From 2ecbe79eeb342692b13cb4ce9ca8ed4cdb86fcdf Mon Sep 17 00:00:00 2001
From: David Luevano Alvarado <david@luevano.xyz>
Date: Fri, 19 Mar 2021 22:44:52 -0700
Subject: Almost finish up the mail entry

---
 blog/src/a/mail_server_with_postfix.md | 259 ++++++++++++++++++++++++++++++++-
 1 file changed, 255 insertions(+), 4 deletions(-)

(limited to 'blog/src/a/mail_server_with_postfix.md')

diff --git a/blog/src/a/mail_server_with_postfix.md b/blog/src/a/mail_server_with_postfix.md
index beff83f..a0cf526 100644
--- a/blog/src/a/mail_server_with_postfix.md
+++ b/blog/src/a/mail_server_with_postfix.md
@@ -4,19 +4,24 @@ The entry is going to be long because it's a *tedious* process. This is also bas
 
 This configuration works for local users (users that appear in `/etc/passwd`), and does not use any type of SQL. And note that most if not all commands executed here are run with root privileges.
 
+More in depth configuration is detailed in the Arch Wiki for each package used here.
+
 ## Prerequisites
 
 Basically the same as with the [website with Nginx and Certbot](https://blog.luevano.xyz/a/website_with_nginx.html):
 
 * A domain name. Got mine on [Epik](https://www.epik.com/?affid=da5ne9ru4) (affiliate link, btw).
 	* Later we'll be adding some **MX**  and **TXT** records.
-	* I also recommend to add a **CNAME** ("mail" and "www.mail") for SSL certificates.
+	* I also recommend to add a **CNAME** for "mail" and "www.mail", to get SSL certificates.
 * A VPS or somewhere else to host. I'm using [Vultr](https://www.vultr.com/?ref=8732849) (also an affiliate link).
 	* Also `ssh` configured.
 	* Ports 25, 587 (SMTP), 465 (SMTPS), 143 (IMAP) and 993 (IMAPS) open on the firewall (I use `ufw`).
+	* With `nginx` and `certbot` setup and running.
 
 ## Postfix
 
+[Postfix](https://wiki.archlinux.org/index.php/Postfix) is a "mail transfer agent" which is the component of the mail server that receives and sends emails via SMTP.
+
 Install the `postfix` package:
 
 ```sh
@@ -125,11 +130,257 @@ smtps 465/tcp
 smtps 465/udp
 ```
 
-At this point you're done configuring `postfix` and you can already start/enable the service:
+At this point you're done configuring `postfix` and you can already start/enable the `postfix` service:
 
 ```sh
-systemctl start postfix
-systemctl enable postfix
+systemctl start postfix.service
+systemctl enable postfix.service
 ```
 
