diff options
Diffstat (limited to 'content/mail')
| -rw-r--r-- | content/mail/dovecot.md | 112 | ||||
| -rw-r--r-- | content/mail/inbox.md | 214 | ||||
| -rw-r--r-- | content/mail/rainloop.md | 117 | ||||
| -rw-r--r-- | content/mail/rdns.md | 6 | ||||
| -rw-r--r-- | content/mail/security.md | 69 | ||||
| -rw-r--r-- | content/mail/smtp.md | 28 | ||||
| -rw-r--r-- | content/mail/validate.md (renamed from content/mail/opendkim.md) | 40 |
7 files changed, 338 insertions, 248 deletions
diff --git a/content/mail/dovecot.md b/content/mail/dovecot.md deleted file mode 100644 index df2b218..0000000 --- a/content/mail/dovecot.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: "Dovecot Email Server" -draft: true ---- -In the article on [SMTP and Postfix](smtp.html), we set up a simple -Postfix server that we could use to programatically send mail with the -`mail` command. In order to have a true and fully-functional mail -server, we need Dovecot, which can store mails received by the server, -have and authenticate user accounts and interact with mail - -## Installation - - apt install dovecot-imapd dovecot-sieve - -## Certificate - -We will want a SSL certificate for the `mail.` subdomain. We can get -this with [Certbot](certbot.html). Assuming we are using Nginx for our -server otherwise, run: - - certbot --nginx certonly -d mail.example.org - -## DNS - -## Configuring Dovecot - -Dovecot\'s configuration file is in `/etc/dovecot/docevot.conf`. If you -open that file, you will this line: `!include conf.d/*.conf` which adds -all the `.conf` files in `/etc/dovecot/conf.d/` to the Dovecot -configuration. - -One can edit each of these files individually to get the needed -configuration, but to make things easy here, delete or backup the main -configuration file and we will replace it with one single config file -with all important settings in it. - -``` wide -ssl = required -ssl_cert = </etc/letsencrypt/live/mail.example.org/fullchain.pem -ssl_key = </etc/letsencrypt/live/mail.example.org/privkey.pem -ssl_min_protocol = TLSv1.2 -ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED -ssl_prefer_server_ciphers = yes -ssl_dh = </usr/share/dovecot/dh.pem -auth_mechanisms = plain login -auth_username_format = %n - -protocols = $protocols imap - -userdb { - driver = passwd -} -passdb { - driver = pam -} - -mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs -namespace inbox { - inbox = yes - mailbox Drafts { - special_use = \Drafts - auto = subscribe -} - mailbox Junk { - special_use = \Junk - auto = subscribe - autoexpunge = 30d -} - mailbox Sent { - special_use = \Sent - auto = subscribe -} - mailbox Trash { - special_use = \Trash -} - mailbox Archive { - special_use = \Archive -} -} - -service auth { - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postfix -} -} -``` - -### Settings Explained - -Take a good look at the settings to understand what\'s going on. Some of -the settings include: - -1. SSL settings to allow encrypted connections. -2. Default directories for a mail account: Inbox, Sent, Drafts, Junk, - Trash and Archive. -3. The mail server will authenticate users against PAM/passwd, which - means users you create on the server (so long as they are part of - the `mail` group) will be able to receive and send mail. -4. Create a `unix_listener` that will allow Postfix to authenticate - users via Dovecot. - -```{=html} -<!-- --> -``` - echo "auth required pam_unix.so nullok - account required pam_unix.so" >> /etc/pam.d/dovecot - -## Connecting Postfix and Dovecot - -[[Next:\<++\>](%3C++%3E)]{.next} diff --git a/content/mail/inbox.md b/content/mail/inbox.md new file mode 100644 index 0000000..dcc071a --- /dev/null +++ b/content/mail/inbox.md @@ -0,0 +1,214 @@ +--- +title: "Setting up an E-mail Inbox" +tags: ['mail'] +weight: 3 +--- +In the article on [SMTP and Postfix](/mail/smtp), we set up a simple +Postfix server that we could use to programatically send mail with the +`mail` command. In order to have a true and fully-functional mail +server, users should be able to login to a mail client where they +can read their inbox and send mail remotely. In order to achieve this we need Dovecot, +which can store mails received by the server, +authenticate user accounts and interact with mail. + +If we're setting up an inbox we will also want spam detection software, such +as spam assassin. + +## Dovecot and Spamassassin + + apt install dovecot-imapd dovecot-sieve spamassassin spamc + +Unblock the imap port: + + ufw allow 993 + +## Certificate + +We will want a SSL certificate for the `mail.