E-mail server section - Revision history

Saruman!: /* Inserting data */

2016-02-22T10:35:02Z

Inserting data

← Older revision		Revision as of 10:35, 22 February 2016
Line 90:		Line 90:

	Should you need to update a user's password from the command line, you can use the following command, provided you've looked up that user's ''id'' :		Should you need to update a user's password from the command line, you can use the following command, provided you've looked up that user's ''id'' :
	UPDATE virtual_users set passwd = 'MD5('<password>')' WHERE id = '<id>';		UPDATE virtual_users set passwd = MD5('<password>') WHERE id = '<id>';

	Next up, we're going to add some aliases, which are alternative e-mail addresses for the users; their primary e-mail address can already be seen in the ''view_users'' view, but perhaps you also want mail to "webmaster@shop.saruman.biz" to arrive at one or more mailboxes, e.g. in the mailbox for user "shopkeeper" (within domain "shop.saruman.biz") and this guy's home address ("j.doe@example.com"). Furthermore, we'll define catchall-addresses for all domains, that'll send all mail for which no mailbox can be found to the mailbox of user Mike (for the first two domains) and Webmaster (for shop.saruman.biz; Webmaster himself is an alias yet again, that points to shopkeeper@shop.saruman.biz). To create the catchall, leave out a value for the source address. This creates the empty value for source that will be expanded (using source@domain) to "@domain".		Next up, we're going to add some aliases, which are alternative e-mail addresses for the users; their primary e-mail address can already be seen in the ''view_users'' view, but perhaps you also want mail to "webmaster@shop.saruman.biz" to arrive at one or more mailboxes, e.g. in the mailbox for user "shopkeeper" (within domain "shop.saruman.biz") and this guy's home address ("j.doe@example.com"). Furthermore, we'll define catchall-addresses for all domains, that'll send all mail for which no mailbox can be found to the mailbox of user Mike (for the first two domains) and Webmaster (for shop.saruman.biz; Webmaster himself is an alias yet again, that points to shopkeeper@shop.saruman.biz). To create the catchall, leave out a value for the source address. This creates the empty value for source that will be expanded (using source@domain) to "@domain".

Saruman!: /* Inserting data */

2016-02-22T10:32:40Z

Inserting data

← Older revision		Revision as of 10:32, 22 February 2016
Line 88:		Line 88:
	mysql> select * from virtual_users;		mysql> select * from virtual_users;
	mysql> select * from view_users;		mysql> select * from view_users;

			Should you need to update a user's password from the command line, you can use the following command, provided you've looked up that user's ''id'' :
			UPDATE virtual_users set passwd = 'MD5('<password>')' WHERE id = '<id>';

	Next up, we're going to add some aliases, which are alternative e-mail addresses for the users; their primary e-mail address can already be seen in the ''view_users'' view, but perhaps you also want mail to "webmaster@shop.saruman.biz" to arrive at one or more mailboxes, e.g. in the mailbox for user "shopkeeper" (within domain "shop.saruman.biz") and this guy's home address ("j.doe@example.com"). Furthermore, we'll define catchall-addresses for all domains, that'll send all mail for which no mailbox can be found to the mailbox of user Mike (for the first two domains) and Webmaster (for shop.saruman.biz; Webmaster himself is an alias yet again, that points to shopkeeper@shop.saruman.biz). To create the catchall, leave out a value for the source address. This creates the empty value for source that will be expanded (using source@domain) to "@domain".		Next up, we're going to add some aliases, which are alternative e-mail addresses for the users; their primary e-mail address can already be seen in the ''view_users'' view, but perhaps you also want mail to "webmaster@shop.saruman.biz" to arrive at one or more mailboxes, e.g. in the mailbox for user "shopkeeper" (within domain "shop.saruman.biz") and this guy's home address ("j.doe@example.com"). Furthermore, we'll define catchall-addresses for all domains, that'll send all mail for which no mailbox can be found to the mailbox of user Mike (for the first two domains) and Webmaster (for shop.saruman.biz; Webmaster himself is an alias yet again, that points to shopkeeper@shop.saruman.biz). To create the catchall, leave out a value for the source address. This creates the empty value for source that will be expanded (using source@domain) to "@domain".

