Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| email:install-preliminary [2025/03/03 06:57] – created willy | email:install-preliminary [2025/03/13 13:29] (current) – willy | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ===== B) user, permissions & storage ===== | ||
| - | ===== Installation: | + | Since different pieces of the email infrastructure will need to interoperate, |
| - | Install Postfix | + | The second user that you need to take into account is user **web**. PostfixAdmin will be running under user web, because on the external server i choose to run only one instance of PHP-FPM. This means that the database itself will need to be writable by user web and readable by user vmail. Due to security concern, you do not want the user web to be in the same group as user vmail, and vice versa. |
| - | USE flags: | + | As storage structure, you will need two different locations: |
| - | <code bash> | + | |
| - | echo "*/* maildir dovecot sasl" >> | + | * **/ |
| - | echo " | + | |
| - | echo " | + | |
| - | echo " | + | |
| - | </ | + | |
| - | + | ||
| - | Emerge the servers: | + | |
| - | <code bash> | + | |
| - | emerge -vp postfix dovecot | + | |
| - | </ | + | |
| - | + | ||
| - | + | ||
| - | ===== Installation: | + | |
| - | + | ||
| - | Since different pieces of the email infrastructure will need to interoperate, | + | |
| + | I assume you already have a //web// account. So: | ||
| <code bash> | <code bash> | ||
| groupadd -g 5000 vmail | groupadd -g 5000 vmail | ||
| - | useradd -m -d /home/vmail -s /bin/false -u 5000 -g vmail vmail | + | mkdir / |
| - | chmod 2770 / | + | useradd -m -d /home/vmail/ |
| + | chmod 2770 / | ||
| + | mkdir / | ||
| + | chown web:vmail / | ||
| </ | </ | ||
| The resulting permissions should look like: | The resulting permissions should look like: | ||
| <code bash> | <code bash> | ||
| - | ls -ld / | + | ls -ld /home/vmail/ |
| - | drwxrws--- 3 vmail vmail 4096 Aug 2 07:24 /home/vmail | + | drwxrw-xr-x 3 root root 4096 Aug 2 07:24 / |
| + | ls -ld / | ||
| + | drwxrws--- 3 vmail vmail 4096 Aug 2 07:24 /home/vmail/storage | ||
| + | ls -ld / | ||
| + | drwxr-x--- 3 web vmail 4096 Aug 2 07:24 / | ||
| </ | </ | ||
| - | FIX QUI I PERMESSI DEL DB | ||
| Now create the database: | Now create the database: | ||
| <code bash> | <code bash> | ||
| - | su - vmail | + | su - web |
| - | mkdir db | + | cd /home/vmail/database |
| - | sqlite3 | + | sqlite3 vmail.sqlite3 |
| sqlite> .databases | sqlite> .databases | ||
| - | main: / | + | main: vmail.sqlite3 r/w |
| sqlite> .tables | sqlite> .tables | ||
| sqlite> .exit | sqlite> .exit | ||
| Line 48: | Line 42: | ||
| - | ===== Installation: | ||
| - | |||
| - | postfixadmin and roundcube will be installed manually and not via Gentoo portage, to avoid upgrade issues. | ||
| - | |||
| - | Download latest release of **postfixadmin** from [[https:// | ||
| - | <code bash> | ||
| - | su # do this as root! You don't need to make postfixadmin writable by the web user | ||
| - | cd /home/web | ||
| - | mkdir postfixadmin | ||
| - | cd postfixadmin | ||
| - | wget https:// | ||
| - | tar xvf postfixadmin-3.3.15.tar.gz | ||
| - | mv postfixadmin-postfixadmin-3.3.15 postfixadmin | ||
| - | #The following folder must be writeable by web user: | ||
| - | mkdir -p postfixadmin/ | ||
| - | chown -R web postfixadmin/ | ||
| - | </ | ||
| - | |||
| - | Now, configure it by creating a file called **postfixadmin/ | ||
| - | <file - config.local.php> | ||
| - | <?php | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | ' | ||
