mailu setup steps
This commit is contained in:
parent
f5caeded23
commit
1c13547385
66
mailu-setup.md
Normal file
66
mailu-setup.md
Normal file
@ -0,0 +1,66 @@
|
||||
## setup docker
|
||||
|
||||
Add Docker's official GPG key and then add repository to Apt sources
|
||||
|
||||
```bash
|
||||
sudo apt-get update
|
||||
sudo apt-get install ca-certificates curl
|
||||
sudo install -m 0755 -d /etc/apt/keyrings
|
||||
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
||||
sudo chmod a+r /etc/apt/keyrings/docker.asc
|
||||
|
||||
echo \
|
||||
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
|
||||
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
||||
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
sudo apt-get update -y
|
||||
```
|
||||
|
||||
to install latest version run:
|
||||
|
||||
```bash
|
||||
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
```
|
||||
|
||||
# install Mailu
|
||||
|
||||
Mailu will store all of its persistent data in a path of your choice (/mailu by default) simply create the directory and move there:
|
||||
|
||||
```bash
|
||||
mkdir /mailu
|
||||
cd /mailu
|
||||
```
|
||||
|
||||
check IP need in next step
|
||||
|
||||
```bash
|
||||
ifconfig eth0
|
||||
```
|
||||
|
||||
then use [this util](https://setup.mailu.io/2024.06/)
|
||||
|
||||
follow instructions to docker compose.
|
||||
|
||||
once done, you need to manually create the admin account now:
|
||||
|
||||
```bash
|
||||
docker compose exec admin flask mailu admin me example.net 'password'
|
||||
```
|
||||
|
||||
This will create a user named `me@example.net` with password password and administration privileges.
|
||||
Connect to the Web admin interface and change the password to a strong one.
|
||||
|
||||
## Upgrading the mail server
|
||||
|
||||
First check upstream for changes in the docker-compose.yml or in the .env files. Also, check
|
||||
CHANGELOG.md for changes that you might not want to include.
|
||||
|
||||
Update your .env file to reflect the version that you wish to install
|
||||
(if you are running stable or latest, you may skip this and proceed),
|
||||
then simply pull the latest images and recreate the containers :
|
||||
|
||||
```bash
|
||||
docker compose pull
|
||||
docker compose down
|
||||
docker compose -p mailu up -d
|
||||
```
|
||||
362
postfix-setup.md
Normal file
362
postfix-setup.md
Normal file
@ -0,0 +1,362 @@
|
||||
# upgrade
|
||||
|
||||
- Ubuntu [ref page](https://ubuntu.com/server/docs/install-and-configure-postfix)
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt upgrade -y
|
||||
```
|
||||
|
||||
## install postfix
|
||||
|
||||
```bash
|
||||
sudo apt install -y postfix
|
||||
```
|
||||
|
||||
in case to reconfigre postfix:
|
||||
|
||||
```bash
|
||||
sudo dpkg-reconfigure postfix
|
||||
```
|
||||
|
||||
## Configure mailbox format
|
||||
|
||||
To configure the mailbox format for Maildir:
|
||||
|
||||
```bash
|
||||
sudo postconf -e 'home_mailbox = maildir/'
|
||||
```
|
||||
|
||||
This will place new mail in /home/<username>/maildir so you will need to configure your Mail Delivery Agent (MDA) to use the same path.