Saruman!: /* E-mail server setup */ updated link to source article

2014-02-04T20:58:37Z

E-mail server setup: updated link to source article

← Older revision		Revision as of 20:58, 4 February 2014
Line 7:		Line 7:
	* can have multiple aliases per mailbox		* can have multiple aliases per mailbox
	* can forward mail for certain aliases to multiple mailboxes		* can forward mail for certain aliases to multiple mailboxes
	For this type of mail server setup, we owe a great thankyou to [~~http~~://workaround.org~~/articles~~/ispmail~~-etch~~/ Christoph Haas], whose advise has helped us create flexible and reliable mail servers since 2003.		For this type of mail server setup, we owe a great thankyou to [https://workaround.org/ispmail/squeeze Christoph Haas], whose advise has helped us create flexible and reliable mail servers since 2003.

	==Preparation==		==Preparation==

Insomnia: /* Dovecot default configuration */

2009-08-29T08:02:46Z

Dovecot default configuration

← Older revision		Revision as of 08:02, 29 August 2009
Line 223:		Line 223:
	global_script_path = /data/vmail/globalsieverc		global_script_path = /data/vmail/globalsieverc
	}		}

			You could change the log path to "log_path =" With a empty logpath syslog will log the events.

	Now that we've finished the Dovecot configuration file, we need to create a fitting MySQL configuration file for Dovecot. The file is ''/etc/dovecot/dovecot-sql.conf'', and its contents are		Now that we've finished the Dovecot configuration file, we need to create a fitting MySQL configuration file for Dovecot. The file is ''/etc/dovecot/dovecot-sql.conf'', and its contents are
Line 234:		Line 236:
	chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf		chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf
	/etc/init.d/dovecot restart		/etc/init.d/dovecot restart

			To get some more logging in the case something goes wrong. Uncomment the folling and change to yes.
			auth_verbose = yes
			auth_debug = yes
			auth_debug_passwords = yes

	===Dovecot SSL configuration===		===Dovecot SSL configuration===

Insomnia: /* Dovecot default configuration */

2009-08-28T07:13:22Z

Dovecot default configuration

← Older revision		Revision as of 07:13, 28 August 2009
Line 175:		Line 175:
	Now to configure Dovecot itself: open ''/etc/dovecot/dovecot.conf'' with your favourite editor [[vim]]; first make sure the ''protocols ='' line reads		Now to configure Dovecot itself: open ''/etc/dovecot/dovecot.conf'' with your favourite editor [[vim]]; first make sure the ''protocols ='' line reads
	protocols = imap imaps pop3 pop3s		protocols = imap imaps pop3 pop3s
	(which it should by default). The second setting is quite crucial. By default, the location of the mail directories is found automatically by Dovecot, but here that won't work. Find the line that reads ''#~~maildir_location~~ ='', and change it to		(which it should by default). The second setting is quite crucial. By default, the location of the mail directories is found automatically by Dovecot, but here that won't work. Find the line that reads ''#mail_location ='', and change it to
	mail_location = maildir:/data/vmail/%d/%n/Maildir		mail_location = maildir:/data/vmail/%d/%n/Maildir
	This will look for mail in directory ''/data/vmail/'''DOMAIN'''/'''USER'''/Maildir'', and expect this directory to be in "maildir" format.		This will look for mail in directory ''/data/vmail/'''DOMAIN'''/'''USER'''/Maildir'', and expect this directory to be in "maildir" format.
Line 234:		Line 234:
	chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf		chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf
	/etc/init.d/dovecot restart		/etc/init.d/dovecot restart

	===Dovecot SSL configuration===		===Dovecot SSL configuration===
	Out of the (Debian) box, Dovecot is SSL-enabled. We'll now replace the generic SSL-certificate, generated for the host by the Dovecot installation script, by our own certificate. To ths end, we first [[Creating_digital_certificates_with_our_root_certificate \| generate an appropriate certificate]], e.g. an SSL wildcard certificate: "*.saruman.biz". This results in a public and a private certificate, both of which must be placed somewhere where Dovecot expects them and can read them.		Out of the (Debian) box, Dovecot is SSL-enabled. We'll now replace the generic SSL-certificate, generated for the host by the Dovecot installation script, by our own certificate. To ths end, we first [[Creating_digital_certificates_with_our_root_certificate \| generate an appropriate certificate]], e.g. an SSL wildcard certificate: "*.saruman.biz". This results in a public and a private certificate, both of which must be placed somewhere where Dovecot expects them and can read them.

