From 855733d9bb434b1ff7e5f94f7f3d993566e3a059 Mon Sep 17 00:00:00 2001 From: APL <17802877+andrelegault@users.noreply.github.com> Date: Thu, 17 Nov 2022 00:48:31 -0500 Subject: `nginx.html` -> `/basic/nginx/` --- content/basic/certbot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/basic/certbot.md b/content/basic/certbot.md index 3b60ea7..f85c4db 100644 --- a/content/basic/certbot.md +++ b/content/basic/certbot.md @@ -5,7 +5,7 @@ tags: ['basic'] --- Once you have a website, it is extremely important to enable encrypted connections over HTTPS/SSL. You might have no idea what that means, but -it\'s easy to do now that we\'ve [set our web server up](nginx.html). +it\'s easy to do now that we\'ve [set our web server up](/basic/nginx/). Certbot is a program that automatically creates and deploys the certificates that allow encrypted connections. It used to be painful -- cgit v1.2.3 From 189a3adbb9d23642876500eebcc739219244feee Mon Sep 17 00:00:00 2001 From: Shuto Tamaoka Date: Sat, 26 Nov 2022 21:49:05 +0900 Subject: Fix rainloop download link The download link is dead so I fixed the link --- content/mail/rainloop.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/mail/rainloop.md b/content/mail/rainloop.md index f43dbb5..b1d92e3 100644 --- a/content/mail/rainloop.md +++ b/content/mail/rainloop.md @@ -33,7 +33,7 @@ Then we will download the community version of Rainloop, unzip it into an appropriate directory and fix all of the file permissions: ```sh -curl -L "https://www.rainloop.net/repository/webmail/rainloop-community-latest.zip" -o "rainloop.zip" +curl -L "https://www.rainloop.net/repository/webmail/rainloop-latest.zip" -o "rainloop.zip" unzip rainloop.zip -d /var/www/mail chown -R www-data: /var/www/mail ``` -- cgit v1.2.3 From 7469e71baeed2d2ede0b3f2dc1a4a79d33946ec3 Mon Sep 17 00:00:00 2001 From: tfasano1 Date: Fri, 18 Nov 2022 00:10:45 -0500 Subject: base line of email course Move email course below services Start managing mail accounts article Order of tutorials corrected combine dovecot and spamassassin into a general inbox setup tut rename tutorials other additions --- content/_index.md | 20 ++++ content/mail/dovecot.md | 112 ---------------------- content/mail/inbox.md | 214 ++++++++++++++++++++++++++++++++++++++++++ content/mail/opendkim.md | 187 ------------------------------------ content/mail/rainloop.md | 117 ----------------------- content/mail/rdns.md | 6 +- content/mail/security.md | 69 ++++++++++++++ content/mail/smtp.md | 28 +++--- content/mail/validate.md | 219 +++++++++++++++++++++++++++++++++++++++++++ content/rainloop.md | 117 +++++++++++++++++++++++ layouts/partials/footer.html | 9 ++ layouts/shortcodes/mail.html | 9 ++ static/style.css | 3 +- 13 files changed, 678 insertions(+), 432 deletions(-) delete mode 100644 content/mail/dovecot.md create mode 100644 content/mail/inbox.md delete mode 100644 content/mail/opendkim.md delete mode 100644 content/mail/rainloop.md create mode 100644 content/mail/security.md create mode 100644 content/mail/validate.md create mode 100644 content/rainloop.md create mode 100644 layouts/shortcodes/mail.html diff --git a/content/_index.md b/content/_index.md index 19626da..aa43e1b 100644 --- a/content/_index.md +++ b/content/_index.md @@ -37,6 +37,26 @@ This is the basic "course." Follow these quick tutorials and you'll have a fully Host your own services, social media and more. +## Setup an Email Server + +
+ +
+ +This is the email "course". Follow these modules to learn how to setup an email server headache free. + +⏳ This entire "email course" may take **about an hour**. The approval for opening email ports with your VPS should take **no less than a day**. + +
+ +
+ +{{< mail >}} + +
+
+
+ ## Maintaining a Server Tips and articles on mastering your server and learning about GNU/Linux systems administration. diff --git a/content/mail/dovecot.md b/content/mail/dovecot.md deleted file mode 100644 index df2b218..0000000 --- a/content/mail/dovecot.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: "Dovecot Email Server" -draft: true ---- -In the article on [SMTP and Postfix](smtp.html), we set up a simple -Postfix server that we could use to programatically send mail with the -`mail` command. In order to have a true and fully-functional mail -server, we need Dovecot, which can store mails received by the server, -have and authenticate user accounts and interact with mail - -## Installation - - apt install dovecot-imapd dovecot-sieve - -## Certificate - -We will want a SSL certificate for the `mail.