This is an old revision of the document!
KPTree - Email Server Setup
Email Server Notes
Setting up the email server on my home server was probably the most difficult task. Email server setup is intricate, risky and involves significant commitment and effort to setup reliably and maintain.
My current email server is based upon workaround.org ISPmail tutorials for a Debian based server. I first got this up and running in later 2020 on Debian 10 (Buster). The most current is ISPmail guide for Debian 11 “Bullseye” that was release late 2021 a couple of months after the Bullseye release.
VM Setup
I setup my email server on a separate virtual machine (VM) on my home server that also acts as a NAS. The main mail files are stored on a drive outside the VM. As the home server has only one external static IPv4 address the mail server subdomain needs to be shared on the common IP address. ===Set network IP address, static IP=== ++I actually like to use netplan
* ''sudo apt install netplan.io''
* ''sudo mv /etc/network/interfaces /etc/network/interfaces.old''
* ''sudo /etc/netplan/network.yaml''
* <code>network:
version: 2
renderer: networkd
ethernets:
enp1s0:
addresses: [192.168.1.16/24]
gateway4: 192.168.1.1
nameservers:
addresses: [192.168.1.1, 1.1.1.1]</code>
* The base client configurations options are given in: ''sudo vim /etc/default/nfs-common''. However the current base options meet our needs and do not need to be modified.
* NEED_STATD=no :(default) we do not need to change the standard port number used
* NEED_GSSD=no :(default) we do not use kerebos security
* NEED_IDMAPD=no:(default) we do not need to map gid and uid with names
* To apply configuration changes ''sudo systemctl restart nfs-client.target''
* Mounting the nfs client manually:
* ''sudo mount -t nfs -o rw,vers=4 192.168.1.10:/export/storage /mnt/storage'' to mount just the specific directory. The mount directory must already exist.
* ''sudo mount -t nfs -o rw,vers=4 192.168.1.10:/export /mnt'' to mount all the defined exports. The mount directory must already exist, not necessarily the sub-directories.
* ''sudo unmount /mnt/storage'' to unmount
* Check status of clients:
* ''findmnt'' to list file system in tree format or ''findmnt -l'' in flat list.
* ''df -h'' to list all mounted drives
* ''lsblk'' to list all drive
* To allow automatic boot of nfs clients: sudo vim /etc/fstab
* ''192.168.1.10:/export /mnt nfs4 bg 0 0'' this will mount all the drive defined on the server as sub-directories under
* ''192.168.1.10:/export/shared /mnt/shared nfs4 bg 0 0'' to mount a single sub-directory
=====Old Email Setup Notes===== This my old email server setup notes. This is for older Ubuntu servers and many of these links are no longer working or have not been updated for latest Ubuntu releases.\\ <fc #ff0000>**These setup notes are not compatible with my current email setup.**</fc>\\ ++++ My Email Server History, really tl;dr: =====Email Server Setup===== My current email server is based upon Debian 10 (Buster) with setup following, [[https://workaround.org/ispmail/buster/ Old Email Server Setup, Historical tl;dr:
*Setup an Ubuntu 18.04 VM with 4 CPUs and 4G of RAM, no/disabled SWAP drive (Expect 2 CPUs and 2 GB RAM sufficient based upon text) *My home router needed to have the port forwarding setup to redirect inbound Internet TCP traffic to the local VM IP address for the nominated ports. *I never open VM SSH access ports to the Internet..... *The Internet ports are only redirected later in the build, when necessary for testing / implementation *For "Now Build a LAMP Web Server" I manually install the various LAMP install components, as I prefer to use Mariadb instead of MySQL *For "Configure MySQL" with Mariadb refer to [[https://mariadb.com/kb/en/mariadb/sql_mode/|SQL_MODE]]:
sudo mysql -u root -p SET GLOBAL sql_mode = 'ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION'; SET SESSION sql_mode = 'ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION'; SELECT @@SQL_MODE, @@GLOBAL.SQL_MODE;
*For “Install Postfix Admin 3.2 and the MySQL Schema” the latest version of is postfixadmin-3.2, as of 2019-12-01, so no change…
*Problems with running https://mail.example.com/postfixadmin/setup.php failed with debug error relating to index to long. Basically indexes are restricted to 1000byte length. So the index with char(255) is ok with char length byte, however modern databases seem to default to utf8mb4 (4 bytes length) or UTF (3 bytes length) to allow for international character sets. Refer to the following links:
*Sourceforge Postfix Admin [[https://sourceforge.net/p/postfixadmin/bugs/379/|#379 Setup fails on MySQL with non-Latin1 as default charset]].
*[[http://zee.balogh.sk/?p=928|Converting Character sets in MySQL to UTF8]]
*Code to convert default character to allow setup to work:
*Login to MySQL: ''sudo mysql -u root -p''
*Use the mail database ''use mail;'' (''show database;'' to confirm available databases)
*Confirm current character sets in use for this database: "SHOW VARIABLES LIKE 'char%';"
*To convert the default database character set: ''ALTER DATABASE mail COLLATE=latin1_swedish_ci;''
*For the Configure Dovecot Section
*The Dovecot configuration file /etc/dovecot/dovecot-sql.conf.ext
*My vmail user uid has historically been 6004. The mail uid and gid are both 8 on default Ubuntu (Linux?) distributions.
