Note that this is mostly for personal use, so there’s no user/authentication control other than that of SSH. Also, most if not all commands here are run as root.

Prerequisites

I might get tired of saying this (it’s just copy paste, basically)… but similar as before (check my website and mail entries):

I might get tired of saying this (it’s just copy paste, basically)… but you will need the same prerequisites as before (check my website and mail entries), with the extras:

git server

Git

You’re basically done. Now you should be able to push/pull repositories to your server… except, you haven’t created any repository in your server, that’s right, they’re not created automatically when trying to push. To do so, you have to do the following sequence (assuming you’re “cd‘ed” into the /home/git directory):

Dovecot

Dovecot is an IMAP and POP3 server, which is what lets an email application retrieve the mail.

As Luke stated, dovecot comes with a lot of “modules” (under /etc/dovecot/conf.d/ if you copied that folder) for all sorts of configurations that you can include, but I do as he does and just edits/creates the whole dovecot.conf file; although, I would like to check each of the separate configuration files dovecot provides I think the options Luke provides are more than good enough.

I’m working with an empty dovecot.conf file. Add the following lines for SSL and login configuration (also replace {yourcertdir} with the same certificate directory described in the Postfix section above, note that the < is required):

As Luke stated, dovecot comes with a lot of “modules” (under /etc/dovecot/conf.d/ if you copied that folder) for all sorts of configurations that you can include, but I do as he does and just edit/create the whole dovecot.conf file; although, I would like to check each of the separate configuration files dovecot provides I think the options Luke provides are more than good enough.

Lastly (for dovecot at least), the plugin configuration for sieve (pigeonhole):

Lastly (for Dovecot at least), the plugin configuration for sieve (pigeonhole):

And more, make sure to include your server IP and something like subdomain.domainname.

Next, edit /etc/opendkim/opendkim.conf to reflect the changes (or rather, additions) of these files, as well as some other configuration. You can look up the example configuration file located at /usr/share/doc/opendkim/opendkim.conf.sample, but I’m creating a blank one with the contents:

Next, edit /etc/opendkim/opendkim.conf to reflect the changes (or rather, addition) of these files, as well as some other configuration. You can look up the example configuration file located at /usr/share/doc/opendkim/opendkim.conf.sample, but I’m creating a blank one with the contents:

I’m using root:opendkim so opendkim doesn’t complain about the {yoursubdomani}.private being insecure (you can change that by using the option RequireSafeKeys False in the opendkim.conf file, as stated here).

That’s it for the general configuration, but you could go more in depth and be more secure with some extra configuration as described in the Arch Wiki entry for OpenDKIM.

That’s it for the general configuration, but you could go more in depth and be more secure with some extra configuration.

Wrapping up

We should have a working mail server by now. Before continuing check your journal logs (journalctl -xe --unit={unit}, where {unit} could be spamassassin.servicefor example) to see if there was any error whatsoever and try to debug it, it should be a typo somewhere (the logs are generally really descriptive) because all the settings and steps detailed here just (literally just finished doing everything on a new server as of the writing of this text) worked (((it just werks on my machine))).

We should have a working mail server by now. Before continuing check your journal logs (journalctl -xe --unit={unit}, where {unit} could be spamassassin.service for example) to see if there was any error whatsoever and try to debug it, it should be a typo somewhere (the logs are generally really descriptive) because all the settings and steps detailed here just (literally just finished doing everything on a new server as of the writing of this text) worked (((it just werks on my machine))).

Now, to actually use the mail service: first of all, you need a normal account (don’t use root) that belongs to the mail group (gpasswd -a user group to add a user user to group group) and that has a password.

Next, to actually login into a mail app/program/whateveryouwanttocallit, you will use the following settings, at least for thunderdbird(I tested in windows default mail app and you don’t need a lot of settings):

All that’s left to do is test your mail server for spoofing, and to see if everything is setup correctly. Go to DKIM Test and follow the instructions (basically click next, and send an email with whatever content to the email that they provide). After you send the email, you should see something like:

(Yes, I blurred a lot in the picture just to be sure, either way what’s important is the list on the bottom part of the image)

Finally, that’s actually it for this entry, if you have any problem whatsoever you have my info down below.