` subdomain. We can get -this with [Certbot](certbot.html). Assuming we are using Nginx for our -server otherwise, run: - - certbot --nginx certonly -d mail.example.org - -## DNS - -## Configuring Dovecot - -Dovecot\'s configuration file is in `/etc/dovecot/docevot.conf`. If you -open that file, you will this line: `!include conf.d/*.conf` which adds -all the `.conf` files in `/etc/dovecot/conf.d/` to the Dovecot -configuration. - -One can edit each of these files individually to get the needed -configuration, but to make things easy here, delete or backup the main -configuration file and we will replace it with one single config file -with all important settings in it. - -``` wide -ssl = required -ssl_cert = -``` - echo "auth required pam_unix.so nullok - account required pam_unix.so" >> /etc/pam.d/dovecot - -## Connecting Postfix and Dovecot - -[[Next:\<++\>](%3C++%3E)]{.next} diff --git a/content/mail/inbox.md b/content/mail/inbox.md new file mode 100644 index 0000000..dcc071a --- /dev/null +++ b/content/mail/inbox.md @@ -0,0 +1,214 @@ +--- +title: "Setting up an E-mail Inbox" +tags: ['mail'] +weight: 3 +--- +In the article on [SMTP and Postfix](/mail/smtp), we set up a simple +Postfix server that we could use to programatically send mail with the +`mail` command. In order to have a true and fully-functional mail +server, users should be able to login to a mail client where they +can read their inbox and send mail remotely. In order to achieve this we need Dovecot, +which can store mails received by the server, +authenticate user accounts and interact with mail. + +If we're setting up an inbox we will also want spam detection software, such +as spam assassin. + +## Dovecot and Spamassassin + + apt install dovecot-imapd dovecot-sieve spamassassin spamc + +Unblock the imap port: + + ufw allow 993 + +## Certificate + +We will want a SSL certificate for the `mail.` subdomain. We can get +this with [Certbot](/basic/certbot/). Assuming we are using Nginx for our +server otherwise, run: + + certbot --nginx certonly -d mail.example.org + +## DNS + +We also need two little DNS records set on your domain registrar's site/DNS server: + +1. An MX record. Just put your domain, **example.org**, in the "Points to" field. +2. A CNAME record. Host field: **mail.example.org**. "Points to" field: **example.org.** + +## Configuring Dovecot + +Dovecot\'s configuration file is in `/etc/dovecot/docevot.conf`. If you +open that file, you will see this line: `!include conf.d/*.conf` which adds +all the `.conf` files in `/etc/dovecot/conf.d/` to the Dovecot +configuration. + +One can edit each of these files individually to get the needed +configuration, but to make things easy here, delete or backup the main +configuration file and we will replace it with one single config file +with all important settings in it. Make sure you change `ssl_cert` +and `ssl_key` accordingly. + +``` wide +# Note that in the dovecot conf, you can use: +# %u for username +# %n for the name in name@domain.tld +# %d for the domain +# %h the user's home directory + +# Connections between the mail client and Dovecot needs to be encrypted +ssl = required +ssl_cert = /var/lib/dovecot/sieve/default.sieve + +After that, we should create the `vmail` user and group, which will +access the mails, and then update the sieve configuration: + + grep -q '^vmail:' /etc/passwd || useradd vmail + chown -R vmail:vmail /var/lib/dovecot + sievec /var/lib/dovecot/sieve/default.sieve + +Then, enable pam authentication for Dovecot: + + echo "auth required pam_unix.so nullok + account required pam_unix.so" >> /etc/pam.d/dovecot + +## Connecting Postfix and Dovecot + +We need to tell Postfix to look to Dovecot for authenticating users/passwords. +Dovecot will be putting an authentication socket in `/var/spool/postfix/private/auth`. + + postconf -e 'smtpd_sasl_auth_enable = yes' + postconf -e 'smtpd_sasl_type = dovecot' + postconf -e 'smtpd_sasl_path = private/auth' + postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' + +## Connecting Postfix and Spamassassin + +We will change `/etc/postifx/master.cf` so postfix can route mail through spamassassin. First +we can cleanup the default configuration. Feel free to make a backup. + + sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf + +Finally, run this command to finish the configuration for spamassassin. + + echo "smtp unix - - n - - smtp + smtp inet n - y - - smtpd + -o content_filter=spamassassin + submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_sasl_auth_enable=yes + -o smtpd_tls_auth_only=yes + smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes + spamassassin unix - n n - - pipe + user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf + +## Make new mail accounts + +This is the easy part. Let's say we want to add a user Billy and let him +receive mail, run this: + + useradd -m -G mail billy + passwd billy + +Any user added to the `mail` group will be able to receive mail. Suppose a user +Cassie already exists and we want to let her receive mail too. Just run: + + usermod -a -G mail cassie diff --git a/content/mail/opendkim.md b/content/mail/opendkim.md deleted file mode 100644 index bd8eb5d..0000000 --- a/content/mail/opendkim.