1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
|
---
layout: default
title: How To Roll Your Own Email (Debian)
url: /docs/how-to-roll-your-own-email
---
# How To Roll Your Own Email (Debian)
Yes, you can do it yourself!
A lot of people say this is super hard, but that's because don't read manuals. I read the manuals for you and wrote a shorter, easier one, because I love you.
Note that this guide assumes you're using a seperate server just for email, like `mail.aberrata.net`. This is required by big providers such as gmail or they'll automatically reject you for not being fancy enough. Pricks.
1. [Required packages](#required-packages)
2. [SSL certificates](#ssl-certificates)
3. [Setting up postfix](#setting-up-post-fix)
1. [Forwarding aliases](#forwarding-aliases)
4. [DKIM](#dkim)
5. [IMAP](#imap)
6. Firewall rules
7. DNS entries
8. Using it
## Required packages
* certbot-nginx
* dovecot-imapd
* nginx
* opendkim-tools
* opendkim
* postfix
One-liner: `apt install certbot-nginx dovecot-imapd nginx opendkim-tools opendkim postfix`
When you install postfix, it's gonna ask you some configuration questions. Keep reading for how to answer them, if it isn't obvious.
## SSL certificates
Seems like everyone uses them. Just edit `/etc/nginx/sites-available/default` and change the "server name" from an `_` to your server name. `mail.aberrata.net`, for example.
Next, run `certbot --nginx` and do all the default stuff. Should be straightforward.
## Setting up postfix
Okay, first it's gonna ask you for your system mail name. That'll be whatever goes after the @ in your email address. In my case it's aberrata.net.
Next up, what kind of mail server is it? That'll be "Internet Site". Your machine is gonna send and recieve mail directly.
That's all your've gotta pay attention to on the installer. Let the packages finish, then open `/etc/postfix/master.cf` with your favorite text editor. Uncomment the "submission" line and the options below, then set them to look like this:
```
submission inet n - y - - smtpd
-o smtpd_tls_auth_only=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o syslog_name=postfix/submission
-o smtpd_tls_wrappermode=no
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
```
Now to add SSL to postfix. Open /etc/postfix/main.cf and change these lines as appropriate for your system:
```
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.aberrata.net/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.aberrata.net/privkey.pem
```
The only other thing you'll need to do is link opendkim to it. To do that, run usermod -a -G opendkim postfix, then edit /etc/postfix/main.cf and add the following lines to the end:
```
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = local:opendkim/opendkim.sock
```
That's it! Everything else is already at sensible defaults, which is good because digging any deeper into those config files will drive you mad.
## Forwarding aliases
Now for the fun part: `/etc/aliases`! It's a file that lets you define aliases so if mail is sent to one address, it'll arrive at another. International standards require a few aliases to always be there, so my file looks like this:
```
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
# I'm not logging in as root, so forward all root's stuff to my personal address.
root: melerva
```
Whenever you change this file, run `newaliases`.
## DKIM
Another thing you've gotta do to avoid going straight to spam folders. First, get the year and month as numbers, for example 202201 for January 2022. That's your key selector, referred to as $SELECTOR in this snippet that you need to run now:
```
sudo --user opendkim opendkim-genkey --directory=/etc/dkimkeys --domain=$(cat /etc/mailname) --selector=$SELECTOR --nosubdomains
```
You're gonna have to run that every six months or so, if you care about security. After running it, there'll be a new DNS record in `/etc/dkimkeys/$SELECTOR.txt`, which you'll need to add to your domain.
Okay, now to set up opendkim because postfix can't use it by default. Go into /etc/opendkim.conf and comment out this line:
```
#Socket local:/run/opendkim/opendkim.sock
```
Now uncomment this one:
```
Socket local:/var/spool/postfix/opendkim/opendkim.sock
```
Now run the following command(s):
```
mkdir /var/spool/postfix/opendkim
chown opendkim:postfix /var/spool/postfix/opendkim
chmod 775 /var/spool/postfix/opendkim
```
At this point, restart opendkim and then postfix so all your changes will apply:
```
systemctl restart opendkim; systemctl restart postfix
```
## IMAP (dovecot)
Time to give you a way to actually access your mail. Go to /etc/dovecot/dovecot.conf and delete everything. Replace that whole file with this, substituting aberrata.net for your own domain:
```
disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
driver = passwd
}
passdb {
args = %s
driver = pam
}
protocols = " imap"
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
}
ssl=required
ssl_cert =
```
Done! Run `systemctl restart dovecot`. Now for the easy stuff.
## Firewall rules
You can ignore this section if you're stupid, but I'd recommend blocking off every single port execpt the following:
* 22/tcp - SSH access so you can maintain it
* 25/tcp - SMTP for receiving email from others
* 80/tcp - HTTP for certbot renewals
* 587/tcp - Submission port for sending emails
* 993/tcp - IMAPS port for checking your mail
443/tcp (HTTPS) isn't needed because this isn't a web server
## DNS entries
Remember that DKIM record above? Good; here's some more that won't change:
```
@ 10800 IN MX 0 mail
@ 10800 IN TXT "v=spf1 mx -all"
_adsp._domainkey 10800 IN TXT "dkim=all"
_dmarc 10800 IN TXT "v=DMARC1;p=reject;pct=100;"
_imaps._tcp 10800 IN SRV 0 1 993 mail
_submission._tcp 10800 IN SRV 0 1 587 mail
```
Also, be sure to set up reverse DNS on your mailserver's IP(s) that point back to it.
## Using it
To add users, use adduser like you would for any other linux user. Every user on the mailserver can send and receive mail using their linux credentials. i.e. Their username will just be the username without the @domain part, the imap server will be mail.aberrata.net, and the smtp server is also mail.aberrata.net. Use port 587 for sending (with TLS turned on) and port 993 for receiving (with security and authentication on).
Note that anyone can send mail with any from: address, so only give access to people you trust. There's a way to prevent this, but I don't know or care how to do that so you're on your own there. At least you have a mailserver now, and it's perfectly fine for a single user (you)!
Test it by sending a message to [check-auth@verifier.port25.com](mailto:check-auth@verifier.port25.com).
Congratulations. Put this on your resume.
|