` subdomain. We can get +this with [Certbot](/basic/certbot/). Assuming we are using Nginx for our +server otherwise, run: + + certbot --nginx certonly -d mail.example.org + +## DNS + +We also need two little DNS records set on your domain registrar's site/DNS server: + +1. An MX record. Just put your domain, **example.org**, in the "Points to" field. +2. A CNAME record. Host field: **mail.example.org**. "Points to" field: **example.org.** + +## Configuring Dovecot + +Dovecot\'s configuration file is in `/etc/dovecot/docevot.conf`. If you +open that file, you will see this line: `!include conf.d/*.conf` which adds +all the `.conf` files in `/etc/dovecot/conf.d/` to the Dovecot +configuration. + +One can edit each of these files individually to get the needed +configuration, but to make things easy here, delete or backup the main +configuration file and we will replace it with one single config file +with all important settings in it. Make sure you change `ssl_cert` +and `ssl_key` accordingly. + +``` wide +# Note that in the dovecot conf, you can use: +# %u for username +# %n for the name in name@domain.tld +# %d for the domain +# %h the user's home directory + +# Connections between the mail client and Dovecot needs to be encrypted +ssl = required +ssl_cert = </etc/letsencrypt/live/mail.example.org/fullchain.pem +ssl_key = </etc/letsencrypt/live/mail.example.org/privkey.pem +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED +ssl_prefer_server_ciphers = yes +ssl_dh = </usr/share/dovecot/dh.pem +auth_mechanisms = plain login +auth_username_format = %n + +protocols = $protocols imap + +# Search for valid users in /etc/passwd +userdb { + driver = passwd +} +#Fallback: Use plain old PAM to find user passwords +passdb { + driver = pam +} + +# Our mail for each user will be in ~/Mail, and the inbox will be ~/Mail/Inbox +mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs +namespace inbox { + inbox = yes + mailbox Drafts { + special_use = \Drafts + auto = subscribe +} + mailbox Junk { + special_use = \Junk + auto = subscribe + autoexpunge = 30d +} + mailbox Sent { + special_use = \Sent + auto = subscribe +} + mailbox Trash { + special_use = \Trash +} + mailbox Archive { + special_use = \Archive +} +} + +# Here we let Postfix use Dovecot's authetication system. +service auth { + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postfix +} +} + +protocol lda { + mail_plugins = \$mail_plugins sieve +} +protocol lmtp { + mail_plugins = \$mail_plugins sieve +} +plugin { + sieve = ~/.dovecot.sieve + sieve_default = /var/lib/dovecot/sieve/default.sieve + sieve_dir = ~/.sieve + sieve_global_dir = /var/lib/dovecot/sieve/ +} +``` + +### Settings Explained + +Take a good look at the above settings to understand what\'s going on. Some of +the settings include: + +1. SSL settings to allow encrypted connections. +2. The mail server will authenticate users against PAM/passwd, which + means users you create on the server (so long as they are part of + the `mail` group) will be able to receive and send mail. +3. Default directories for a mail account: Inbox, Sent, Drafts, Junk, + Trash and Archive. +4. Create a `unix_listener` that will allow Postfix to authenticate + users via Dovecot. +5. Setup the Dovecot sieve plugin, which provides mail filtering facilities + at time of final message delivery. Sieve scripts can be used to + customize how messages are delivered, whether they're forwarded + or stored in special folders. + +Next, we can tell sieve to automatically move mail flagged as spam to +the junk folder: + + echo "require [\"fileinto\", \"mailbox\"]; + if header :contains \"X-Spam-Flag\" \"YES\" + { + fileinto \"Junk\"; + }" > /var/lib/dovecot/sieve/default.sieve + +After that, we should create the `vmail` user and group, which will +access the mails, and then update the sieve configuration: + + grep -q '^vmail:' /etc/passwd || useradd vmail + chown -R vmail:vmail /var/lib/dovecot + sievec /var/lib/dovecot/sieve/default.sieve + +Then, enable pam authentication for Dovecot: + + echo "auth required pam_unix.so nullok + account required pam_unix.so" >> /etc/pam.d/dovecot + +## Connecting Postfix and Dovecot + +We need to tell Postfix to look to Dovecot for authenticating users/passwords. +Dovecot will be putting an authentication socket in `/var/spool/postfix/private/auth`. + + postconf -e 'smtpd_sasl_auth_enable = yes' + postconf -e 'smtpd_sasl_type = dovecot' + postconf -e 'smtpd_sasl_path = private/auth' + postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' + +## Connecting Postfix and Spamassassin + +We will change `/etc/postifx/master.cf` so postfix can route mail through spamassassin. First +we can cleanup the default configuration. Feel free to make a backup. + + sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf + +Finally, run this command to finish the configuration for spamassassin. + + echo "smtp unix - - n - - smtp + smtp inet n - y - - smtpd + -o content_filter=spamassassin + submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_sasl_auth_enable=yes + -o smtpd_tls_auth_only=yes + smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes + spamassassin unix - n n - - pipe + user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf + +## Make new mail accounts + +This is the easy part. Let's say we want to add a user Billy and let him +receive mail, run this: + + useradd -m -G mail billy + passwd billy + +Any user added to the `mail` group will be able to receive mail. Suppose a user +Cassie already exists and we want to let her receive mail too. Just run: + + usermod -a -G mail cassie diff --git a/content/mail/rainloop.md b/content/mail/rainloop.md deleted file mode 100644 index b1d92e3..0000000 --- a/content/mail/rainloop.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: "Rainloop" -tags: ['service'] -icon: 'rainloop.png' -short_desc: 'A graphical website for accessing a mail server.' ---- - - -[Rainloop](https://www.rainloop.net/) -is a webmail client, a program that allows you to access your email -online like Gmail. It is useful to be able to access you email from a -web browser because it allows you to easily access your email from any -device with a web browser without any additional setup. - -If you set up -[Nextcloud](/nextcloud) -then you do not need to install Rainloop because Nextcloud comes with a -webmail client. However, if all you want is a webmail client and you do -not need all of the extra things that Nextcloud provides, Rainloop would -be the better choice out of the two since it is less bloated and simpler -to install. - -## Instructions - -First we will install the required packages for Rainloop with the -following command: - -```sh -apt-get install php7.4 php7.4-common php7.4-curl php7.4-xml php7.4-fpm php7.4-json php7.4-dev php7.4-mysql unzip -y -``` - -Then we will download the community version of Rainloop, unzip it into -an appropriate directory and fix all of the file permissions: - -```sh -curl -L "https://www.rainloop.net/repository/webmail/rainloop-latest.zip" -o "rainloop.zip" -unzip rainloop.zip -d /var/www/mail -chown -R www-data: /var/www/mail -``` - -We have installed Rainloop itself, but now we need Nginx to serve the -client. We do that by adding the following text into the file -`/etc/nginx/sites-available/mail` (you can replace the bold text with -whatever is appropriate for your server). - -```nginx -server { - - listen 80; - - server_name mail.example.org ; - root /var/www/mail; - - index index.php; - - access_log /var/log/nginx/rainloop_access.log; - error_log /var/log/nginx/rainloop_error.log; - - location / { - try_files $uri $uri/ /index.php?$query_string; - } - - location ~ \.php$ { - fastcgi_index index.php; - fastcgi_split_path_info ^(.+\.php)(.