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: "Validating your emails with OpenDKIM" -draft: true -tags: ['email'] ---- -Email is a lot like real-life mail. You can send email to anyone, but -you can also write whatever return address you\'d like. That is, it\'s -pretty easy to pretend to be someone else via mail, and that was -originally the case with email as well: email is just text, and you -could just change your `From:` address to any email address you wanted! - -DKIM (Domain Keys Identified Mail) helps solve this issue. - -OpenDKIM will generate a public/private cryptographic key pair for your -server. The public key will be made available publicly in your server\'s -DNS records and the private key will be used to sign every single email -that leaves the server. This means that people receiving mail from your -server can now be absolutely sure that it originated from your server -because their servers can check the cryptographic signature on the email -with the public key! - -OpenDKIM ensures that email originated from the server it claims it did, -but it does not ensure that it originated from the user account it -claims it did. This easier problem is solved by server-side -authorization settings. - -## Installation - -```sh -apt install opendkim opendkim-tools -``` - -## The Keys and Files - -We have to generate the DKIM keys and create some secondary files that -will be required for our configuration. - -### Generate the DKIM key - - - -Here we create directories for the OpenDKIM keys, generate them, and -ensure they have the right file permissions. - -```sh -mkdir -p /etc/postfix/dkim -opendkim-genkey -D /etc/postfix/dkim/ -d example.org -s mail -chgrp opendkim /etc/postfix/dkim/* -chmod g+r /etc/postfix/dkim/* -``` - -### Create the key table - -Now we\'ll tell OpenDKIM where the newly generated keys are on the file -system. - -```sh -echo "mail._domainkey.example.org example.org:mail:/etc/postfix/dkim/mail.private" > /etc/postfix/dkim/keytable -``` - -### Create the signing table - -```sh -echo "*@example.org mail._domainkey.example.org" > /etc/postfix/dkim/signingtable -``` - -### Adding trusted hosts - -```sh -echo "127.0.0.1 -10.1.0.0/16 -1.2.3.4/24" > /etc/postfix/dkim/trustedhosts -``` - -## Configuring opendkim.conf - -Now we have all the raw material, so open up `/etc/opendkim.conf` and we -can finalize our server settings. First, add these lines that will -source the files we just created. - -```yaml -KeyTable file:/etc/postfix/dkim/keytable -SigningTable refile:/etc/postfix/dkim/signingtable -InternalHosts refile:/etc/postfix/dkim/trustedhosts - -Canonicalization relaxed/simple -Socket inet:12301@localhost -``` - -There will already be an uncommented `Socket` directive, so delete, -comment out or replace it with the above. - -## Interfacing with Postfix - -There are a couple things we must add to the Postfix SMTP server -settings to interface it with OpenDKIM. Specifically, we have to set our -OpenDKIM server, which will be running on port `12301`, as a milter -(mail filter). This is easy to do with the four commands below: - -```sh -postconf -e "milter_default_action = accept" -postconf -e "milter_protocol = 6" -postconf -e "smtpd_milters = inet:localhost:12301" -postconf -e "non_smtpd_milters = inet:localhost:12301" -``` - -## Restart and reload Postfix and DKIM - -Now that we have all our settings in place: - -```sh -systemctl restart opendkim -systemctl enable opendkim -systemctl reload postfix -``` - -## Adding the DNS record! - -We are only one step away from having functioning OpenDKIM. We must add -the DKIM public key to our server\'s DNS settings, so go ahead and open -up [your registrar\'s site](https://www.epik.com/?affid=we2ro7sa6) or -wherever your site\'s DNS settings are. - -The public key is found in the file `/etc/postfix/dkim/mail.txt`, but it -will display as multiple lines and multiple quoted strings, which is -annoying and hard to copy-and-paste into your registrar. To make things -easier, run the following command to format the key in the way we need -it for the DNS TXT entry: - -```sh -echo -e " - -v=DKIM1; k=rsa; $(tr -d " -" }} - -On my registrar, Epik, this is how it is input, but on some registrars, -it may be required to include your domain name as well as -`mail._domainkey.example.org`. - -If you have your own DNS server, add a TXT entry as follows: - -```txt -mail._domainkey.example.org TXT v=DKIM1; k=rsa; p=ThatLongRandomSequenceOfLettersAndNumbersOfYours -``` - -## Testing it out! - -Now we want to send an email to make sure that your emails will now be -signed with OpenDKIM. - -### Hostname - -If you\'ve followed these instructions, all emails from the domain -**example.org** will now have a DKIM signature on them. If we send mail -via the `mail` command, however, their domain of origin will be whatever -your server\'s hostname is, which you may have set to something -different than your domain. - -You can permanently change your hostname by changing it in -`/etc/hostname` and rebooting, or you can just run -`hostname example.org` to change it temporarily for testing. Either way, -this will allow us to run the `mail` command as in [the SMTP -article](smtp.html). - -```sh -echo "Hi there. - -This is the text." | mail -s "Email from the server" your@emailaddress.com -``` - -### More helpful troubleshooting. - -You can also go to [this site](https://appmaildev.com/en/dkim), which -will help you troubleshoot any other DKIM problems if you mistyped -something. diff --git a/content/mail/rainloop.md b/content/mail/rainloop.md deleted file mode 100644 index b1d92e3..0000000 --- a/content/mail/rainloop.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: "Rainloop" -tags: ['service'] -icon: 'rainloop.png' -short_desc: 'A graphical website for accessing a mail server.' ---- - - -[Rainloop](https://www.rainloop.net/) -is a webmail client, a program that allows you to access your email -online like Gmail. It is useful to be able to access you email from a -web browser because it allows you to easily access your email from any -device with a web browser without any additional setup. - -If you set up -[![logo](/pix/nextcloud.svg)Nextcloud](/nextcloud) -then you do not need to install Rainloop because Nextcloud comes with a -webmail client. However, if all you want is a webmail client and you do -not need all of the extra things that Nextcloud provides, Rainloop would -be the better choice out of the two since it is less bloated and simpler -to install. - -## Instructions - -First we will install the required packages for Rainloop with the -following command: - -```sh -apt-get install php7.4 php7.4-common php7.4-curl php7.4-xml php7.4-fpm php7.4-json php7.4-dev php7.4-mysql unzip -y -``` - -Then we will download the community version of Rainloop, unzip it into -an appropriate directory and fix all of the file permissions: - -```sh -curl -L "https://www.rainloop.net/repository/webmail/rainloop-latest.zip" -o "rainloop.zip" -unzip rainloop.zip -d /var/www/mail -chown -R www-data: /var/www/mail -``` - -We have installed Rainloop itself, but now we need Nginx to serve the -client. We do that by adding the following text into the file -`/etc/nginx/sites-available/mail` (you can replace the bold text with -whatever is appropriate for your server). - -```nginx -server { - - listen 80; - - server_name mail.example.org ; - root /var/www/mail; - - index index.php; - - access_log /var/log/nginx/rainloop_access.log; - error_log /var/log/nginx/rainloop_error.log; - - location / { - try_files $uri $uri/ /index.php?$query_string; - } - - location ~ \.php$ { - fastcgi_index index.php; - fastcgi_split_path_info ^(.+\.php)(.*)$; - fastcgi_keep_conn on; - fastcgi_pass unix:/var/run/php/php7.4-fpm.sock; - include /etc/nginx/fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - } - location ~ /\.ht { - deny all; - } - - location ^~ /data { - deny all; - } -} -``` - -Then enable the site by linking it to the sites-enabled directory: - -```sh -ln -s /etc/nginx/sites-available/mail /etc/nginx/sites-enabled/ -``` - -Reload nginx: - -```sh -systemctl reload nginx -``` - -Finally get certifications if you are using a new subdomain: - -```sh -certbot --nginx -``` - -After that go to `mail.example.org/?admin` and login with the default -username and password: admin, 12345. Now you are in the admin panel and -the first thing you do should be to change the adminsitrator password by -looking in the security tab on the left. - -{{< img alt="rainloop" src="/pix/rainloop-1.png" >}} - -After securing the admin account you can go to domains and add your own -email address. - -{{< img alt="rainloop" src="/pix/rainloop-2.png" >}} - -Finally, go to `mail.example.org` and