263 lines
15 KiB
Plaintext
263 lines
15 KiB
Plaintext
extends article.pug
|
|
|
|
block article
|
|
header
|
|
h2 Setting up a mail server (WIP)
|
|
div.menu
|
|
a(href='/stuff#articles') Go back to articles list
|
|
time(datetime='2020-09-22') 22 September 2020
|
|
nav
|
|
h3 Contents
|
|
ol
|
|
li #[a(href='#art-1') Introduction]
|
|
li #[a(href='#art-2') Installing]
|
|
li #[a(href='#art-3') Postfix SMTP server]
|
|
ol
|
|
li #[a(href='#art-3-1') main.cf]
|
|
li #[a(href='#art-3-2') master.cf]
|
|
li #[a(href='#art-3-3') User aliases]
|
|
li #[a(href='#art-3-4') Starting Postfix]
|
|
li #[a(href='#art-4') Dovecot POP3/IMAP server with Sieve mail filter]
|
|
li #[a(href='#art-5') SpamAssassin spam filter]
|
|
li #[a(href='#art-6') OpenDKIM signing and verifying filter]
|
|
ol
|
|
li #[a(href='#art-6-1') opendkim.conf]
|
|
li #[a(href='#art-6-2') Generating keys]
|
|
li #[a(href='#art-6-3') Populating KeyTable and SigningTable]
|
|
li #[a(href='#art-6-4') internal-hosts file]
|
|
li #[a(href='#art-6-5') Starting OpenDKIM]
|
|
li #[a(href='#art-7') OpenDMARC email policy filter]
|
|
li #[a(href='#art-8') DNS records]
|
|
ol
|
|
li #[a(href='#art-8-1') MX and A/AAAA]
|
|
li #[a(href='#art-8-2') PTR]
|
|
li #[a(href='#art-8-3') SPF]
|
|
li #[a(href='#art-8-4') DMARC]
|
|
li #[a(href='#art-8-5') DKIM]
|
|
li #[a(href='#art-9') Setting up a ClamAV antivirus]
|
|
|
|
h3#art-1 #[a(href='#art-1') 1. Introduction]
|
|
p I use Postfix as a SMTP and Dovecot (with Pigeonhole (Sieve)) as an IMAP server. ClamAV for an antivirus. For anti-spam I use SpamAssassin. For DKIM and DMARC — OpenDKIM and OpenDMARC respectively. I could use rspamd instead of the latter three, but it doesn't work on Raspberry Pi.
|
|
p It is vital to make the DKIM, DMARC and SPF DNS records. Also, if you want your mail server to be trusted by every other mail servers then you should get a static IP-address if you don't yet. And you have to ask your ISP to edit PTR DNS record for your static IP-address to point to your domain.
|
|
p Unfortunately for me I don't have neither, and I'm afraid that even if I get the static IP-address, my ISP won't edit PTR record, because that's available only for bussiness customers.
|
|
p Server is configured in a simple way using PAM (real system users) with user's passwords and with mail stored in ~/Maildir.
|
|
|
|
h3#art-2 #[a(href='#art-2') 2. Installing]
|
|
p You need to install following packages: #[code postfix], #[code dovecot], #[code pidgeonhole] (or could be #[code dovecot-sieve]), #[code clamav], #[code opendkim], #[code opendmarc] and #[code spamassassin].
|
|
|
|
h3#art-3 #[a(href='#art-3') 3. Postfix SMTP server]
|
|
p Its configuration files are in directory #[code /etc/postfix]. First we need to work with #[code main.cf] file. Then configure services in #[code master.cf]. Also I'll show you how to make aliases for users.
|
|
|
|
h4#art-3-1 #[a(href='#art-3-1') 3.1. main.cf]
|
|
p Set #[code myhostname] to a hostname of a server (e.g. #[code mail.example.org]). Set #[code mydomain] to your domain name (e.g. #[code example.org]). Set #[code myorigin] to #[code $mydomain] to set origin of mail being sent from your server.
|
|
p #[code mydestination] is a list of domains that are delivered through a local transport. If server should go outside then this parameter must include #[code $mydomain] alongside names for the local machine. E.g. #[code $myhostname, localhost, $mydomain, mail.$mydomain].
|
|
p #[code local_recipient_maps] are lookup tables with all names and/or addresses of local recipients. In my case it set to #[code unix:passwd.byname $alias_maps].
|
|
p I have #[code inet_interfaces = all] to listen on all the interfaces.
|
|
p In #[code mynetworks], as stated in a Postfix's manual, we specify a list of “trusted” clients that have more privileges than “strangers”. In particular, such clients are allowed to relay mail through Postfix. I have it set to localhost and my LAN.