Finally, that’s actually it for this entry, if you have any problem whatsoever you can contact me.

By David Luévano

Created: Sun, Mar 21, 2021 @ 04:05 UTC

Modified: Sun, Jun 06, 2021 @ 00:24 UTC

Modified: Tue, Jun 08, 2021 @ 06:27 UTC

Tags: english, server, tools, tutorial

diff --git a/blog/dst/a/website_with_nginx.html b/blog/dst/a/website_with_nginx.html index 7e5bd99..caf756f 100644 --- a/blog/dst/a/website_with_nginx.html +++ b/blog/dst/a/website_with_nginx.html @@ -95,14 +95,18 @@

Nginx

Nginx is a web (HTTP) server and reverse proxy server.

You have two options: nginx and nginx-mainline. I prefer nginx-mainline because it’s the “up to date” package even though nginx is labeled to be the “stable” version. Install the package and enable/start the service:

pacman -S nginx-mainline
 systemctl enable nginx.service
 systemctl start nginx.service

And that’s it, at this point you can already look at the default initial page of nginx if you enter the ip of your server in a web browser. You should see something like this:

Nginx welcome page

As stated in the welcome page, configuration is needed, head to the directory of nginx:

And that’s it, at this point you can already look at the default initial page of Nginx if you enter the IP of your server in a web browser. You should see something like this:

As stated in the welcome page, configuration is needed, head to the directory of Nginx:

cd /etc/nginx

Here you have several files, the important one is nginx.conf, which as its name implies, contains general configuration of the web server. If you peek into the file, you will see that it contains around 120 lines, most of which are commented out and contains the welcome page server block. While you can configure a website in this file, it’s common practice to do it on a separate file (so you can scale really easily if needed for mor websites or sub-domains).

@@ -125,7 +129,7 @@ http { types_hash_max_size 4096; } -

Next, inside the directory /etc/nginx/ create the sites-available and sites-enabled, and go into the sites-available one:

Next, inside the directory /etc/nginx/ create the sites-available and sites-enabled directories, and go into the sites-available one:

mkdir sites-available
 mkdir sites-enabled
 cd sites-available
@@ -144,28 +148,32 @@ cd sites-available
     }
 }

Note several things:

That could serve as a template if you intend to add more domains.

Note some things:

listen: we’re telling nginx which port to listen to (ipv4 and ipv6, respectively).
listen: we’re telling Nginx which port to listen to (IPv4 and IPv6, respectively).
root: the root directory of where the website files (.html, .css, .js, etc. files) are located. I followed Luke’s directory path /var/www/some_folder.
server_name: the actual domain to “listen” to (for my website it is: server_name luevano.xyz www.luevano.xyz; and for this blog is: server_name blog.luevano.xyz www.blog.luevano.xyz).
server_name: the actual domain to “listen” to (for my website it is: server_name luevano.xyz www.luevano.xyz; and for this blog is: server_name blog.luevano.xyz www.blog.luevano.xyz;).
index: what file to serve as the index (could be any .html, .htm, .php, etc. file) when just entering the website.
location: used in case of different configurations across different URL paths.
- try_files: tells what files to look for, don’t look into this too much for now.
- location: what goes after domain.name, used in case of different configurations depending on the URL paths (deny access on /private, make a proxy on /proxy, etc).
  - try_files: tells what files to look for.
-
Then, make a symbolic from this config file to the sites-enabled directory:
+
Then, make a symbolic link from this configuration file to the sites-enabled directory:
```
ln -s /etc/nginx/sites-available/your_config_file.conf /etc/nginx/sites-enabled
 