*I propose to install the working mail directory on an NFS drive to help limit the VM drive size, /mnt/shared/vmail.
*Follow change directions for the Dovecot configuration file /etc/dovecot/conf.d/10-auth.conf
*The Dovecot configuration file /etc/dovecot/10-mail.conf
*I propose to install the working mail directory on an NFS drive to help limit the VM drive size, /mnt/shared/vmail.
*My vmail user uid has historically been 6004. The mail uid and gid are both 8 on default Ubuntu (Linux?) distributions.
*Note that /etc/amavis/conf.d/15-content_filter_mode directives were back-slashed as follows:
*@bypass_virus_checks_maps = (
*\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
*@bypass_spam_checks_maps = (
*\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
*Configuration file /etc/default/spamassassin not changed as directed, as on systemd use sudo systemctl enable spamassassin.service instead. CRON=0 changed to CRON=1.
*Attempting to run "sudo freshclam" came up with error. I had to disable the clamav daemons to allow the update to work.
*To find clamav related running daemons ''sudo systemctl list-units -all | grep clam''
*Stop the daemons ''sudo systemctl stop clamav-daemon'' and any other found daemons
*''sudo freshclam'' does not functions without error
*Restart clamav ''sudo systemctl start clamav-daemon'', however a ''sudo reboot'' may be in order....
*For the Configure Postfix Section no major changes (other than ensuring consistency with configuration site specifics, as above)
*Restart Everything, and Test the Server - check /var/log/mail.log & /var/log/mail.err
*Log showed error [postfix/smtpd[15073]: warning: SASL: Connect to private/auth failed: No such file or directory] and [postfix/smtpd[15073]: fatal: no SASL authentication mechanisms]. Upon restarting dovecot and then postfix, this error went away. (Restarting Dovecot initialises the file /var/spool/postfix/private/auth as per configuration /etc/dovecot/conf.d/10-master.conf after which this Postfix error is resolved.)
*Added compatibility_level = 2 to /etc/postfix/main.cf concerning log message "Postfix is running with backwards-compatible default settings"
Alias /.well-known /var/www/mail.kptree.net
Some other related handy commands ++++Some other online references
* [[https://httpd.apache.org/docs/2.4/mod/mod_alias.html#alias|Apache Module mod_alias]] * [[https://httpd.apache.org/docs/2.4/mod/core.html#location|<Location> Directive]] * [[https://httpd.apache.org/docs/2.4/mod/core.html#directory|<Directory> Directive]]
IMAP Client Settings
Email address: admin@example.com
Server Type: IMAP
Server: mail.example.com
Port: 143
Username: admin@example.com
Encryption method: STARTTLS (not SSL/TLS)
Tick, Server requires authorisation
Authentication: Password
POP3 Client Settings - not used any more
SMTP Client Settings
Server: mail.example.com
Port: 567
TICK, Server requires authentication
Encryption Method: TLS (start after connecting) (or STARTTLS)
Username: admin@example.com
Auth Type: Login
Gmail
IMAP Client Settings
server address: imap.gmail.com
user name: Your full Gmail address (e.g. me@gmail.com)
password: Your Gmail password
With Gmail 2-step authentication enabled, use an application-specific Gmail password.
IMAP port : 993
IMAP TLS/SSL required: yes
POP3 Client Settings
server address: pop.gmail.com
user name: Your full Gmail address (e.g. me@gmail.com)
password: Your Gmail password
With Gmail 2-step authentication enabled, use an application-specific Gmail password.
IMAP port : 995
IMAP TLS/SSL required: yes
SMTP Client Settings
server address: smtp.gmail.com
user name: Your full Gmail address (e.g. me@gmail.com)
password: Your Gmail password
With Gmail 2-step authentication enabled, use an application-specific Gmail password.