login with your email address and -password. - -## Contribution - -[Deniz Telci](https://deniz.telci.org/) - XMR: -`4AcKbpTUc3QX2zHYdh9HZwJAQyexdybFhF1WhXTFhxAcV9jgzB6kroqGZDgeW3rQqXEMYJioYo61kaLBqstwecty9Bjbr4v` diff --git a/content/mail/rdns.md b/content/mail/rdns.md index 6571d8c..874449d 100644 --- a/content/mail/rdns.md +++ b/content/mail/rdns.md @@ -1,7 +1,7 @@ --- -title: "rDNS and PTR Records" -draft: true -tags: ['email'] +title: "Setup rDNS" +tags: ['mail'] +weight: 5 --- While [DNS records](dns.html) refer a domain name to the IP address where the the website is hosted, there is also rDNS (reverse DNS) and diff --git a/content/mail/security.md b/content/mail/security.md new file mode 100644 index 0000000..876c40a --- /dev/null +++ b/content/mail/security.md @@ -0,0 +1,69 @@ +--- +title: "Harden your E-mail Server" +tags: ['mail'] +weight: 2 +--- + +## Hardening Postfix + +Put restrictions on servers sending mail to you. + + postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' + +## Anonymize Headers + +Use some regular expressions to prevent some meta data like a client's ip address +from being leaked. + + echo "/^Received:.*/ IGNORE + /^X-Originating-IP:/ IGNORE" + /^User-Agent:/ IGNORE + /^X-Mailer:/ IGNORE >> /etc/postfix/header_checks + +Add this file to the postfix configuration: + + postconf -e "header_checks = regexp:/etc/postfix/header_checks" + +## Fail2Ban + +If you're not familiar with fail2Ban, it's essentially a program which +blocks bot's and hacker's login requests after a few invalid attempts. + + apt-get install fail2ban + +Make a local copy of the configuration file: + + cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local + +Go down to the `# Mail servers` line and paste this: + + [postfix] + + enabled = true + port = smtp,ssmtp,submission + filter = postfix + logpath = /var/log/mail.log + + + [sasl] + + enabled = true + port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s + filter = postfix-sasl + # You might consider monitoring /var/log/mail.warn instead if you are + # running postfix since it would provide the same log lines at the + # "warn" level but overall at the smaller filesize. + logpath = /var/log/mail.warn + maxretry = 1 + bantime = 21600 + + [dovecot] + + enabled = true + port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s + filter = dovecot + logpath = /var/log/mail.log + +This will only grant 2 login attempts and then block the requester for 6 hours. Now restart `fail2ban`: + + systemctl restart fail2ban diff --git a/content/mail/smtp.md b/content/mail/smtp.md index 6ce92f2..2039907 100644 --- a/content/mail/smtp.md +++ b/content/mail/smtp.md @@ -1,7 +1,9 @@ --- -title: "Setting up a Postfix SMTP server" -draft: true +title: "Sending and Receiving Email" +tags: ['mail'] +weight: 6 --- + The first step to setting up an email server is having an SMTP server. SMTP sends and receives email. Whether we want a full email server or just the ability to send automated email by script, we will need SMTP, @@ -20,10 +22,13 @@ ports by default**. VPS providers do this to prevent spammers from using their services. If you want to start an email server, therefore, go to your VPS\'s site -and open a ticket or make a request to open up email ports. This is a +and open a ticket or make a request to open up email ports, notably port `25`. This is a simple process that requires nothing too special. One of the wagies at your VPS will kindly do the needful and open your ports for you. Note -that this is not the same as unblocking a port with [ufw](ufw.html). +that this is not the same as unblocking a port with [ufw](ufw.html), +which still needs to be done for SMTP to work. + + ufw allow 25,587 proto tcp ## Installation @@ -35,13 +40,13 @@ mail programs we will use. Installing Postfix for the first time will give us some graphical options. -![SMTP Postfix internet site choice](pix/smtp-01.png) +{{< img alt="SMTP Postfix internet site choice" src="/pix/smtp-01.png" link="/pix/smtp-01.png" >}} When asked for a \"mail name\", give your full domain name from which -you would like mail to come and go, e.g. [example.org]{.dfn} or -[landchad.net]{.dfn}. +you would like mail to come and go, e.g. **example.org** or +**landchad.net** -![SMTP Postfix fully qualified domain name](pix/smtp-02.png) +{{< img alt="SMTP Postfix fully qualified domain name" src="/pix/smtp-02.png" link="/pix/smtp-02.png" >}} ## Test the email @@ -53,7 +58,7 @@ command like that below. This is the text." | mail -s "Email from the server" your@emailaddress.com -And that is simply enough the command your server can run to send mail. +This