|
|
p In #[code alias_maps] we specify a list of lookup tables that contain aliases for existing users. And in #[code alias_database] just add #[code $alias_maps]. #[code alias_database] is, as stated in a manual, separate because not all the tables specified with #[code $alias_maps] have to be local files.
|
|
p #[code recipient_delimeter = +]. Here we set a delimeter to a plus sign (that's just a usual practice that I obeyed).
|
|
p I use a Maildir-style mailboxes, so #[code home_mailbox] is set to #[code Maildir/] (slash is necessary).
|
|
p We use Dovecot, so #[code mailbox_transport] should be set to #[code lmtp:unix:private/dovecot-lmtp]. Here we point to where Dovecot LMTP server listens, in our case it is a UNIX-socket.
|
|
p Optionaly, you can set #[code inet_protocols] to IP versions used by you, I set it just to #[code ipv4] for a quite legitimate reason of not having IPv6 address. :)
|
|
p Here are all the modified parameters listed:
|
|
pre
|
|
| myhostname = mail.example.org
|
|
| mydomain = example.org
|
|
| myorigin = $mydomain
|
|
|
|
|
| inet_interfaces = all
|
|
|
|
|
| mydestination = $myhostname, localhost, $mydomain, mail.$mydomain
|
|
|
|
|
| local_recipient_maps = unix:passwd.byname $alias_maps
|
|
|
|
|
| mynetworks = localhost, 192.168.0.0/24
|
|
|
|
|
|
|
| alias_maps = hash:/etc/postfix/aliases
|
|
| alias_database = $alias_maps
|
|
|
|
|
| recipient_delimiter = +
|
|
|
|
|
| home_mailbox = Maildir/
|
|
|
|
|
| mailbox_transport = lmtp:unix:private/dovecot-lmtp
|
|
|
|
|
| inet_protocols = ipv4
|
|
p Next I'll cover how to make encryption working, set up milters (mail filters (i.e. OpenDKIM and OpenDMARC)), and restrictions.
|
|
|
|
h4#art-3-2 #[a(href='#art-3-2') 3.2. master.cf]
|
|
p Here are all needed lines to be added or modified:
|
|
pre
|
|
| smtp inet n - n - - smtpd
|
|
| -o content_filter=spamassassin
|
|
| submission inet n - n - - smtpd
|
|
| -o syslog_name=postfix/submission
|
|
| -o smtpd_tls_security_level=encrypt
|
|
| -o smtpd_sasl_auth_enable=yes
|
|
| -o smtpd_tls_auth_only=yes
|
|
| smtps inet n - n - - smtpd
|
|
| -o content_filter=spamassassin
|
|
| -o syslog_name=postfix/smtps
|
|
| -o smtpd_tls_wrappermode=yes
|
|
| -o smtpd_sasl_auth_enable=yes
|
|
|
|
|
| spamassassin unix - n n - - pipe
|
|
| user=spamd argv=/bin/vendor_perl/spamc
|
|
| -e /sbin/sendmail -oi -f ${sender} ${recipient}
|
|
|
|
h4#art-3-3 #[a(href='#art-3-3') 3.3. User aliases]
|
|
p User aliases are in #[code aliases] file. They has a form "#[code <alias>: <username>]", e.g. #[code me: arav]. Where #[code username] may be other alias. After modifications you need to run #[code newaliases] program to update #[code aliases.db] database file.
|
|
|
|
h4#art-3-4 #[a(href='#art-3-4') 3.4. Starting Postfix]
|
|
p To start a Postfix service on systemd-based Linux distro run #[code systemctl start postfix]. To make Postfix run on every boot run #[code systemctl enable postfix].
|
|
|
|
h3#art-4 #[a(href='#art-4') 4. Dovecot POP3/IMAP server with Sieve mail filter]
|
|
|
|
h3#art-5 #[a(href='#art-5') 5. SpamAssassin spam filter]
|
|
|
|
h3#art-6 #[a(href='#art-6') 6. OpenDKIM signing and verifying filter]
|
|
p On ArchLinux OpenDKIM is unable to write in #[code /run], so I created #[code /var/spool/opendkim] directory for it.