Saruman!: /* Finishing up */ with SSL for postfix

2009-01-17T16:03:43Z

Finishing up: with SSL for postfix

← Older revision		Revision as of 16:03, 17 January 2009
Line 265:		Line 265:
	If TLS works, you'll probably want to change the certificate as you have for Dovecot in the previous section. This is again pretty easy. If you haven't yet, now is the time to [[Creating_digital_certificates_with_our_root_certificate \| creating that custom SSL certificate]] for our mail server - but you have to make sure that you DON'T use a password on the private key. Unlike Dovecot, Postfix cannot be told the password to the private key somewhere.		If TLS works, you'll probably want to change the certificate as you have for Dovecot in the previous section. This is again pretty easy. If you haven't yet, now is the time to [[Creating_digital_certificates_with_our_root_certificate \| creating that custom SSL certificate]] for our mail server - but you have to make sure that you DON'T use a password on the private key. Unlike Dovecot, Postfix cannot be told the password to the private key somewhere.

	For starters, look at the TLS-section of your ''main.cf'' that you currently have. Chances are it looks ~~a bit~~ like this:		For starters, look at the TLS-section of your ''main.cf'' that you currently have. Chances are a big chunk of it looks like this:
	# TLS parameters		# TLS parameters
	smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem		smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
	smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key		smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
	smtpd_use_tls=yes		smtpd_use_tls=yes
			Now all you need to do is replace the name of the snakeoil-keys with those of appropriate ssl-certificates, the private key of which needs to be NOT passphrase-protected. For this you could copy the Dovecot certificates, if you strip that passphrase in the manner described in the [[Creating_digital_certificates_with_our_root_certificate#Creating_an_SSL_certificate \| SSL certificate section]]. The ''main.cf'' then would become:
			# TLS parameters
			smtpd_tls_cert_file=/etc/ssl/certs/postfix.pem
			smtpd_tls_key_file=/etc/ssl/private/postfix.key
			smtpd_use_tls=yes
			Restart Postfix, and presto.


	=== Other additions ===		=== Other additions ===

	If everything ''still'' works after these changes, then congratulations, you now have a powerful, flexible and pretty secure mail setup. Of course, there are always points for improvements. We'll cover these in separate pages. One page that we want to direct you to now, is		If everything ''still'' works after these changes, then congratulations, you now have a powerful, flexible and pretty secure mail setup. Of course, there are always points for improvements. We'll cover these in separate pages. One page that we want to direct you to now, is
	* [[Antispam measures]] for our Postfix mailserver		* [[Antispam measures]] for our Postfix mailserver

Saruman!: /* Finishing up */ begun Postfix TLS cert

2009-01-13T19:37:25Z

Finishing up: begun Postfix TLS cert

← Older revision		Revision as of 19:37, 13 January 2009
Line 253:		Line 253:
	==Finishing up==		==Finishing up==

	This is a good moment to test your configuration, if you haven't been able to test your work inbetween. If everything works as expected, you can add bells and whistles to your configuration. The first ~~one~~ we'd like to present covers the way Postfix handles incoming connections. Since authentication works, we can have Postfix distrust every (unauthenticated) connection:		This is a good moment to test your configuration, if you haven't been able to test your work inbetween. If everything works as expected, you can add bells and whistles to your configuration.

			===''smtpd'' TLS encryption===
			The first addition we'd like to present covers the way Postfix handles incoming connections. Since authentication works, we can have Postfix distrust every (unauthenticated) connection:
	postconf -e mynetworks=		postconf -e mynetworks=
	Furthermore, since a default SSL certificate is installed by the Debian Postfix installation routine, we can encrypt all our connections using TLS; we enforce this using		Furthermore, since a default SSL certificate is installed by the Debian Postfix installation routine, we can encrypt all our connections using TLS; we enforce this using
Line 260:		Line 263:
	Of course, you need to adjust the settings of your IMAP client so that it properly uses TLS and properly authenticates itself.		Of course, you need to adjust the settings of your IMAP client so that it properly uses TLS and properly authenticates itself.