type of command is sufficient enough for your server to send mail. Note that we use the `-s` option to specify the email\'s subject while we pipe the email content into the `mail` command via standard input. In this example I use a quoted multiline email as an example. @@ -65,6 +70,5 @@ major email provider, there is **very high** chance of the message you sent above being marked as spam or not appearing at all! Don\'t worry, we\'ll take care of that in the next two articles where we -set up rDNS and OpenDKIM to validate the emails you send. - -[[Next: rDNS and PTR Records](rdns.html)]{.next} +set up rDNS with your VPS provider and various other DNS +records to validate the emails you send. diff --git a/content/mail/validate.md b/content/mail/validate.md new file mode 100644 index 0000000..f4f8769 --- /dev/null +++ b/content/mail/validate.md @@ -0,0 +1,219 @@ +--- +title: "Validate Email with DNS Records" +tags: ['mail'] +weight: 4 +--- +Email is a lot like real-life mail. You can send email to anyone, but +you can also write whatever return address you\'d like. That is, it\'s +pretty easy to pretend to be someone else via mail, and that was +originally the case with email as well: email is just text, and you +could just change your `From:` address to any email address you wanted! +DKIM (Domain Keys Identified Mail) helps solve this issue. + +OpenDKIM will generate a public/private cryptographic key pair for your +server. The public key will be made available publicly in your server\'s +DNS records and the private key will be used to sign every single email +that leaves the server. This means that people receiving mail from your +server can now be absolutely sure that it originated from your server +because their servers can check the cryptographic signature on the email +with the public key! + +OpenDKIM ensures that email originated from the server it claims it did, +but it does not ensure that it originated from the user account it +claims it did. This easier problem is solved by server-side +authorization settings. + +## Installation + +```sh +apt install opendkim opendkim-tools +``` + +## The Keys and Files + +We have to generate the DKIM keys and create some secondary files that +will be required for our configuration. + +### Generate the DKIM key + + + +Here we create directories for the OpenDKIM keys, generate them, and +ensure they have the right file permissions. + +```sh +mkdir -p /etc/postfix/dkim +opendkim-genkey -D /etc/postfix/dkim/ -d example.org -s mail +chgrp opendkim /etc/postfix/dkim/* +chmod g+r /etc/postfix/dkim/* +``` + +### Create the key table + +Now we\'ll tell OpenDKIM where the newly generated keys are on the file +system. + +```sh +echo "mail._domainkey.example.org example.org:mail:/etc/postfix/dkim/mail.private" > /etc/postfix/dkim/keytable +``` + +### Create the signing table + +```sh +echo "*@example.org mail._domainkey.example.org" > /etc/postfix/dkim/signingtable +``` + +### Adding trusted hosts + +```sh +echo "127.0.0.1 +10.1.0.0/16 +1.2.3.4/24" > /etc/postfix/dkim/trustedhosts +``` + +## Configuring opendkim.conf + +Now we have all the raw material, so open up `/etc/opendkim.conf` and we +can finalize our server settings. First, add these lines that will +source the files we just created. + +```yaml +KeyTable file:/etc/postfix/dkim/keytable +SigningTable refile:/etc/postfix/dkim/signingtable +InternalHosts refile:/etc/postfix/dkim/trustedhosts + +Canonicalization relaxed/simple +Socket inet:12301@localhost +``` + +There will already be an uncommented `Socket` directive, so delete, +comment out or replace it with the above. + +## Interfacing with Postfix + +There are a couple things we must add to the Postfix SMTP server +settings to interface it with OpenDKIM. Specifically, we have to set our +OpenDKIM server, which will be running on port `12301`, as a milter +(mail filter). This is easy to do with the four commands below: + +```sh +postconf -e "myhostname = $(cat /etc/mailname)" +postconf -e "milter_default_action = accept" +postconf -e "milter_protocol = 6" +postconf -e "smtpd_milters = inet:localhost:12301" +postconf -e "non_smtpd_milters = inet:localhost:12301" +``` + +## Restart and reload Postfix and DKIM + +Now that we have all our settings in place: + +```sh +systemctl restart opendkim +systemctl enable opendkim +systemctl reload postfix +``` + +## Adding the DNS record! + +We are only one step away from having functioning OpenDKIM. We must add +the DKIM public key to our server\'s DNS settings, so go ahead and open +up [your registrar\'s site](https://www.epik.com/?affid=we2ro7sa6) or +wherever your