put into subfolders starting with .
= Converting from mbox to maildir =
<pre>
Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at [[Converting from mbox to maildir]]
mail_location = maildir:~/Maildir
</pre>


Ensure the following is set for performance
= Webmail performance =
<pre>
package imapproxy implements UP-IMapProxy
maildir_copy_with_hardlinks = yes
</pre>


Because we're using NFS for mail storage we need to check:
= Iphone Push =
<pre>
package imaprowl implements push for Iphone and Gmail
mmap_disable = yes
dotlock_use_excl = yes # MUST CHECK THIS ONE
mail_nfs_storage = yes
mail_nfs_index = yes
</pre>
 
== v2 ==
in /etc/dovecot/dovecot.conf
<pre>
listen = *, ::
base_dir = /var/run/dovecot/
</pre>
 
in /etc/dovecot/conf.d/
 
10-auth.conf
<pre>
disable_plaintext_auth = no
</pre>
 
10-logging.conf
<pre>
log_path = /var/log/mail/dovecot.err
info_log_path = /var/log/mail/dovecot.info
</pre>
 
10-mail.conf
<pre>
mail_location = maildir:~/Maildir
mmap_disable = yes
dotlock_use_excl = yes
mail_fsync = always
mail_nfs_storage = yes
mail_nfs_index = yes
maildir_copy_with_hardlinks = yes
</pre>
 
== after installation ==
Logging:
<pre>
log_path = /var/log/mail/dovecot.err
info_log_path = /var/log/mail/dovecot.info
</pre>
<pre>
touch /var/log/mail/dovecot.err
touch /var/log/mail/dovecot.info
</pre>
in /etc/logrotate.d/rsyslog add
<pre>
/var/log/mail/dovecot.err
/var/log/mail/dovecot.info
</pre>
to the rest of the mail lines


Create a maildir for www-data manually (dovecot has no permissions to create in /var/www)
= Mobile settings =
Incoming:
<pre>
<pre>
mkdir /var/www/Maildir
Security type: TLS (Accept all certificates)
chown www-data /var/www/Maildir
Port: 143
</pre>
</pre>


To test:
Outgoing:
<pre>
<pre>
mutt -f imap://username@localhost
Hostname: mail.edgarbv.com
mutt -f pop://username@localhost
Security Type: TLS (Accept all certificates)
 
Port: 587
or to open a user's maildir:
Require sign in: on
mutt -m maildir -f ~user/Maildir
</pre>
</pre>


= Roundcube webmail =
Note, TLS will only work for 1 IP adres per hostname. It only gets 1 certificate per IP adres.
We're going to get the backport version as it's much much better


so in /etc/apt/sources.list add
= Spam protection =
<pre>
== SPF ==
deb http://backports.debian.org/debian-backports squeeze-backports main
This implements Sender Policy Framework, a method to check if an email's From comes from an authorised server
</pre>
http://www.openspf.org/Introduction


and to install
[[Sender Policy Framework / SPF]]
<pre>
apt-get -t squeeze-backports install roundcube roundcube-mysql roundcube-plugins roundcube-plugins-extra
</pre>


You will need mysql-server, apache2 and php5 as well.
== DKIM ==
Another trust mechanism http://www.dkim.org/


then in /etc/roundcube/apache.conf
[https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8/ Configure SPF and DKIM With Postfix on Debian 8]
<pre>
uncomment:
    Alias /roundcube/program/js/tiny_mce/ /usr/share/tinymce/www/
    Alias /roundcube /var/lib/roundcube
</pre>


in /etc/roundcube/main.inc.php change
[https://wiki.debian.org/opendkim Debian wiki opendkim]
<pre>
$rcmail_config['htmleditor'] = 0; to 1
$rcmail_config['preview_pane'] = 0; to 1
$rcmail_config['default_host'] = '127.0.0.1';
$rcmail_config['language'] = 'nl_NL';
</pre>


Settings that need looking at and haven't been enabled yet!
Permissions for keyfiles: 640
<pre>
$rcmail_config['smtp_server'] = 'localhost';
$rcmail_config['smtp_user'] = '%u';
$rcmail_config['smtp_pass'] = '%p';
</pre>


in /usr/local/etc/php.ini
if you want multiple subdomains you need to create the keyfiles multiple times
<pre>
<pre>
upload_max_filesize = 5M</pre>
opendkim-genkey -D /etc/postfix/dkim/keys/ -d example.com -s mail
opendkim-genkey -D /etc/postfix/dkim/keys/ -d example.com -s smtp
</pre>https://dmarcguide.globalcyberalliance.org/dkim