	If everything ''still'' works after these changes, then congratulations, you now have a powerful, flexible and pretty secure mail setup. Of course, there are always points for improvements. We'll cover these in separate pages. ~~Two pages~~ that we want to direct you to now, ~~are~~		If TLS works, you'll probably want to change the certificate as you have for Dovecot in the previous section. This is again pretty easy. If you haven't yet, now is the time to [[Creating_digital_certificates_with_our_root_certificate \| creating that custom SSL certificate]] for our mail server - but you have to make sure that you DON'T use a password on the private key. Unlike Dovecot, Postfix cannot be told the password to the private key somewhere.
	* [[Creating_digital_certificates_with_our_root_certificate \| Creating a custom SSL certificate]] for our mail server
			For starters, look at the TLS-section of your ''main.cf'' that you currently have. Chances are it looks a bit like this:
			# TLS parameters
			smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
			smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
			smtpd_use_tls=yes

			=== Other additions ===

			If everything ''still'' works after these changes, then congratulations, you now have a powerful, flexible and pretty secure mail setup. Of course, there are always points for improvements. We'll cover these in separate pages. One page that we want to direct you to now, is
	* [[Antispam measures]] for our Postfix mailserver		* [[Antispam measures]] for our Postfix mailserver

Saruman!: /* Configuring mail delivery through Dovecot LDA */ added SSL

2009-01-04T17:12:15Z

Configuring mail delivery through Dovecot LDA: added SSL

← Older revision		Revision as of 17:12, 4 January 2009
Line 164:		Line 164:
	==Configuring mail delivery through Dovecot LDA==		==Configuring mail delivery through Dovecot LDA==
	E-mails get delivered to the virtual mailboxes by means of a Mail Delivery Agent (MDA). With Postfix, the standard MDA for delivery to virtual mailboxes is called ''virtual'', but we're not going to use that; we're going to use ''[http://wiki.dovecot.org/LDA Dovecot LDA]'', which is a program called ''deliver''. By the way, the abbreviation LDA stands for Local Delivery Agent, which of course means more or less the same as MDA.		E-mails get delivered to the virtual mailboxes by means of a Mail Delivery Agent (MDA). With Postfix, the standard MDA for delivery to virtual mailboxes is called ''virtual'', but we're not going to use that; we're going to use ''[http://wiki.dovecot.org/LDA Dovecot LDA]'', which is a program called ''deliver''. By the way, the abbreviation LDA stands for Local Delivery Agent, which of course means more or less the same as MDA.
			===Enabling the Dovecot daemon===
	To make Postfix use Dovecot LDA, we add the following line to ''/etc/postfix/master.cf'':		To make Postfix use Dovecot LDA, we add the following line to ''/etc/postfix/master.cf'':
	dovecot unix - n n - - pipe		dovecot unix - n n - - pipe
Line 172:		Line 172:
	postconf -e virtual_transport=dovecot		postconf -e virtual_transport=dovecot
	postconf -e dovecot_destination_recipient_limit=1		postconf -e dovecot_destination_recipient_limit=1
			===Dovecot default configuration===
	Now to configure Dovecot itself: open ''/etc/dovecot/dovecot.conf'' with your favourite editor [[vim]]; first make sure the ''protocols ='' line reads		Now to configure Dovecot itself: open ''/etc/dovecot/dovecot.conf'' with your favourite editor [[vim]]; first make sure the ''protocols ='' line reads
	protocols = imap imaps pop3 pop3s		protocols = imap imaps pop3 pop3s
Line 233:		Line 234:
	chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf		chmod u=rw,g=r,o= /etc/dovecot/dovecot.conf
	/etc/init.d/dovecot restart		/etc/init.d/dovecot restart
			===Dovecot SSL configuration===
			Out of the (Debian) box, Dovecot is SSL-enabled. We'll now replace the generic SSL-certificate, generated for the host by the Dovecot installation script, by our own certificate. To ths end, we first [[Creating_digital_certificates_with_our_root_certificate \| generate an appropriate certificate]], e.g. an SSL wildcard certificate: "*.saruman.biz". This results in a public and a private certificate, both of which must be placed somewhere where Dovecot expects them and can read them.

			By default, Dovecot expects the following locations/filenames/owner/attributes:
			/etc/ssl/certs/dovecot.pem -rw-r--r-- root:dovecot 4624 bytes
			/etc/ssl/private/dovecot.pem -rw------- root:dovecot 1743 bytes
			If we may make a suggestion: rename the generated certificates in both locations to dovecot.pem.bak, place your generated certificates in their place, and set the owner/permissions like displayed here.