*)$; - fastcgi_keep_conn on; - fastcgi_pass unix:/var/run/php/php7.4-fpm.sock; - include /etc/nginx/fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - } - location ~ /\.ht { - deny all; - } - - location ^~ /data { - deny all; - } -} -``` - -Then enable the site by linking it to the sites-enabled directory: - -```sh -ln -s /etc/nginx/sites-available/mail /etc/nginx/sites-enabled/ -``` - -Reload nginx: - -```sh -systemctl reload nginx -``` - -Finally get certifications if you are using a new subdomain: - -```sh -certbot --nginx -``` - -After that go to `mail.example.org/?admin` and login with the default -username and password: admin, 12345. Now you are in the admin panel and -the first thing you do should be to change the adminsitrator password by -looking in the security tab on the left. - -{{< img alt="rainloop" src="/pix/rainloop-1.png" >}} - -After securing the admin account you can go to domains and add your own -email address. - -{{< img alt="rainloop" src="/pix/rainloop-2.png" >}} - -Finally, go to `mail.example.org` and login with your email address and -password. - -## Contribution - -[Deniz Telci](https://deniz.telci.org/) - XMR: -`4AcKbpTUc3QX2zHYdh9HZwJAQyexdybFhF1WhXTFhxAcV9jgzB6kroqGZDgeW3rQqXEMYJioYo61kaLBqstwecty9Bjbr4v` diff --git a/content/mail/rdns.md b/content/mail/rdns.md index 6571d8c..874449d 100644 --- a/content/mail/rdns.md +++ b/content/mail/rdns.md @@ -1,7 +1,7 @@ --- -title: "rDNS and PTR Records" -draft: true -tags: ['email'] +title: "Setup rDNS" +tags: ['mail'] +weight: 5 --- While [DNS records](dns.html) refer a domain name to the IP address where the the website is hosted, there is also rDNS (reverse DNS) and diff --git a/content/mail/security.md b/content/mail/security.md new file mode 100644 index 0000000..876c40a --- /dev/null +++ b/content/mail/security.md @@ -0,0 +1,69 @@ +--- +title: "Harden your E-mail Server" +tags: ['mail'] +weight: 2 +--- + +## Hardening Postfix + +Put restrictions on servers sending mail to you. + + postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' + +## Anonymize Headers + +Use some regular expressions to prevent some meta data like a client's ip address +from being leaked. + + echo "/^Received:.*/ IGNORE + /^X-Originating-IP:/ IGNORE" + /^User-Agent:/ IGNORE + /^X-Mailer:/ IGNORE >> /etc/postfix/header_checks + +Add this file to the postfix configuration: + + postconf -e "header_checks = regexp:/etc/postfix/header_checks" + +## Fail2Ban + +If you're not familiar with fail2Ban, it's essentially a program which +blocks bot's and hacker's login requests after a few invalid attempts. + + apt-get install fail2ban + +Make a local copy of the configuration file: + + cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local + +Go down to the `# Mail servers` line and paste this: + + [postfix] + + enabled = true + port = smtp,ssmtp,submission + filter = postfix + logpath = /var/log/mail.log + + + [sasl] + + enabled = true + port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s + filter = postfix-sasl + # You might consider monitoring /var/log/mail.warn instead if you are + # running postfix since it would provide the same log lines at the + # "warn" level but overall at the smaller filesize. + logpath = /var/log/mail.warn + maxretry = 1 + bantime = 21600 + + [dovecot] + + enabled = true + port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s + filter = dovecot + logpath = /var/log/mail.log + +This will only grant 2 login attempts and then block the requester for 6 hours. Now restart `fail2ban`: + + systemctl restart fail2ban diff --git a/content/mail/smtp.md b/content/mail/smtp.md index 6ce92f2..2039907 100644 --- a/content/mail/smtp.md +++ b/content/mail/smtp.md @@ -1,7 +1,9 @@ --- -title: "Setting up a Postfix SMTP server" -draft: true +title: "Sending and Receiving Email" +tags: ['mail'] +weight: 6 --- + The first step to setting up an email server is having an SMTP server. SMTP sends and receives email. Whether we want a full email server or just the ability to send automated email by script, we will need SMTP, @@ -20,10 +22,13 @@ ports by default**. VPS providers do this to prevent spammers from using their services. If you want to start an email server, therefore, go to your VPS\'s site -and open a ticket or make a request to open up email ports. This is a +and open a ticket or make a request to open up email ports, notably port `25`. This is a simple process that requires nothing too special. One of the wagies at your VPS will kindly do the needful and open your ports for