|
|
|
|
h4#art-6-1 #[a(href='#art-6-1') 6.1. opendkim.conf]
|
|
p Well, that's main config file
|
|
pre
|
|
| KeyTable refile:/etc/opendkim/keytable
|
|
| SigningTable refile:/etc/opendkim/signingtable
|
|
| InternalHosts refile:/etc/opendkim/internal-hosts
|
|
|
|
|
| Socket local:/var/spool/opendkim/opendkim.sock
|
|
| PidFile /var/spool/opendkim/opendkim.pid
|
|
| UMask 000
|
|
| UserID opendkim:opendkim
|
|
|
|
|
| Mode sv
|
|
| SubDomains yes
|
|
|
|
|
| Canonicalization relaxed/simple
|
|
|
|
|
| Syslog yes
|
|
| SyslogSuccess yes
|
|
| LogWhy yes
|
|
|
|
|
| SoftwareHeader yes
|
|
|
|
p I myself set up a multi-domain variant just in case. So, here we have two main tables: #[code KeyTable] and #[code SigningTable]. Those files tells OpenDKIM where to find keys and what domains to sign. You may use one key for all domains or generate keys for each domain.
|
|
p #[code InternalHosts] tells OpenDKIM what hosts should be signed rather than verified.
|
|
p #[code Socket] tells where to listen to connections, in this case we use UNIX sockets.
|
|
p #[code Mode] selects operating mode(s). In our case we have two modes: (s)igner and (v)erifier.
|
|
p #[code SubDomains] set to yes tells that we allow subdomains of our domains to be signed and verified.
|
|
p #[code Canonicalization] selects the canonicalization method(s) to be used with signing. We set relaxed for header and simple for body. I don't fully understand it and just use what suggested.
|
|
p Below are logging options that tells to write in syslog.
|
|
p With #[code SoftwareHeader] set to yes OpenDKIM will be always adding "DKIM-Filter" header field.
|
|
|
|
h4#art-6-2 #[a(href='#art-6-2') 6.2. Generating keys]
|
|
pre
|
|
| opendkim-genkey -r -s myselector -b 2048 -d example.com
|
|
p This command will generate a key pair stored in files "myselector.private" and "myselector.txt" for a given domain.
|
|
p #[code -r] restricts the key to emails use only. #[code -s] is a name of selector.#[code -b] is the size of the key in bits. #[code -d] is our domain.
|
|
p Name of a selector is usually a #[code mail], but that's just what I use, you can choose whatever you want.
|
|
|
|
|
|
h4#art-6-3 #[a(href='#art-6-3') 6.3. Populating KeyTable and SigningTable]
|
|
p KeyTable has following structure (a line per domain):
|
|
pre
|
|
| myselector._domainkey.example.com example.com:myselector:/etc/opendkim/myselector.private
|
|
p And SigningTable this one:
|
|
pre
|
|
| *@example.com myselector._domainkey.example.com
|
|
|
|
h4#art-6-4 #[a(href='#art-6-4') 6.4. internal-hosts file]
|
|
p As stated above in this file we put hosts whose mail should be signed rather than verified. And its structure is the following:
|
|
pre
|
|
| 127.0.0.1
|
|
| 192.168.0.0/24
|
|
p #[code 127.0.0.1] is necessary to be there according to a manual.
|
|
|
|
|
|
h4#art-6-5 #[a(href='#art-6-5') 6.5. Starting OpenDKIM]
|
|
p #[code systemctl start opendkim] and #[code systemctl enable opendkim] to start and enable OpenDKIM service to run on OS start up if you got Poetteringed just like me. :)
|
|
|
|
h3#art-7 #[a(href='#art-7') 7. OpenDMARC email policy filter]
|
|
p Its configuration lies in #[code /etc/opendmarc/opendmarc.conf] and is fully documented. Here are the options I changed:
|
|
pre
|
|
| AuthservID OpenDMARC
|
|
| FailureReports true
|
|
| FailureReportsBcc admin@example.org
|
|
| FailureReportsSentBy admin@example.org
|
|
| IgnoreAuthenticatedClient yes
|
|
| RejectFailures true
|
|
| RequiredHeaders yes
|
|
| Socket unix:/var/spool/opendmarc/opendmarc.sock
|
|
| SoftwareHeader true
|
|
| SPFSelfValidate true
|
|
| Syslog true
|
|
| TrustedAuthservIDs mail.example.org,example.org
|
|
| UMask 002
|
|
p What's in a #[code Socket] option should be added to Postfix's #[code smtpd_milters] and #[code non_smtpd_milters].
|
|
p Creating DMARC DNS record covered in <a href="#art-7-4">7.4</a>.
|
|
|
|
h3#art-8 #[a(href='#art-8') 8. DNS records]
|
|
|
|
h4#art-8-1 #[a(href='#art-8-1') 8.1. MX and A/AAAA]
|
|
p It's good to have a dedicated A (IPv4 address) or AAAA (IPv6 address) record for a mail server's hostname instead of a CNAME record so other servers won't need to do two DNS requests. Hostname is usually mail.example.org if there's just one server, you can call it whatever you want. Remind you that we set it in Postfix in #[code myhostname] parameter.