== Plugins ==
== DMARC ==
=== virtuser_file ===
A system to tell you what to do with reply messages http://www.dmarc.org/overview.html https://www.sonicwall.com/support/knowledge-base/what-is-a-dmarc-record-and-how-do-i-create-it-on-dns-server/170504796167071/  https://dmarcguide.globalcyberalliance.org/#/dmarc/
This comes with the roundcube-plugins package and makes roundcube read the identities (@domain.ext) from a file in the format:


email@domain.ext user
_dmarc.edgarbv.com. IN TXT "v=DMARC1; p=none; rua=<nowiki>mailto:dmarc@edgarbv.com</nowiki>; ruf=<nowiki>mailto:dmarc@edgarbv.com</nowiki>; sp=none; ri=86400"
email2@domain2.ext user2


If a user has multiple @domain.ext set in the file, then it makes multiple entries you can choose from as your from address.
== Microsoft JMRP and SNDS ==
JMRP (Junk Mail Reporting Partner Program) and SNDS (Smart Network Data Services),


Find in /etc/roundcube/main.inc.php
Enrol here:
<pre>
$rcmail_config['plugins'] = array('virtuser_file');
</pre>
To enable it. and then all the way at the bottom set
<pre>
$rcmail_config['virtuser_file'] = '/etc/postfix/virtual';
</pre>


=== DragnDrop Attachments ===
https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0
You can find that [https://github.com/strimpak/dragndrop_attachments here]


download, then unzip and mv to /var/lib/roundcube/plugins/dragndrop_attachments/
[https://kb.iweb.com/hc/en-us/articles/230267648-Subscribing-to-Microsoft-JMRP-and-SNDS More information about enrolling]


In main.inc.php
= fail2ban =
in /etc/fail2ban/jail.d/jail.local
<pre>
<pre>
$rcmail_config['plugins'] = array('virtuser_file','vcard_attachments','show_additional_headers','emoticons','jqueryui','dragndrop_attachments', 'vacation');
[DEFAULT]
</pre>


== Vacation autoresponder ==
ignoreip = 127.0.0.1/8 91.154.222.134 37.252.124.72/24
Download it from [http://sourceforge.net/projects/rcubevacation/files/ here]
bantime  = 6000


unzip it to /var/lib/roundcube/plugins/vacation/
[proftpd]
enabled  = true


The config.ini should look like this:
[dovecot]
<pre>
enabled = true
[default]
logpath = /var/log/mail/dovecot.info
driver = "ftp"
subject = "Afwezig"
body = "default.txt"
 
[dotforward]
binary = "/usr/bin/vacation"
flags = ""
message = ".vacation.msg"
database = ".vacation.db"
alias_identities = true
set_envelop_sender = false
always_keep_message = true
</pre>


in Roundcube 0.5 the page layout has changed and the plugin displays incorrectly. To fix this, edit
[postfix]
enabled  = true
# To use another modes set filter parameter "mode" in jail.local:
mode    = more
port    = smtp,465,submission
logpath = /var/log/mail/mail.log
maxretry = 5
#backend = %(postfix_backend)s


plugins/vacation/skins/default/vacation.css
[postfix-rbl]
enabled  = true
filter  = postfix[mode=rbl]
port    = smtp,465,submission
logpath  = /var/log/mail/mail.log
#backend  = %(postfix_backend)s
maxretry = 1


and add in some padding:
[postfix-sasl]
<pre>
enabled = true
#pagecontent {
port    = smtp
width: 800px;
filter  = postfix-sasl
padding-top:70px;
logpath = /var/log/mail/mail.log
}
maxretry = 5
</pre>
</pre>
Also edit plugins/vacation/default.txt
Note that it won't save the autoresponder message and subject if you don't tick the checkbox on the top of the page (which we've moved down a bit above)
Finally, add 'vacation' to the $rcmail_config['plugins'] in roundcube main.inc.php
You can find the auto reply in the settings
NB. when testing, you may need to delete the users from the database to check if certain settings are being set before logging in.
= Converting from mbox to maildir =
Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at [[Converting from mbox to maildir]]
= Webmail performance =
package imapproxy implements UP-IMapProxy
= Iphone Push =
package imaprowl implements push for Iphone and Gmail