|
||||
|
||||
## Configure SMTP authentication
|
||||
|
||||
To configure Postfix for SMTP-AUTH using SASL (Dovecot SASL), run these commands at a terminal prompt:
|
||||
|
||||
```bash
|
||||
sudo postconf -e 'smtpd_sasl_type = dovecot'
|
||||
sudo postconf -e 'smtpd_sasl_path = private/auth'
|
||||
sudo postconf -e 'smtpd_sasl_local_domain ='
|
||||
sudo postconf -e 'smtpd_sasl_security_options = noanonymous,noplaintext'
|
||||
sudo postconf -e 'smtpd_sasl_tls_security_options = noanonymous'
|
||||
sudo postconf -e 'broken_sasl_auth_clients = yes'
|
||||
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
|
||||
sudo postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
|
||||
```
|
||||
|
||||
## setup ssl
|
||||
|
||||
install certbot to use letsencrypt
|
||||
|
||||
```bash
|
||||
sudo apt install -y certbot
|
||||
```
|
||||
|
||||
and get cert
|
||||
|
||||
```bash
|
||||
sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d my_domain
|
||||
```
|
||||
|
||||
Once you have a certificate, configure Postfix to provide TLS encryption for both incoming and outgoing mail:
|
||||
|
||||
```bash
|
||||
sudo postconf -e 'smtp_tls_security_level = may'
|
||||
sudo postconf -e 'smtpd_tls_security_level = may'
|
||||
sudo postconf -e 'smtp_tls_note_starttls_offer = yes'
|
||||
sudo postconf -e 'smtpd_tls_key_file = /etc/letsencrypt/live/my_domain/privkey.pem'
|
||||
sudo postconf -e 'smtpd_tls_cert_file = /etc/letsencrypt/live/my_domain/fullchain.pem'
|
||||
sudo postconf -e 'smtpd_tls_loglevel = 1'
|
||||
sudo postconf -e 'smtpd_tls_received_header = yes'
|
||||
sudo postconf -e 'myhostname = my_domain'
|
||||
```
|
||||
|
||||
restart postfix
|
||||
|
||||
```bash
|
||||
sudo systemctl restart postfix.service
|
||||
```
|
||||
|
||||
### Configure SASL
|
||||
|
||||
Postfix supports two SASL implementations: Cyrus SASL and Dovecot SASL.
|
||||
|
||||
To enable Dovecot SASL the dovecot-core package will need to be installed:
|
||||
|
||||
```bash
|
||||
sudo apt install dovecot-core
|
||||
```
|
||||
|
||||
Next, edit /etc/dovecot/conf.d/10-master.conf and change the following:
|
||||
|
||||
```text
|
||||
service auth {
|
||||
# auth_socket_path points to this userdb socket by default. It's typically
|
||||
# used by dovecot-lda, doveadm, possibly imap process, etc. Its default
|
||||
# permissions make it readable only by root, but you may need to relax these
|
||||
# permissions. Users that have access to this socket are able to get a list
|
||||
# of all usernames and get results of everyone's userdb lookups.
|
||||
unix_listener auth-userdb {
|
||||
#mode = 0600
|
||||
#user =
|
||||
#group =
|
||||
}
|
||||
|
||||
# Postfix smtp-auth
|
||||
unix_listener /var/spool/postfix/private/auth {
|
||||
mode = 0660
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Once you have configured Dovecot, restart it with:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart dovecot.service
|
||||
```
|
||||
|
||||
### Setup SPF and dkim
|
||||
|
||||
Step 1: Create an SPF Record in DNS
|
||||
In your DNS management interface, create a new TXT record like below.
|
||||
|
||||
```
|
||||
TXT @ v=spf1 mx ~all
|
||||
```
|
||||
|
||||
### Setting up DKIM
|
||||
|
||||
First, install OpenDKIM which is an open-source implementation of the DKIM sender authentication system.
|
||||
|
||||
```bash
|
||||
sudo apt install opendkim opendkim-tools
|
||||
```
|
||||
|
||||
Then add postfix user to opendkim group.
|
||||
|
||||
```bash
|
||||
sudo gpasswd -a postfix opendkim
|
||||
```
|
||||
|
||||
Edit OpenDKIM main configuration file.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/opendkim.conf
|
||||
```
|
||||
|
||||
Find the following line.
|
||||
|
||||
```
|
||||
Syslog yes
|
||||
```
|
||||
|
||||
By default, OpenDKIM logs will be saved in /var/log/mail.log file. Add the following line so OpenDKIM will generate more detailed logs for debugging.