site\'s DNS settings are. + +The public key is found in the file `/etc/postfix/dkim/mail.txt`, but it +will display as multiple lines and multiple quoted strings, which is +annoying and hard to copy-and-paste into your registrar. To make things +easier, run the following command to format the key in the way we need +it for the DNS TXT entry: + +```sh +echo -e " + +v=DKIM1; k=rsa; $(tr -d " +" }} + +On my registrar, Epik, this is how it is input, but on some registrars, +it may be required to include your domain name as well as +`mail._domainkey.example.org`. + +If you have your own DNS server, add a TXT entry as follows: + +```txt +mail._domainkey.example.org TXT v=DKIM1; k=rsa; p=ThatLongRandomSequenceOfLettersAndNumbersOfYours +``` + +## Testing it out! + +Now we want to send an email to make sure that your emails will now be +signed with OpenDKIM. + +### Hostname + +If you\'ve followed these instructions, all emails from the domain +**example.org** will now have a DKIM signature on them. If we send mail +via the `mail` command, however, their domain of origin will be whatever +your server\'s hostname is, which you may have set to something +different than your domain. + +You can permanently change your hostname by changing it in +`/etc/hostname` and rebooting, or you can just run +`hostname example.org` to change it temporarily for testing. Either way, +this will allow us to run the `mail` command as in [the SMTP +article](smtp.html). + +```sh +echo "Hi there. + +This is the text." | mail -s "Email from the server" your@emailaddress.com +``` + +### More helpful troubleshooting. + +You can also go to [this site](https://appmaildev.com/en/dkim), which +will help you troubleshoot any other DKIM problems if you mistyped +something. + +## DMARC + +DMARC (Domain-based Message Authentication Protocol) is a protocol designed +to give email domain owners the ability to protect their domain from +unauthorized use. + +Add the dmarc user: + + useradd -m -G mail dmarc + +Open up your registrar or DNS settings again, and make a new TXT record like +we did with DKIM, except now use the output from the following command: + + echo "_dmarc.$(cat /etc/mailname)" + echo "v=DMARC1; p=reject; rua=mailto:dmarc@$(cat /etc/mailname); fo=1" + +The first line is the Host field. The latter is the TXT value. + +### Sender Policy Framework + +Saving the easiest for last, we should add a TXT record for SPF, +an email-authentication standard used to prevent spammers from sending messages +that appear to come from a spoofed domain. + + cat /etc/mailname + echo "v=spf1 mx a:mail.$(cat /etc/mailname) -all" + +The output of `cat /etc/mailname` is the Host field. The output of the second command is the TXT value. + +Again, you can check [that site](https://appmaildev.com/en/spf) +to make sure your DKIM, DMARC, and SPF entries are valid. That's it! diff --git a/content/rainloop.md b/content/rainloop.md new file mode 100644 index 0000000..b1d92e3 --- /dev/null +++ b/content/rainloop.md @@ -0,0 +1,117 @@ +--- +title: "Rainloop" +tags: ['service'] +icon: 'rainloop.png' +short_desc: 'A graphical website for accessing a mail server.' +--- + + +[Rainloop](https://www.rainloop.net/) +is a webmail client, a program that allows you to access your email +online like Gmail. It is useful to be able to access you email from a +web browser because it allows you to easily access your email from any +device with a web browser without any additional setup. + +If you set up +[![logo](/pix/nextcloud.svg)Nextcloud](/nextcloud) +then you do not need to install Rainloop because Nextcloud comes with a +webmail client. However, if all you want is a webmail client and you do +not need all of the extra things that Nextcloud provides, Rainloop would +be the better choice out of the two since it is less bloated and simpler +to install. + +## Instructions + +First we will install the required packages for Rainloop with the +following command: + +```sh +apt-get install php7.4 php7.4-common php7.4-curl php7.4-xml php7.4-fpm php7.4-json php7.4-dev php7.4-mysql unzip -y +``` + +Then we will download the community version of Rainloop, unzip it into +an appropriate directory and fix all of the file permissions: + +```sh +curl -L "https://www.rainloop.net/repository/webmail/rainloop-latest.zip" -o "rainloop.zip" +unzip rainloop.zip -d /var/www/mail +chown -R www-data: /var/www/mail +``` + +We have installed Rainloop itself, but now we need Nginx to serve the +client. We do that by adding the following text into the file +`/etc/nginx/sites-available/mail` (you can replace the bold text with +whatever is appropriate for your server). + +```nginx +server { + + listen 80; + + server_name mail.example.org ; + root /var/www/mail; + + index index.php; + + access_log /var/log/nginx/rainloop_access.log; + error_log /var/log/nginx/rainloop_error.log; + + location / { + try_files $uri $uri/ /index.php?