| - | ' | ||
| - | ' | ||
| - | ' | ||
| - | ); | ||
| - | $CONF[' | ||
| - | $CONF[' | ||
| - | /* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: | ||
| - | </ | ||
| - | |||
| - | Now setup NGINX to point to it. You need of course to setup a certbot certificate, | ||
| - | <file postfixadmin.conf> | ||
| - | server { | ||
| - | server_name mail.mydomain.com; | ||
| - | listen 443 ssl; | ||
| - | |||
| - | access_log / | ||
| - | error_log / | ||
| - | | ||
| - | index index.php; | ||
| - | | ||
| - | root / | ||
| - | |||
| - | # Uncomment the following lines only AFTER setup is complete! | ||
| - | # location ~ / | ||
| - | # deny all; | ||
| - | # alias / | ||
| - | # } | ||
| - | | ||
| - | location ~ /.*\.php$ { | ||
| - | try_files $uri =404; | ||
| - | fastcgi_split_path_info ^(.+\.php)(/ | ||
| - | include fastcgi_params; | ||
| - | fastcgi_param SCRIPT_FILENAME $request_filename; | ||
| - | fastcgi_pass 127.0.0.1: | ||
| - | } | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | restart NGINX and go to the URL **https:// | ||
| - | |||
| - | Also don't forget to create a superadmin-account. I suggest you call it **user@mydomain.com** and set a password you will not forget. | ||
| - | |||
| - | Go back, uncomment the lines in the NGINX config file to disable the setup.php, and restart NGINX. | ||
| - | |||
| - | __note:__ when adding new domains, choose " | ||
| - | |||
| - | At this point, you can already create all the mail domains and user accounts you want. | ||
| - | |||
| - | |||
| - | ===== Configuration: | ||
| - | |||
| - | Link to SQL. | ||
| - | |||
| - | File: **/ | ||
| - | <file - virtual_mailbox_domains.cf> | ||
| - | dbpath = / | ||
| - | query = SELECT domain FROM domain WHERE domain = ' | ||
| - | </ | ||
| - | |||
| - | File: **/ | ||
| - | <file - virtual_mailbox_maps.cf> | ||
| - | dbpath = / | ||
| - | query = SELECT maildir FROM mailbox WHERE local_part=' | ||
| - | </ | ||
| - | |||
| - | File: **/ | ||
| - | <file - virtual_alias_maps.cf> | ||
| - | dbpath = / | ||
| - | query = SELECT goto FROM alias WHERE address=' | ||
| - | </ | ||
| - | |||
| - | Now, link it all in **/ | ||
| - | < | ||
| - | # A list of all virtual domains serviced by this instance of postfix. | ||
| - | virtual_mailbox_domains = sqlite:/ | ||
| - | # Look up the mailbox location based on the email address received. | ||
| - | virtual_mailbox_maps = sqlite:/ | ||
| - | # Any aliases that are supported by this system | ||
| - | virtual_alias_maps = sqlite:/ | ||
| - | </ | ||
| - | |||
| - | |||
| - | |||
| - | < | ||
| - | compatibility_level = 3.6 | ||
| - | |||
| - | # Prevent hard-bounces | ||
| - | soft_bounce = yes | ||
| - | |||
| - | queue_directory = / | ||
| - | command_directory = /usr/sbin | ||
| - | daemon_directory = / | ||
| - | data_directory = / | ||
| - | |||
| - | mail_owner = postfix | ||
| - | |||
| - | # Usa gethostname() per default | ||
| - | #myhostname = gardiol.org | ||
| - | |||
| - | mydomain = gardiol.org | ||
| - | |||
| - | #myorigin = $mydomain | ||
| - | # | ||
| - | |||
| - | mydestination = localhost.localdomain | ||
| - | unknown_local_recipient_reject_code = 550 | ||
| - | |||
| - | mynetworks_style = host | ||
| - | |||
| - | in_flow_delay = 1s | ||
| - | |||
| - | home_mailbox = .maildir/ | ||
| - | |||
| - | header_checks = regexp:/ | ||
| - | |||
| - | smtpd_banner = $myhostname ESMTP NO UCE | ||
| - | |||
| - | debug_peer_level = 2 | ||
| - | # | ||
| - | |||
| - | sendmail_path = / | ||
| - | newaliases_path = / | ||