|
||||
|
||||
```
|
||||
Logwhy yes
|
||||
```
|
||||
|
||||
Set
|
||||
|
||||
```
|
||||
Canonicalization simple
|
||||
Mode sv
|
||||
SubDomains no
|
||||
```
|
||||
|
||||
Then add the following lines below
|
||||
|
||||
```
|
||||
AutoRestart yes
|
||||
AutoRestartRate 10/1M
|
||||
Background yes
|
||||
DNSTimeout 5
|
||||
SignatureAlgorithm rsa-sha256
|
||||
```
|
||||
|
||||
Next, add the following lines at the end of this file.
|
||||
|
||||
```
|
||||
# OpenDKIM user
|
||||
# Remember to add user postfix to group opendkim
|
||||
UserID opendkim
|
||||
|
||||
# Map domains in From addresses to keys used to sign messages
|
||||
KeyTable refile:/etc/opendkim/key.table
|
||||
SigningTable refile:/etc/opendkim/signing.table
|
||||
|
||||
# Hosts to ignore when verifying signatures
|
||||
ExternalIgnoreList /etc/opendkim/trusted.hosts
|
||||
|
||||
# A set of internal hosts whose mail should be signed
|
||||
InternalHosts /etc/opendkim/trusted.hosts
|
||||
```
|
||||
|
||||
Save and close the file.
|
||||
|
||||
### Create Signing Table, Key Table and Trusted Hosts File
|
||||
|
||||
Create a directory structure for OpenDKIM
|
||||
|
||||
```bash
|
||||
sudo mkdir /etc/opendkim
|
||||
sudo mkdir /etc/opendkim/keys
|
||||
```
|
||||
|
||||
Change the owner from root to opendkim and make sure only opendkim user can read and write to the keys directory.
|
||||
|
||||
```bash
|
||||
sudo chown -R opendkim:opendkim /etc/opendkim
|
||||
sudo chmod go-rw /etc/opendkim/keys
|
||||
```
|
||||
|
||||
Create the signing table.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/opendkim/signing.table
|
||||
```
|
||||
|
||||
Add the following two lines to the file. This tells OpenDKIM that if a sender on your server is using a @your-domain.com address, then it should be signed with the private key identified by default.\_domainkey.your-domain.com. The second line tells that your sub-domains will be signed by the private key as well.
|
||||
|
||||
```
|
||||
_@your-domain.com default.\_domainkey.your-domain.com
|
||||
\_@\*.your-domain.com default.\_domainkey.your-domain.com
|
||||
```
|
||||
|
||||
Save and close the file. Then create the key table.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/opendkim/key.table
|
||||
```
|
||||
|
||||
Add the following line, which tells the location of the private key.
|
||||
|
||||
```
|
||||
default.\_domainkey.your-domain.com your-domain.com:default:/etc/opendkim/keys/your-domain.com/default.private
|
||||
```
|
||||
|
||||
Save and close the file. Next, create the trusted hosts file.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/opendkim/trusted.hosts
|
||||
```
|
||||
|
||||
Add the following lines to the newly created file. This tells OpenDKIM that if an email is coming from localhost or from the same domain, then OpenDKIM should only sign the email but not perform DKIM verification on the email.
|
||||
|
||||
```
|
||||
127.0.0.1
|
||||
localhost
|
||||
|
||||
cdl.patialtech.com
|
||||
.patialtech.com
|
||||
```
|
||||
|
||||
### Save and close the file.
|
||||
|
||||
Generate Private/Public Keypair
|
||||
Since DKIM is used to sign outgoing messages and verify incoming messages, we need to generate a private key for signing and a
|
||||
public key for remote verifier. Public key will be published in DNS.
|
||||
|
||||
Create a separate folder for the domain.
|
||||
|
||||
```bash
|
||||
sudo mkdir /etc/opendkim/keys/your-domain.com
|
||||
```
|
||||
|
||||
Generate keys using opendkim-genkey tool.