|
|
p And A record looks like this:
|
|
pre
|
|
| mail IN 86400 A 203.0.113.4
|
|
p Where #[code mail] is a hostname, 86400 is a TTL of a record in seconds.
|
|
p Next we need to add a MX (mail exchanger) record that looks like this:
|
|
pre
|
|
| MX 10 mail.example.org.
|
|
p Here 10 is a priority of a record. The lower a number the higher a priority.
|
|
p A period at the end of the hostnames is necessary in DNS records.
|
|
|
|
h4#art-8-2 #[a(href='#art-8-2') 8.2. PTR]
|
|
p PTR is a reverse DNS record that stands for pointer and is used to “bind” a hostname to IP-address. Mail servers looks for this record and check so this name equals to a hostname provided in EHLO. Most servers will reject your mail if your PTR looks something like 1.2.3.4.pppoe.someisp.net or not set at all.
|
|
p There are three ways to set this record: ask your hosting or internet-provider, or get your own Autonomous System (:^)).
|
|
p Example of this record:
|
|
pre
|
|
| 1 IN PTR mail.example.org.
|
|
|
|
h4#art-8-3 #[a(href='#art-8-3') 8.3. SPF]
|
|
p SPF stands for Sender Policy Framework and in my case it looks exactly like this:
|
|
pre
|
|
| v=spf1 +a +mx -all
|
|
p So, #[code v] is a version of a protocol. #[code +a +mx] means that only servers specified in the A and MX DNS records could send email, and #[code -all] that no one else could do that.
|
|
|
|
h4#art-8-4 #[a(href='#art-8-4') 8.4. DMARC]
|
|
p DMARC stands for Domain-based Message Authentication Reporting and Conformance. And its DNS record could be like this one that I use:
|
|
pre
|
|
| _dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@example.org; ruf=mailto:admin@example.org"
|
|
p #[code v] is a version of a protocol.
|
|
p #[code p] is a default policy that could be set to #[code none], #[code quarantine] and #[code reject]. I chose to #[code reject] mail that comes from «me” if there's something wrong with a origin of a message. If you could get email from subdomains then you need to set #[code sp] as well.
|
|
p #[code rua] is an address for the reports and #[code ruf] is for the forensic reports.
|
|
|
|
h4#art-8-5 #[a(href='#art-8-5') 8.5. DKIM]
|
|
p In 5.2 we generated a key pair for our domain and now we'll take what's inside a #[code myselector.txt] file and add it to our DNS.
|
|
p DKIM DNS record looks like this:
|
|
pre
|
|
| myselector._domainkey IN TXT ( "v=DKIMv1; k=rsa; s=email; p=<public key goes here>" )
|
|
p By the way, brackets are used in case a content of a record doesn't fit on one line.
|
|
|
|
h3#art-9 #[a(href='#art-9') 9. Setting up a ClamAV antivirus]
|
|
p All you need to make it work together with Postfix is to add #[code /run/clamav/milter.sock] to #[code smtpd_milters] and #[code non_smtpd_milters] options in Postfix, also make some changes in configs of ClamAV.
|
|
p In #[code clamav-milter.conf] you need the following:
|
|
pre
|
|
| MilterSocket unix:/run/clamav/milter.sock
|
|
| ClamdSocket unix:/run/clamav/clamd.ctl
|
|
p Also, in case you need ClamAV to add headers also in case a message is free of viruses add #[code AddHeader Add] or #[code AddHeader Replace] option. The difference between them is detaily described in config file itself.
|
|
p Before starting ClamAV you need to update its virus definitions with #[code freshclam] util. Also, enable and start #[code clamav-freshclam] systemd service to keep definitions recent.
|
|
p I don't know how it is in other distros, but, for whatever reason, an Arch Linux's package doesn't have a systemd service file for the ClamAV milter. So I just copy it here from <a href="https://wiki.archlinux.org/index.php/ClamAV#Using_the_milter" rel="noopener noreferrer" target="_blank">ArchWiki</a>:
|
|
pre
|
|
| [Unit]
|
|
| Description='ClamAV Milter'
|
|
| After=clamav-daemon.service
|
|
|
|
|
| [Service]
|
|
| Type=forking
|
|
| ExecStart=/usr/bin/clamav-milter --config-file /etc/clamav/clamav-milter.conf
|
|
|
|
|
| [Install]
|
|
| WantedBy=multi-user.target
|
|
p Save it as #[code /usr/lib/systemd/system/clamav-milter.service] and run #[code systemctl daemon-reload].
|
|
p Next you need to enable and start #[code clamav-daemon] and #[code clamav-milter]. |