initial commit

1 files changed, 209 insertions, 0 deletions

diff --git a/smtpd.md b/smtpd.md
new file mode 100644
index 0000000..974b7b8
--- /dev/null
+++ b/smtpd.md
@@ -0,0 +1,209 @@
+---
+layout: default
+title: How To Roll Your Own Email (Debian)
+url: /docs/how-to-roll-your-own-email
+---
+
+# How To Roll Your Own Email (Debian)
+
+Yes, you can do it yourself!
+
+A lot of people say this is super hard, but that's because don't read manuals. I read the manuals for you and wrote a shorter, easier one, because I love you.
+
+Note that this guide assumes you're using a seperate server just for email, like `mail.aberrata.net`. This is required by big providers such as gmail or they'll automatically reject you for not being fancy enough. Pricks.
+
+1. [Required packages](#required-packages)
+2. [SSL certificates](#ssl-certificates)
+3. [Setting up postfix](#setting-up-post-fix)
+    1. [Forwarding aliases](#forwarding-aliases)
+4. [DKIM](#dkim)
+5. [IMAP](#imap)
+6. Firewall rules
+7. DNS entries
+8. Using it
+
+## Required packages
+
+* certbot-nginx
+* dovecot-imapd
+* nginx
+* opendkim-tools
+* opendkim
+* postfix
+
+One-liner: `apt install certbot-nginx dovecot-imapd nginx opendkim-tools opendkim postfix`
+
+When you install postfix, it's gonna ask you some configuration questions. Keep reading for how to answer them, if it isn't obvious.
+
+## SSL certificates
+
+Seems like everyone uses them. Just edit `/etc/nginx/sites-available/default` and change the "server name" from an `_` to your server name. `mail.aberrata.net`, for example.
+
+Next, run `certbot --nginx` and do all the default stuff. Should be straightforward.
+
+## Setting up postfix
+
+Okay, first it's gonna ask you for your system mail name. That'll be whatever goes after the @ in your email address. In my case it's aberrata.net.
+
+Next up, what kind of mail server is it? That'll be "Internet Site". Your machine is gonna send and recieve mail directly.
+
+That's all your've gotta pay attention to on the installer. Let the packages finish, then open `/etc/postfix/master.cf` with your favorite text editor. Uncomment the "submission" line and the options below, then set them to look like this:
+
+```
+submission inet n       -       y       -       -       smtpd
+  -o smtpd_tls_auth_only=yes
+  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_helo_restrictions=$mua_helo_restrictions
+  -o smtpd_sender_restrictions=$mua_sender_restrictions
+  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_wrappermode=no
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+  -o smtpd_sasl_type=dovecot
+  -o smtpd_sasl_path=private/auth
+  ```
+
+   Now to add SSL to postfix. Open /etc/postfix/main.cf and change these lines as appropriate for your system:
+
+```
+    smtpd_tls_cert_file=/etc/letsencrypt/live/mail.aberrata.net/fullchain.pem
+    smtpd_tls_key_file=/etc/letsencrypt/live/mail.aberrata.net/privkey.pem
+```
+
+The only other thing you'll need to do is link opendkim to it. To do that, run usermod -a -G opendkim postfix, then edit /etc/postfix/main.cf and add the following lines to the end:
+
+```
+    milter_default_action = accept
+    milter_protocol = 6
+    smtpd_milters = local:opendkim/opendkim.sock
+    non_smtpd_milters = local:opendkim/opendkim.sock
+```
+
+That's it! Everything else is already at sensible defaults, which is good because digging any deeper into those config files will drive you mad. 
+
+## Forwarding aliases
+
+Now for the fun part: `/etc/aliases`! It's a file that lets you define aliases so if mail is sent to one address, it'll arrive at another. International standards require a few aliases to always be there, so my file looks like this:
+
+```
+    mailer-daemon: postmaster
+    postmaster: root
+    nobody: root
+    hostmaster: root
+    usenet: root
+    news: root
+    webmaster: root
+    www: root
+    ftp: root
+    abuse: root
+
+    # I'm not logging in as root, so forward all root's stuff to my personal address.