$query_string; + } + + location ~ \.php$ { + fastcgi_index index.php; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_keep_conn on; + fastcgi_pass unix:/var/run/php/php7.4-fpm.sock; + include /etc/nginx/fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + location ~ /\.ht { + deny all; + } + + location ^~ /data { + deny all; + } +} +``` + +Then enable the site by linking it to the sites-enabled directory: + +```sh +ln -s /etc/nginx/sites-available/mail /etc/nginx/sites-enabled/ +``` + +Reload nginx: + +```sh +systemctl reload nginx +``` + +Finally get certifications if you are using a new subdomain: + +```sh +certbot --nginx +``` + +After that go to `mail.example.org/?admin` and login with the default +username and password: admin, 12345. Now you are in the admin panel and +the first thing you do should be to change the adminsitrator password by +looking in the security tab on the left. + +{{< img alt="rainloop" src="/pix/rainloop-1.png" >}} + +After securing the admin account you can go to domains and add your own +email address. + +{{< img alt="rainloop" src="/pix/rainloop-2.png" >}} + +Finally, go to `mail.example.org` and login with your email address and +password. + +## Contribution + +[Deniz Telci](https://deniz.telci.org/) - XMR: +`4AcKbpTUc3QX2zHYdh9HZwJAQyexdybFhF1WhXTFhxAcV9jgzB6kroqGZDgeW3rQqXEMYJioYo61kaLBqstwecty9Bjbr4v` diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html index 7742c7e..ecfb175 100644 --- a/layouts/partials/footer.html +++ b/layouts/partials/footer.html @@ -5,8 +5,17 @@ {{ with .PrevInSection }} Or Previous: {{ .Title }} {{ end }} + {{ end }} + {{ if in .Params.tags "mail" }} + {{ with .NextInSection }} + + {{ end }} + {{ with .PrevInSection }} + Or Previous: {{ .Title }} {{ end }} + {{ end }} + diff --git a/layouts/shortcodes/mail.html b/layouts/shortcodes/mail.html new file mode 100644 index 0000000..53cc3b9 --- /dev/null +++ b/layouts/shortcodes/mail.html @@ -0,0 +1,9 @@ +
    +{{range.Site.RegularPages.ByWeight.Reverse}}{{ if in .Params.tags "mail" }}
  1. + +{{ with .Params.icon }}{{ end }} +{{.Title}} +{{ with .Params.short_desc }}{{ . }}{{ end }}{{.Params.Tags}} +
    2. {{ end }}{{ end }} +
+ diff --git a/static/style.css b/static/style.css index 55c7c95..00b5710 100644 --- a/static/style.css +++ b/static/style.css @@ -236,6 +236,7 @@ aside.callout { margin: auto ; display: block ; font-weight: bold ; + padding: 1em ; } .prev:before { @@ -253,7 +254,7 @@ aside.callout { margin: auto ; display: block ; font-weight: bold ; - padding: 0 1em 1em 1em ; + padding: 1em ; } #servicelist { -- cgit v1.2.3 From 551de0c6f18d145848586b8cc1b55f2788edff23 Mon Sep 17 00:00:00 2001 From: Luke Smith Date: Mon, 5 Dec 2022 13:31:54 -0500 Subject: template fix --- layouts/_default/baseof.html | 26 ++++++++++++++++++++------ layouts/partials/footer.html | 22 ---------------------- 2 files changed, 20 insertions(+), 28 deletions(-) delete mode 100644 layouts/partials/footer.html diff --git a/layouts/_default/baseof.html b/layouts/_default/baseof.html index a299bc0..6a1b6ff 100644 --- a/layouts/_default/baseof.html +++ b/layouts/_default/baseof.html @@ -19,18 +19,32 @@

{{ with .Params.icon }}{{ end }}{{ .Title }}

{{ with .Params.img }}{{ end }} -{{ block "main" . }} +{{ block "main" . -}} {{ .Content }} -{{ end }} -{{ if .Param "nextprev" }}{{ partial "nextprev.html" . -}}{{ end -}} -{{ if .Param "taglist" }}{{ partial "taglist.html" . }}{{ end -}} +{{- end -}}
+{{- if in .Params.tags "basic" -}} +{{ with .NextInSection }} + +{{- end }} +{{- with .PrevInSection }} +Or Previous: {{ .Title }} +{{- end -}} +{{- end }} +{{ if in .Params.tags "mail" -}} +{{ with .NextInSection -}} + +{{- end -}} +{{- with .PrevInSection }} +Or Previous: {{ .Title }} +{{- end -}} +{{- end }}
-{{ block "footer" . }} +{{ block "footer" . -}} -{{ end }} +{{- end }} diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html deleted file mode 100644 index ecfb175..0000000 --- a/layouts/partials/footer.html +++ /dev/null @@ -1,22 +0,0 @@ - {{ if in .Params.tags "basic" }} - {{ with .NextInSection }} - - {{ end }} - {{ with .PrevInSection }} - Or Previous: {{ .Title }} - {{ end }} - {{ end }} - - {{ if in .Params.tags "mail" }} - {{ with .NextInSection }} - - {{ end }} - {{ with .PrevInSection }} - Or Previous: {{ .Title }} - {{ end }} - {{ end }} - - - - - -- cgit v1.2.3