			However, if you've generated your own keys, you might have used a passphrase on the private key. You'll have to tell dovecot about it in its configuration file /etc/dovecot/dovecot.conf. To this end, edit the corresponding section by uncommenting the "ssl_" lines, and using your private key password (e.g. "zM7Ertq12") in the appropriate line:
			ssl_cert_file = /etc/ssl/certs/dovecot.pem
			ssl_key_file = /etc/ssl/private/dovecot.pem

			# If key file is password protected, give the password here. Alternatively
			# give it when starting dovecot with -p parameter.
			ssl_key_password = zM7Ertq12
			Naturally you are free to place the keys in a different location, and/or use a different name...

	==Finishing up==		==Finishing up==

Saruman!: /* Configuring mail delivery through Dovecot LDA */ added "finishing up" section

2008-11-02T15:14:14Z

Configuring mail delivery through Dovecot LDA: added "finishing up" section

Show changes

Saruman!: /* MySQL configuration */ added mailboxmaps

2008-11-02T11:01:26Z

MySQL configuration: added mailboxmaps

← Older revision		Revision as of 11:01, 2 November 2008
Line 64:		Line 64:
	(This of course assumes you have ''create.vmail.sql'' in your current working directory; if not you can include the path to the file.) Simply give the MySQL root user password, and the script creates the database, the user, and the necessary tables.		(This of course assumes you have ''create.vmail.sql'' in your current working directory; if not you can include the path to the file.) Simply give the MySQL root user password, and the script creates the database, the user, and the necessary tables.

	~~We're not going to fill the database tables just yet~~, ~~but~~ we '~~'are''~~ going to tell Postfix to use the ''vmail'' database, and also ''how'' to read the database. To this end, we're going to create three configuration files in directory ''/etc/postfix''. We'll start off with one configuration file, with which Postfix can determine if a domain name is among the domain(s) that it's actually hosting mailboxes for.		Next, we're going to tell Postfix to use the ''vmail'' database, and also how to read the database (Postfix never writes the MySQL database). To this end, we're going to create three configuration files in directory ''/etc/postfix''. We'll start off with one configuration file, with which Postfix can determine if a domain name is among the domain(s) that it's actually hosting mailboxes for. Then we'll create the config file that checks the table that contains all the users that have a virtual mailbox, and finally we create the lookup for the table with all the aliases.

			===Virtual mail domains lookup===
	Create file ''/etc/postfix/mysql-virtual-domains.cf'' with the following content:		Create file ''/etc/postfix/mysql-virtual-domains.cf'' with the following content:
	user = vmail_admin		user = vmail_admin
Line 84:		Line 85:
	This has the effect of creating three entries. Only the first entry needs an ''id'' value, because in MySQL we've defined that field as AUTO_INCREMENT. After creating your first virtual domain in the table, you never have to use a statement like the first INSERT again, only statements like the other two.		This has the effect of creating three entries. Only the first entry needs an ''id'' value, because in MySQL we've defined that field as AUTO_INCREMENT. After creating your first virtual domain in the table, you never have to use a statement like the first INSERT again, only statements like the other two.

	After creating data like this, postfix will be able to recognise that you have three virtual mail domains (namely the three domains in the VALUES section) for which it hosts virtual mailboxes. However,		After creating data like this, postfix will be able to recognise that you have three virtual mail domains (namely the three domains in the VALUES section) for which it hosts virtual mailboxes.

			=== Virtual mail user lookup===
			Create the file ''/etc/postfix/mysql-virtual-mailbox-maps.cf'' with the following content:
			user = vmail_admin
			password = SuperSecret
			hosts = 127.0.0.1
			dbname = vmail
			query = SELECT 1 FROM view_users WHERE email='%s'
			Next, we change the attributes on this configuration file so that it is secure. Also, we tell Postfix that this mapping file is supposed to be used for the ''virtual_mailbox_maps'' mapping:
			chown root:postfix /etc/postfix/mysql-virtual-mailbox-maps.cf
			chmod o=/etc/postfix/mysql-virtual-mailbox-maps.cf
			postconf -e virtual_mailbox_maps=mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
			However, the lookup of virtual mailboxes at present will not work (yet), because we need data in the ''users'' table.