SMTP port (TLS): 587
SMTP TLS/SSL required: yes
MSOutlook / Hotmail
IMAP Client Settings
server address: imap-mail.outlook.com
user name: Your full email address (e.g. me@hotmail.com)
password: Your hotmail password
IMAP port : 993
IMAP TLS/SSL required: yes
POP3 Client Settings
server address: pop-mail.outlook.com
user name: Your full email address (e.g. me@hotmail.com)
password: Your hotmail password
IMAP port : 995
IMAP TLS/SSL required: yes
SMTP Client Settings
server address: smtp-mail.outlook.com
user name: Your full email address (e.g. me@hotmail.com)
password: Your hotmail password
SMTP port (TLS): 587
SMTP port (SSL): 465
SMTP TLS/SSL required: yes (STARTTLS)
=====Webmail Installation===== ====Install Roundcube for Webmail==== My current email server is based upon Debian 10 (Buster) with setup following, [[https://workaround.org/ispmail/buster/ Old Webmail Setup, Historical tl;dr:
*The IMAP host chosen to perform login is ''ssl:%%//%%sub1.example.com'' and port 993 (standard IMAP secure port) *Similarly, The SMTP server host is ssl:sub1.example.com and port 25 (not 465). There is no SMTP username and password, just select the "Use the current IMAP username and password for SMTP authentication. *Personally I do not understand why you would want to use a webmail client to Gmail, Outlook, etc., as these all have there own webmail clients. *Instead of deleting the installer directory, disable access in apache2:
create new file: /etc/apache2/sites-available/roundcube.conf and add following:
<Directory /var/www/html/webmail>
Options +FollowSymLinks
AllowOverride All
AllowOverrideList None
<RequireAll>
Require all granted
</RequireAll>
</Directory>
<Directory /var/www/html/webmail/installer>
Options +FollowSymLinks
AllowOverride None
AllowOverrideList None
<RequireAll>
Require all denied
</RequireAll>
</Directory>
To enable site configuration: sudo a2ensite roundcube.conf
*Note to function correctly the “/var/www/html/webmail/.htaccess” file should have the <IfModule mod_php5.c> changed to <IfModule mod_php7.c>
Some additional followups:
*GitHub Roundcube Plugin Resources
*Roundcube Plugins The Official Plugin Repository
In order to direct default traffic to the webmail page I added directive Redirectmatch ^/$ https://mail.kptree.net/webmail to the Apaches site configuration file /etc/apache2/sites-available/sub1.example.com-ssl.conf.
====Install Horde 5 for Webmail====
I never had much success with Horde, not sure how good it is and if it is worth the effort. Further to this I use Nextcloud, which probably provides a lot of the similar functionallity I need.
++++ Install Horde 5 for Webmail tl;dr;
<code> "sudo apt update" "sudo apt install php7.0-dev php-pear php7.0-tidy php-imagick" (no php5-sasl, php-auth-sasl?) "sudo apt install php-geoip geoip-bin" (packages geoip-database and libgeoip1 included in php-geoip install) "sudo apt install php-xml-serializer php-memcache php7.0-soap php7.0-intl" "sudo apt install libidn11-dev libmagickwand-dev imagemagick" (libmagick++4?) "sudo apt install libsasl2-dev php-ssh2 php-http-webdav-server" (no libssh2-php, php-ssh2?, no libphp-jpgraph)</code>
2. Next update the PECL and Pear package managers and install the remaining required packages:
sudo pecl channel-update pear.php.net
sudo pear channel-update pear.php.net
sudo pecl install lzf - with messages:
configuration option "php_ini" is not set to php.ini location
You should add "extension=lzf.so" to php.ini
Check the Pear website for latest package versions and versions that suit you at pear Packages
sudo pear install --alldeps channel://pear.php.net/Date_Holidays-0.21.8
sudo pear install --alldeps channel://pear.php.net/Date_Holidays_UNO-0.1.3
sudo pear install --alldeps channel://pear.php.net/Date_Holidays_Australia-0.2.2
sudo pear install --alldeps channel://pear.php.net/Numbers_Words-0.18.1
sudo pear install --alldeps channel://pear.php.net/Text_CAPTCHA-1.0.2
sudo pear install --alldeps channel://pear.php.net/Console_GetoptPlus
sudo pear install --alldeps channel://pear.php.net/HTTP_Request2
sudo pear install --nodeps channel://pear.php.net/MDB2_Driver_mysql
3. Next up is installing the Horde components. Start with these commands:
sudo pear channel-discover pear.horde.org
sudo pear install horde/Horde_role
sudo pear run-scripts horde/Horde_role
4. At this point, you will be prompted to enter the “Filesystem location for the base Horde application” - so enter the full path to your web root without a trailing slash, i.e. /var/www/html/horde.
5. Next start the installation process with the command below. This will take a while to run to completion:
6. sudo pear install -a -B –force horde/webmail
The –force is required to allow the use of php7, otherwise this will error out the install.
Use “pear config-show -c horde” to show where the key Horde php related files are on the system.
++
=====The following is a list of related commonly used SQL commands:=====
*To confirm the status (start, stop and restart) mysql sudo systemctl status apache2
*To login into mysql as root, with password prompt: sudo mysql -u root -p
*Database commands:
*To show databases: show databases;
*To create database (where new database name is: dBase_NAME): create dBase_NAME
*To list mySQL database sizes: SELECT table_schema “DB Name”, Round(Sum(data_length + index_length) / 1024 / 1024, 1) “DB Size in MB” FROM information_schema.tables GROUP BY table_schema;
*To use a database: use databasename;
*To show tables in a database: show tables;
=====The following is a list of related commonly used commands and scripts:=====
*Get external IP address wget http://ipinfo.io/ip -qO -
*To check the current network hardware configuration ip a
*To start (/stop /enable) the deluge daemon sudo systemctl start deluge
*To start (/stop /enable) the deluge web interface daemon sudo systemctl start deluge-web
*Systemd common commands (start / stop / restart / status) (enable / disable for boot control)