```
-
This is so the nginx.conf file can look up the newly created server config. With this method of having each server configuration file separate you can easily “deactivate” any website by just deleting the symbolic link in sites-enabled and you’re good, or just add new configuration files and keep everything nice and tidy.
-
All you have to do now is restart (or enable and start if you haven’t already) the nginx service (and optionally test the configuration):
+
This is so the nginx.conf file can look up the newly created server configuration. With this method of having each server configuration file separate you can easily “deactivate” any website by just deleting the symbolic link in sites-enabled and you’re good, or just add new configuration files and keep everything nice and tidy.
+
All you have to do now is restart (or enable and start if you haven’t already) the Nginx service (and optionally test the configuration):
```
nginx -t
 systemctl restart nginx
 
```
-
If everything goes correctly, you can now go to your website by typing “domain.name” on a web browser. But you will see a “404 Not Found” page like the following (maybe with different nginx version):
-
-
That’s no problem, because it means that the web server it’s actually working. Just add an index.html file with something simple to see it in action. If you keep seeing the 404 page make sure your root line is correct and that the directory/index file exists.
+
If everything goes correctly, you can now go to your website by typing domain.name on a web browser. But you will see a “404 Not Found” page like the following (maybe with different Nginx version):
+
+ +
Nginx 404 Not Found page
+
+
That’s no problem, because it means that the web server it’s actually working. Just add an index.html file with something simple to see it in action (in the /var/www/some_folder that you decided upon). If you keep seeing the 404 page make sure your root line is correct and that the directory/index file exists.

I like to remove the .html and trailing / on the URLs of my website, for that you need to add the following rewrite lines and modify the try_files line (for more: Sean C. Davis: Remove HTML Extension And Trailing Slash In Nginx Config):
```
server {
     ...
@@ -175,27 +183,26 @@ systemctl restart nginx
     try_files $uri/index.html $uri.html $uri/ $uri =404;
     ...
 
```
-
For more: Arch Linux Wiki: nginx.

Certbot
-
The only “bad” (bloated) thing about certbot, is that it uses python, but for me it doesn’t matter too much. You may want to look up another alternative if you prefer. Install the packages certbot and certbot-nginx:
+
Certbot is what provides the SSL certificates via Let’s Encrypt.
+
The only “bad” (bloated) thing about Certbot, is that it uses python, but for me it doesn’t matter too much. You may want to look up another alternative if you prefer. Install the packages certbot and certbot-nginx:
```
pacman -S certbot certbot-nginx
 
```
After that, all you have to do now is run certbot and follow the instructions given by the tool:
```
certbot --nginx
 
```
-
It will ask you for some information, for you to accept some agreements and the names to activate https for. Also, you will want to “say yes” to the redirection from http to https. And that’s it, you can now go to your website and see that you have https active.
+
It will ask you for some information, for you to accept some agreements and the names to activate HTTPS for. Also, you will want to “say yes” to the redirection from HTTP to HTTPS. And that’s it, you can now go to your website and see that you have HTTPS active.

Now, the certificate given by certbot expires every 3 months or something like that, so you want to renew this certificate every once in a while. Using cron, you can do this by running:
```
crontab -e
 
```
-
And a file will be opened where you need to add a new rule for certbot, just append the line: 1 1 1 * * certbot renew (renew on the first day of every month) and you’re good. Alternatively use systemd timers as stated in the Arch Linux Wiki.
-
For more: Arch Linux Wiki: Certbot.
+
And a file will be opened where you need to add a new rule for Certbot, just append the line: 1 1 1 * * certbot renew (renew on the first day of every month) and you’re good. Alternatively use systemd timers as stated in the Arch Linux Wiki.

That’s it, you now have a website with SSL certificate.

By David Luévano

Created: Fri, Mar 19, 2021 @ 02:58 UTC
-
Modified: Sun, Jun 06, 2021 @ 00:23 UTC
+
Modified: Tue, Jun 08, 2021 @ 06:11 UTC

Tags: english, server, tools, tutorial
-- cgit v1.2.3-54-g00ecf

Create a mail server with Postfix, Dovecot, SpamAssassin and OpenDKIM

Prerequisites

Postfix

Prerequisites

git server

Git

cgit

Cgit

Dovecot

OpenDKIM

SpamAssassin

Wrapping up

Nginx

Certbot