Latest revision as of 13:51, 20 March 2024

You will need these for the mail server

apt-get install openssh-server proftpd snmpd iotop iptstate atsar postfix shorewall vim awstats bmon nscd sshfs mc zip unzip bzip2 arj spamassassin pyzor razor ncftp rsync quota ntpdate ntp vacation pdnsd dovecot-common dovecot-imapd dovecot-pop3d automx

pdnsd - use resolvconf configuration

Network

Debian Network Setup

Ensure your PTR records are set in DNS 

TXT edgarbv.com v=spf1 mx-all
AAAA edgarbv.com IPv6address
MX 10 mail.edgarbv.com edgarbv.com
A edgarbv.com IPv4address

Certificates for mail.edgarbv.com - see postfix and dovecot

Postfix and Procmail

First install Postfix as the mail transport agent

Amavis-new + ClamAV

Amavis functions as a postfix addon that filters mail through ClamAV and Spamassassin. Amavis-new and ClamAV

Spamassassin

Then configure Spamassassin

Dovecot

Now install Dovecot as an IMAP / POP3 server

Automx

automx sets up a webservice that tells Outlook, Thunderbird and mobile clients how to autodetect the right mailserver settings

Roundcube webmail

And install Roundcube for webmail

Converting from mbox to maildir

Because we want the system to support IMAP functionality fully, there are some changes to to be made which will be documented further. For now, look at Converting from mbox to maildir

Webmail performance

package imapproxy implements UP-IMapProxy

Iphone Push

package imaprowl implements push for Iphone and Gmail

Mobile settings

Incoming: 

Security type: TLS (Accept all certificates)
Port: 143

Outgoing: 

Hostname: mail.edgarbv.com
Security Type: TLS (Accept all certificates)
Port: 587
Require sign in: on

Note, TLS will only work for 1 IP adres per hostname. It only gets 1 certificate per IP adres.

Spam protection

SPF

This implements Sender Policy Framework, a method to check if an email's From comes from an authorised server http://www.openspf.org/Introduction

Sender Policy Framework / SPF

DKIM

Another trust mechanism http://www.dkim.org/

Configure SPF and DKIM With Postfix on Debian 8

Debian wiki opendkim

Permissions for keyfiles: 640

if you want multiple subdomains you need to create the keyfiles multiple times 

opendkim-genkey -D /etc/postfix/dkim/keys/ -d example.com -s mail 
opendkim-genkey -D /etc/postfix/dkim/keys/ -d example.com -s smtp

https://dmarcguide.globalcyberalliance.org/dkim

DMARC

A system to tell you what to do with reply messages http://www.dmarc.org/overview.html https://www.sonicwall.com/support/knowledge-base/what-is-a-dmarc-record-and-how-do-i-create-it-on-dns-server/170504796167071/ https://dmarcguide.globalcyberalliance.org/#/dmarc/

_dmarc.edgarbv.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@edgarbv.com; ruf=mailto:dmarc@edgarbv.com; sp=none; ri=86400"

Microsoft JMRP and SNDS

JMRP (Junk Mail Reporting Partner Program) and SNDS (Smart Network Data Services),

Enrol here:

https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0

More information about enrolling

fail2ban

in /etc/fail2ban/jail.d/jail.local 

[DEFAULT]

ignoreip = 127.0.0.1/8 91.154.222.134 37.252.124.72/24
bantime  = 6000

[proftpd]
enabled  = true

[dovecot]
enabled = true
logpath = /var/log/mail/dovecot.info

[postfix]
enabled  = true
# To use another modes set filter parameter "mode" in jail.local:
mode    = more
port    = smtp,465,submission
logpath = /var/log/mail/mail.log
maxretry = 5
#backend = %(postfix_backend)s

[postfix-rbl]
enabled  = true
filter   = postfix[mode=rbl]
port     = smtp,465,submission
logpath  = /var/log/mail/mail.log
#backend  = %(postfix_backend)s
maxretry = 1

[postfix-sasl]
enabled = true
port    = smtp
filter  = postfix-sasl
logpath = /var/log/mail/mail.log
maxretry = 5
Retrieved from "http://wiki.edgarbv.com/index.php?title=Installing_a_new_mailserver&oldid=37741"