you. Note -that this is not the same as unblocking a port with [ufw](ufw.html). +that this is not the same as unblocking a port with [ufw](ufw.html), +which still needs to be done for SMTP to work. + + ufw allow 25,587 proto tcp ## Installation @@ -35,13 +40,13 @@ mail programs we will use. Installing Postfix for the first time will give us some graphical options. - +{{< img alt="SMTP Postfix internet site choice" src="/pix/smtp-01.png" link="/pix/smtp-01.png" >}} When asked for a \"mail name\", give your full domain name from which -you would like mail to come and go, e.g. [example.org]{.dfn} or -[landchad.net]{.dfn}. +you would like mail to come and go, e.g. **example.org** or +**landchad.net** - +{{< img alt="SMTP Postfix fully qualified domain name" src="/pix/smtp-02.png" link="/pix/smtp-02.png" >}} ## Test the email @@ -53,7 +58,7 @@ command like that below. This is the text." | mail -s "Email from the server" your@emailaddress.com -And that is simply enough the command your server can run to send mail. +This type of command is sufficient enough for your server to send mail. Note that we use the `-s` option to specify the email\'s subject while we pipe the email content into the `mail` command via standard input. In this example I use a quoted multiline email as an example. @@ -65,6 +70,5 @@ major email provider, there is **very high** chance of the message you sent above being marked as spam or not appearing at all! Don\'t worry, we\'ll take care of that in the next two articles where we -set up rDNS and OpenDKIM to validate the emails you send. - -[[Next: rDNS and PTR Records](rdns.html)]{.next} +set up rDNS with your VPS provider and various other DNS +records to validate the emails you send. diff --git a/content/mail/opendkim.md b/content/mail/validate.md index bd8eb5d..f4f8769 100644 --- a/content/mail/opendkim.md +++ b/content/mail/validate.md @@ -1,14 +1,13 @@ --- -title: "Validating your emails with OpenDKIM" -draft: true -tags: ['email'] +title: "Validate Email with DNS Records" +tags: ['mail'] +weight: 4 --- Email is a lot like real-life mail. You can send email to anyone, but you can also write whatever return address you\'d like. That is, it\'s pretty easy to pretend to be someone else via mail, and that was originally the case with email as well: email is just text, and you could just change your `From:` address to any email address you wanted! - DKIM (Domain Keys Identified Mail) helps solve this issue. OpenDKIM will generate a public/private cryptographic key pair for your @@ -101,6 +100,7 @@ OpenDKIM server, which will be running on port `12301`, as a milter (mail filter). This is easy to do with the four commands below: ```sh +postconf -e "myhostname = $(cat /etc/mailname)" postconf -e "milter_default_action = accept" postconf -e "milter_protocol = 6" postconf -e "smtpd_milters = inet:localhost:12301" @@ -185,3 +185,35 @@ This is the text." | mail -s "Email from the server" your@emailaddress.com You can also go to [this site](https://appmaildev.com/en/dkim), which will help you troubleshoot any other DKIM problems if you mistyped something. + +## DMARC + +DMARC (Domain-based Message Authentication Protocol) is a protocol designed +to give email domain owners the ability to protect their domain from +unauthorized use. + +Add the dmarc user: + + useradd -m -G mail dmarc + +Open up your registrar or DNS settings again, and make a new TXT record like +we did with DKIM, except now use the output from the following command: + + echo "_dmarc.$(cat /etc/mailname)" + echo "v=DMARC1; p=reject; rua=mailto:dmarc@$(cat /etc/mailname); fo=1" + +The first line is the Host field. The latter is the TXT value. + +### Sender Policy Framework + +Saving the easiest for last, we should add a TXT record for SPF, +an email-authentication standard used to prevent spammers from sending messages +that appear to come from a spoofed domain. + + cat /etc/mailname + echo "v=spf1 mx a:mail.$(cat /etc/mailname) -all" + +The output of `cat /etc/mailname` is the Host field. The output of the second command is the TXT value. + +Again, you can check [that site](https://appmaildev.com/en/spf) +to make sure your DKIM, DMARC, and SPF entries are valid. That's it! |