|
||||
|
||||
```bash
|
||||
sudo opendkim-genkey -b 2048 -d your-domain.com -D /etc/opendkim/keys/your-domain.com -s default -v
|
||||
```
|
||||
|
||||
The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory
|
||||
where the keys will be stored and we use default as the selector (-s), also known as the name. Once the command is executed,
|
||||
the private key will be written to default.private file and the public key will be written to default.txt file.
|
||||
|
||||
Make opendkim as the owner of the private key.
|
||||
|
||||
```bash
|
||||
sudo chown opendkim:opendkim /etc/opendkim/keys/your-domain.com/default.private
|
||||
```
|
||||
|
||||
And change the permission, so only the opendkim user has read and write access to the file.
|
||||
|
||||
```bash
|
||||
sudo chmod 600 /etc/opendkim/keys/your-domain.com/default.private
|
||||
```
|
||||
|
||||
Display the public key
|
||||
|
||||
```bash
|
||||
sudo cat /etc/opendkim/keys/your-domain.com/default.txt
|
||||
```
|
||||
|
||||
### Test DKIM Key
|
||||
|
||||
Enter the following command on Ubuntu server to test your key.
|
||||
|
||||
```bash
|
||||
sudo opendkim-testkey -d your-domain.com -s default -vvv
|
||||
```
|
||||
|
||||
If everything is OK, you will see Key OK in the command output.
|
||||
|
||||
```
|
||||
opendkim-testkey: using default configfile /etc/opendkim.conf
|
||||
opendkim-testkey: checking key 'default._domainkey.your-domain.com'
|
||||
opendkim-testkey: key secure
|
||||
opendkim-testkey: key OK
|
||||
```
|
||||
|
||||
If you see Key not secure in the command output, don’t panic. This is because DNSSEC isn’t enabled on your domain name.
|
||||
DNSSEC is a security standard for secure DNS query. Most domain names haven’t enabled DNSSEC.
|
||||
There’s absolutely no need to worry about Key not secure. You can continue to follow this guide.
|
||||
|
||||
### Connect Postfix to OpenDKIM
|
||||
|
||||
Postfix can talk to OpenDKIM via a Unix socket file. The default socket file used by OpenDKIM is /var/run/opendkim/opendkim.sock, as shown in /etc/opendkim.conf file. But the postfix SMTP daemon shipped with Ubuntu runs in a chroot jail, which means the SMTP daemon resolves all filenames relative to the Postfix queue directory (/var/spool/postfix). So we need to change the OpenDKIM Unix socket file.
|
||||
|
||||
Create a directory to hold the OpenDKIM socket file and allow only opendkim user and postfix group to access it.
|
||||
|
||||
```bash
|
||||
sudo mkdir /var/spool/postfix/opendkim
|
||||
sudo chown opendkim:postfix /var/spool/postfix/opendkim
|
||||
```
|
||||
|
||||
Then edit the OpenDKIM main configuration file.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/opendkim.conf
|
||||
```
|
||||
|
||||
set
|
||||
|
||||
```bash
|
||||
Socket local:/var/spool/postfix/opendkim/opendkim.sock
|
||||
```
|
||||
|
||||
Save and close the file.
|
||||
|
||||
Next, we need to edit the Postfix main configuration file.
|
||||
|
||||
```bash
|
||||
sudo vim /etc/postfix/main.cf
|
||||
```
|
||||
|
||||
Add the following lines at the end of this file, so Postfix will be able to call OpenDKIM via the milter protocol.
|
||||
|
||||
```
|
||||
# Milter configuration
|
||||
milter_default_action = accept
|
||||
milter_protocol = 6
|
||||
smtpd_milters = local:opendkim/opendkim.sock
|
||||
non_smtpd_milters = $smtpd_milters
|
||||
```
|
||||
|
||||
Then restart opendkim and postfix service.
|
||||
|
||||
```bash
|
||||
sudo systemctl restart opendkim postfix
|
||||
```
|
||||
Loading…
Reference in New Issue
Block a user