+    root: melerva
+```
+
+Whenever you change this file, run `newaliases`.
+
+## DKIM
+
+Another thing you've gotta do to avoid going straight to spam folders. First, get the year and month as numbers, for example 202201 for January 2022. That's your key selector, referred to as $SELECTOR in this snippet that you need to run now:
+
+```
+sudo --user opendkim opendkim-genkey --directory=/etc/dkimkeys --domain=$(cat /etc/mailname) --selector=$SELECTOR --nosubdomains
+```
+
+You're gonna have to run that every six months or so, if you care about security. After running it, there'll be a new DNS record in `/etc/dkimkeys/$SELECTOR.txt`, which you'll need to add to your domain.
+
+Okay, now to set up opendkim because postfix can't use it by default. Go into /etc/opendkim.conf and comment out this line:
+
+```
+    #Socket                 local:/run/opendkim/opendkim.sock
+```
+
+Now uncomment this one:
+
+```
+    Socket                  local:/var/spool/postfix/opendkim/opendkim.sock
+```
+
+Now run the following command(s):
+
+```
+    mkdir /var/spool/postfix/opendkim
+    chown opendkim:postfix /var/spool/postfix/opendkim
+    chmod 775 /var/spool/postfix/opendkim
+```
+
+At this point, restart opendkim and then postfix so all your changes will apply:
+
+```
+systemctl restart opendkim; systemctl restart postfix
+```
+
+## IMAP (dovecot)
+
+ Time to give you a way to actually access your mail. Go to /etc/dovecot/dovecot.conf and delete everything. Replace that whole file with this, substituting aberrata.net for your own domain:
+
+```
+    disable_plaintext_auth = no
+    mail_privileged_group = mail
+    mail_location = mbox:~/mail:INBOX=/var/mail/%u
+    userdb {
+      driver = passwd
+    }
+    passdb {
+      args = %s
+      driver = pam
+    }
+    protocols = " imap"
+    service auth {
+      unix_listener /var/spool/postfix/private/auth {
+        group = postfix
+        mode = 0660
+        user = postfix
+      }
+    }
+    ssl=required
+    ssl_cert = 
+```
+
+Done! Run `systemctl restart dovecot`. Now for the easy stuff.
+
+## Firewall rules
+
+You can ignore this section if you're stupid, but I'd recommend blocking off every single port execpt the following:
+
+* 22/tcp - SSH access so you can maintain it
+* 25/tcp - SMTP for receiving email from others
+* 80/tcp - HTTP for certbot renewals
+* 587/tcp - Submission port for sending emails
+* 993/tcp - IMAPS port for checking your mail
+
+443/tcp (HTTPS) isn't needed because this isn't a web server
+
+## DNS entries
+
+ Remember that DKIM record above? Good; here's some more that won't change:
+
+```
+    @ 10800 IN MX 0 mail
+    @ 10800 IN TXT "v=spf1 mx -all"
+    _adsp._domainkey 10800 IN TXT "dkim=all"
+    _dmarc 10800 IN TXT "v=DMARC1;p=reject;pct=100;"
+    _imaps._tcp 10800 IN SRV 0 1 993 mail
+    _submission._tcp 10800 IN SRV 0 1 587 mail
+```
+
+Also, be sure to set up reverse DNS on your mailserver's IP(s) that point back to it.
+
+## Using it
+
+ To add users, use adduser like you would for any other linux user. Every user on the mailserver can send and receive mail using their linux credentials. i.e. Their username will just be the username without the @domain part, the imap server will be mail.aberrata.net, and the smtp server is also mail.aberrata.net. Use port 587 for sending (with TLS turned on) and port 993 for receiving (with security and authentication on).
+
+Note that anyone can send mail with any from: address, so only give access to people you trust. There's a way to prevent this, but I don't know or care how to do that so you're on your own there. At least you have a mailserver now, and it's perfectly fine for a single user (you)!
+
+Test it by sending a message to [check-auth@verifier.port25.com](mailto:check-auth@verifier.port25.com).
+
+Congratulations. Put this on your resume.