| - | mailq_path = / | ||
| - | |||
| - | setgid_group = postdrop | ||
| - | html_directory = no | ||
| - | manpage_directory = / | ||
| - | sample_directory = / | ||
| - | readme_directory = no | ||
| - | inet_protocols = ipv4 | ||
| - | meta_directory = / | ||
| - | shlib_directory = / | ||
| - | |||
| - | |||
| - | ############################################ | ||
| - | ########################################### | ||
| - | ########################################### | ||
| - | disable_vrfy_command = yes | ||
| - | message_size_limit = 0 | ||
| - | #20971520 | ||
| - | biff = no | ||
| - | |||
| - | local_transport = virtual | ||
| - | local_recipient_maps = $alias_maps $virtual_mailbox_maps | ||
| - | |||
| - | virtual_transport = lmtp: | ||
| - | |||
| - | virtual_uid_maps = static:999 | ||
| - | virtual_gid_maps = static:999 | ||
| - | |||
| - | virtual_mailbox_domains = proxy: | ||
| - | virtual_alias_maps = proxy: | ||
| - | | ||
| - | | ||
| - | virtual_mailbox_maps = proxy: | ||
| - | | ||
| - | |||
| - | # if you let postfix store your mails directly (without using maildrop, dovecot deliver etc.) | ||
| - | virtual_mailbox_base = /home/vmail | ||
| - | |||
| - | # SASL | ||
| - | smtpd_sasl_type = dovecot | ||
| - | smtpd_sasl_path = private/ | ||
| - | smtpd_sasl_auth_enable = yes | ||
| - | smtpd_sasl_security_options = noanonymous | ||
| - | smtpd_sasl_local_domain = | ||
| - | broken_sasl_auth_clients = no | ||
| - | smtpd_sasl_authenticated_header = yes | ||
| - | # Setup TLS | ||
| - | smtpd_tls_cert_file = / | ||
| - | smtpd_tls_key_file = / | ||
| - | # abilita il debug... | ||
| - | smtpd_tls_loglevel = 0 | ||
| - | # metti a " | ||
| - | smtpd_tls_security_level = may | ||
| - | # Metti a yes per impedire AUTH non cifrata | ||
| - | smtpd_tls_auth_only = no | ||
| - | # Fai la cache delle sessioni | ||
| - | smtpd_tls_session_cache_database = btree:/ | ||
| - | |||
| - | # Some ANTISPAM | ||
| - | smtpd_delay_reject = yes | ||
| - | smtpd_helo_required = yes | ||
| - | smtpd_helo_restrictions = permit_mynetworks, | ||
| - | smtpd_sender_restrictions = permit_sasl_authenticated, | ||
| - | smtpd_recipient_restrictions = reject_unauth_pipelining, | ||
| - | smtpd_client_restrictions = permit_mynetworks, | ||
| - | #, reject_rbl_client zen.spamhaus.org, | ||
| - | |||
| - | policy-spf_time_limit = 3600s | ||
| - | |||
| - | smtpd_timeout = 60s | ||
| - | default_process_limit = 200 | ||
| - | |||
| - | smtputf8_enable = no | ||
| - | smtp_data_done_timeout = 1800 | ||
| - | |||
| - | smtpd_milters = unix:/ | ||
| - | non_smtpd_milters = unix:/ | ||
| - | |||
| - | syslog_facility = mail | ||
| - | syslog_name = postfix | ||
| - | |||
| - | body_checks = regexp:/ | ||
| - | |||
| - | maximal_queue_lifetime = 60m | ||
| - | bounce_queue_lifetime = 60m | ||
| - | smtp_connect_timeout | ||
| - | smtp_helo_timeout = 60s | ||
| - | |||
| - | smtpd_relay_before_recipient_restrictions = no | ||
| - | </ | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | ===== Installation: | ||
| - | |||
| - | This step is **mandatory** and critical for proper email delivery. | ||
| - | |||
| - | |||
| - | ===== Installation: | ||
| - | |||
| - | Install spamassassin & amavisd-new | ||
| - | |||
| - | |||
| - | FILE / | ||
| - | < | ||
| - | # Link the mailbox uid and gid to postfix. | ||
| - | virtual_uid_maps = static:5000 | ||
| - | virtual_gid_maps = static:5000 | ||
| - | |||
| - | # Set the base address for all virtual mailboxes | ||
| - | virtual_mailbox_base = /var/vmail | ||
| - | </ | ||