computing:mailserver-trixie
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:mailserver-trixie [2026/07/31 17:05] – oemb1905 | computing:mailserver-trixie [2026/08/31 00:07] (current) – oemb1905 | ||
|---|---|---|---|
| Line 70: | Line 70: | ||
| sudo apt update && sudo apt upgrade -y | sudo apt update && sudo apt upgrade -y | ||
| - | sudo apt install mailutils postfix ufw fail2ban | + | sudo apt install mailutils postfix ufw fail2ban apache2 php8.4-fpm php8.4-mysql php8.4-curl php8.4-gd php8.4-mbstring php8.4-xml php8.4-zip dovecot-core dovecot-imapd dovecot-lmtpd |
| It's also important that that the host knows how to identify itself properly. Let's open it up ''/ | It's also important that that the host knows how to identify itself properly. Let's open it up ''/ | ||
| Line 202: | Line 202: | ||
| inet_protocols = all | inet_protocols = all | ||
| message_size_limit = 52428800 | message_size_limit = 52428800 | ||
| + | cyrus_sasl_config_path = / | ||
| </ | </ | ||
| Line 303: | Line 304: | ||
| </ | </ | ||
| - | Lastly, before testing, make sure that you only authorize your mynetworks and properly authenticated users. Failing to do this will mean your server could potentially be used for public relay. This block rejects any unauthenticated senders (besides localhost) and requires senders to be authenticated (or to be localhost) while only permitting incoming email directed to '' | + | Lastly, before testing, make sure that you only authorize your mynetworks and properly authenticated users. Failing to do this will mean your server could potentially be used for public relay. This block rejects any unauthenticated senders (besides localhost) and requires senders to be authenticated (or to be localhost) while only permitting incoming email directed to '' |
| < | < | ||
| Line 343: | Line 344: | ||
| < | < | ||
| - | #spf incoming policy and recipient restrictions\ | + | #spf incoming policy and recipient restrictions |
| - | policyd-spf_time_limit = 3600\ | + | policyd-spf_time_limit = 3600 |
| smtpd_recipient_restrictions = | smtpd_recipient_restrictions = | ||
| permit_mynetworks, | permit_mynetworks, | ||
| Line 415: | Line 416: | ||
| < | < | ||
| - | '*@yourdomain.com default._domainkey.yourdomain.com' | + | *@yourdomain.com default._domainkey.yourdomain.com |
| - | '*@*.yourdomain.com default._domainkey.yourdomain.com' | + | *@*.yourdomain.com default._domainkey.yourdomain.com |
| </ | </ | ||
| Line 468: | Line 469: | ||
| </ | </ | ||
| - | The most important line is the uppermost line, which specifies that email should not be rejected as a result of leveraging the policy. Again, this ensures that spam assassin has what it needs to help users sort and organize email, without the possibility of phantom rejections, prohibiting email from having ever arrived in your inbox. After your DKIM keypair and DKIM policy are setup, you can setup a DMARC policy as well. Install the policy with sudo apt install opendmarc. After it installs, open up ''/ | + | The most important line is the uppermost line, which specifies that email should not be rejected as a result of leveraging the policy. Again, this ensures that spam assassin has what it needs to help users sort and organize email, without the possibility of phantom rejections, prohibiting email from having ever arrived in your inbox. After your DKIM keypair and DKIM policy are setup, you can setup a DMARC policy as well. Install the policy with '' |
| < | < | ||
| Line 546: | Line 547: | ||
| Sieve is already enabled in dovecot and postfix. That was done up above. Now, the tutorial is discussing how to leverage the sieve syntax or language to get desired user results for incoming email. The most basic way to do this is by setting up a global, or server-wide rule, that filters emails before dovecot, via lmtp, delivers the emails to their final destination. This is done by spam assassin adding custom fields and scoring to incoming email headers. The sieve plugin assesses these headers and then makes the correct determination for the final destination, | Sieve is already enabled in dovecot and postfix. That was done up above. Now, the tutorial is discussing how to leverage the sieve syntax or language to get desired user results for incoming email. The most basic way to do this is by setting up a global, or server-wide rule, that filters emails before dovecot, via lmtp, delivers the emails to their final destination. This is done by spam assassin adding custom fields and scoring to incoming email headers. The sieve plugin assesses these headers and then makes the correct determination for the final destination, | ||
| - | | + | < |
| + | #sieve_before = / | ||
| + | |||
| + | #modern trixie way | ||
| + | sieve_script SpamToJunk { | ||
| + | type = before | ||
| + | path = / | ||
| + | } | ||
| + | </ | ||
| - | Now, create the file that you just referenced above in ''/ | + | Now, create the file that you just referenced above in ''/ |
| < | < | ||
| Line 625: | Line 634: | ||
| ServerName mail.domain.com | ServerName mail.domain.com | ||
| ServerAdmin email@email.com | ServerAdmin email@email.com | ||
| - | DocumentRoot / | + | DocumentRoot / |
| ErrorLog ${APACHE_LOG_DIR}/ | ErrorLog ${APACHE_LOG_DIR}/ | ||
| CustomLog ${APACHE_LOG_DIR}/ | CustomLog ${APACHE_LOG_DIR}/ | ||
| Line 654: | Line 663: | ||
| ServerName mail.domain.com | ServerName mail.domain.com | ||
| ServerAdmin email@email.com | ServerAdmin email@email.com | ||
| - | DocumentRoot / | + | DocumentRoot / |
| ErrorLog ${APACHE_LOG_DIR}/ | ErrorLog ${APACHE_LOG_DIR}/ | ||
| CustomLog ${APACHE_LOG_DIR}/ | CustomLog ${APACHE_LOG_DIR}/ | ||
| Line 702: | Line 711: | ||
| ' | ' | ||
| ' | ' | ||
| - | ' | + | |
| ' | ' | ||
| ' | ' | ||
| Line 795: | Line 804: | ||
| ====== Part V - Setting up pflogsumm ====== | ====== Part V - Setting up pflogsumm ====== | ||
| - | It's important to be able to monitor how your setup is performing and what is or is not working correctly. No better way to do that than to get some analytics emailed to you each day. To do that, let's install pflogsumm and use rsyslog for logging. Install the packages sudo apt install pflogsumm rsyslog and then create the log rotation rule over in ''/ | + | It's important to be able to monitor how your setup is performing and what is or is not working correctly. No better way to do that than to get some analytics emailed to you each day. To do that, let's install pflogsumm and use rsyslog for logging. Install the packages |
| < | < | ||
| Line 1054: | Line 1063: | ||
| Once you edited the file, load the changes with sudo postmap / | Once you edited the file, load the changes with sudo postmap / | ||
| - | Another thing I researched when reviewing Linux Babe's tutorial, but ultimately rejected doing was body and header inspection. To do that, install postfix' | + | Another thing I researched when reviewing Linux Babe's tutorial, but ultimately rejected doing was body and header inspection. To do that, install postfix' |
| header_checks = pcre:/ | header_checks = pcre:/ | ||
| Line 1134: | Line 1143: | ||
| I rewrote the mail server tutorial for the presentation [[https:// | I rewrote the mail server tutorial for the presentation [[https:// | ||
| - | --- // | + | --- // |
computing/mailserver-trixie.1785517522.txt.gz · Last modified: by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