 ## Dovecot
+
+[Dovecot](https://wiki.archlinux.org/index.php/Dovecot) is an IMAP and POP3 server, which is what lets an email application retrieve the mail.
+
+Install the `dovecot` and `pigeonhole` (sieve for `dovecot`) packages:
+
+```sh
+pacman -S dovecot pigeonhole
+```
+
+On arch, by default, there is no `/etc/dovecot` directory with default configurations set in place, but the package does provide the example configuration files. Create the `dovecot` directory under `/etc` and, optionally, copy the `dovecot.conf` file and `conf.d` directory under the just created `dovecot` directory:
+
+```sh
+mkdir /etc/dovecot
+cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot/dovecot.conf
+cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot
+```
+
+As Luke stated, `dovecot` comes with a lot of "modules" (under `/etc/dovecot/conf.d/` if you copied that folder) for all sorts of configurations that you can include, but I do as he does and just edits/creates the whole `dovecot.conf` file; although, I would like to check each of the separate configuration files `dovecot` provides I think the options Luke provides are more than good enough.
+
+I'm working with an empty `dovecot.conf` file. Add the following lines for SSL and login configuration (also replace `{yourcertdir}` with the same certificate directory described in the Postfix section above, note that the `<` is required):
+
+```conf
+ssl = required
+ssl_cert = <{yourcertdir}/fullchain.pem
+ssl_key = <{yourcertdir}/privkey.pem
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SHA1:!SHA256:!SHA384:!LOW@STRENGTH
+ssl_prefer_server_ciphers = yes
+ssl_dh = </etc/dovecot/dh.pem
+
+auth_mechanisms = plain login
+auth_username_format = %n
+protocols = $protocols imap
+```
+
+You may notice we specify a file we don't have under `/etc/dovecot`: `dh.pem`. We need to create it with `openssl` (you should already have it installed if you've been following this entry and the one for `nginx`). Just run (might take a few minutes):
+
+```sh
+openssl dhparam -out /etc/dovecot/dh.pem 4096
+```
+
+After that, the next lines define what a "valid user is" (really just sets the database for users and passwords to be the local users with their password):
+
+```conf
+userdb {
+	driver = passwd
+}
+
+passdb {
+	driver = pam
+}
+```
+
+Next, comes the mail directory structure (has to match the one described in the Postfix section). Here, the `LAYOUT` option is important so the boxes are `.Sent` instead of `Sent`. Add the next lines (plus any you like):
+
+```conf
+mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
+namespace inbox {
+	inbox = yes
+
+	mailbox Drafts {
+		special_use = \Drafts
+		auto = subscribe
+		}
+
+	mailbox Junk {
+		special_use = \Junk
+		auto = subscribe
+		autoexpunge = 30d
+		}
+
+	mailbox Sent {
+		special_use = \Sent
+		auto = subscribe
+		}
+
+	mailbox Trash {
+		special_use = \Trash
+		}
+
+	mailbox Archive {
+		special_use = \Archive
+		}
+}
+```
+
+Also include this so Postfix can use Dovecot's authentication system:
+
+```conf
+service auth {
+	unix_listener /var/spool/postfix/private/auth {
+		mode = 0660
+		user = postfix
+		group = postfix
+		}
+}
+```
+
+Lastly (for `dovecot` at least), the plugin configuration for `sieve` (`pigeonhole`):
+
+```conf
+protocol lda {
+	mail_plugins = $mail_plugins sieve
+}
+
+protocol lmtp {
+	mail_plugins = $mail_plugins sieve
+}
+
+plugin {
+	sieve = ~/.dovecot.sieve
+	sieve_default = /var/lib/dovecot/sieve/default.sieve
+	sieve_dir = ~/.sieve
+	sieve_global_dir = /var/lib/dovecot/sieve/
+```
+
+Where `/var/lib/dovecot/sieve/default.sieve` doesn't exist yet. Create the folders:
+
+```sh
+mkdir -p /var/lib/dovecot/sieve
+```
+
+And create the file `default.sieve` inside that just created folder with the content:
+
+```conf
+require ["fileinto", "mailbox"];
+if header :contains "X-Spam-Flag" "YES" {
+	fileinto "Junk";
+}
+```
+
+Now, if you don't have a `vmail` (virtual mail) user, create one and change the ownership of the `/var/lib/dovecot` directory to this user:
+
+```sh
+grep -q "^vmail:" /etc/passwd || useradd vmail -s /usr/bin/nologin
+chown -R vmail:vmail /var/lib/dovecot
+```
+
+Note that I also changed the shell for `vmail` to be `/usr/bin/nologin`. After that, run:
+
+```sh
+sievec /var/lib/dovecot/sieve/default.sieve
+```
+
+To compile the configuration file (a `default.svbin` file will be created next to `default.sieve`).
+
+Next, add the following lines to `/etc/pam.d/dovecot` if not already present (shouldn't be there if you've been following these notes):
+
+```conf
+auth required pam_unix.so nullok
+account required pam_unix.so
+```
+
+That's it for `dovecot`, at this point you can start/enable the `dovecot` service:
+
+```sh
+systemctl start dovecot.service
+systemctl enable dovecot.service
+```
+
+# OpenDKIM
+
+[OpenDKIM](https://wiki.archlinux.org/index.php/OpenDKIM) is needed so services like G\*\*gle (we don't mention that name here \[\[\[this is a meme\]\]\]) don't throw the mail to the trash. DKIM stands for "DomainKeys Identified Mail".
+
+Install the `opendkim` package:
+
+```sh
+pacman -S opendkim
+```
+
+Generate the keys for your domain:
+
+```sh
+opendkim-genkey -D /etc/opendkim -d {yourdomain} -s {yoursubdomain} -r -b 2048
+```
+
+Where you need to change `{yourdomain}` and `{yoursubdomain}` (doesn't really need to be the subdomain, could be anything that describes your key) accordingly, for me it's `luevano.xyz` and `mail`, respectively. After that, we need to create some files inside the `/etc/opendkim` directory. First, create the file `KeyTable` with the content:
+
+```conf
+{yoursubdomain}._domainkey.{yourdomain} {yourdomain}:{yoursubdomain}:/etc/opendkim/{yoursubdomain}.private
+```
+
+So, for me it would be:
+
+```conf
+mail._domainkey.luevano.xyz luevano.xyz:mail:/etc/opendkim/mail.private
+```
+
+Next, create the file `SigningTable` with the content:
+
+```conf
+*@{yourdomain} {yoursubdomain}._domainkey.{yourdomain}
+```
+
+Again, for me it would be:
+
+```conf
+*@luevano.xyz mail._domainkey.luevano.xyz
+```
+
+And, lastly create the file `TrustedHosts` with the content:
+
+```conf
+127.0.0.1
+::1
+10.1.0.0/16
+1.2.3.4/24
+localhost
+{yourserverip}
+...
+```
+
+And more, make sure to include your server IP and something like `subdomain.domainname`.
+
+Finally, edit `/etc/opendkim/opendkim.conf` to reflect the changes (or rather, additions) of these files, as well as some other configuration. You can look up the example configuration file located at `/usr/share/doc/opendkim/opendkim.conf.sample`, but I'm creating a blank one with the contents:
+
+```conf
+Domain {yourdomain}
+Selector {yoursubdomain}
+
+Syslog Yes
+UserID opendkim
+
+KeyFile /etc/opendkim/{yoursubdomain}.private
+Socket inet:8891@localhost
+```
+
+Now, change the permissions for all the files inside `/etc/opendkim`:
+
+```conf
+chown -R root:opendkim /etc/opendkim
+chmod g+r /etc/postfix/dkim/*
+```
+
+I'm using `root:opendkim` so `opendkim` doesn't complain about the `{yoursubdomani}.private` being insecure (you can change that by using the option `RequireSafeKeys False` in the `opendkim.conf` file, as stated [here](http://lists.opendkim.org/archive/opendkim/users/2014/12/3331.html)).
+
+That's it for the general configuration, but you could go more in depth and be more secure with some extra configuration as described in the [Arch Wiki entry for OpenDKIM](https://wiki.archlinux.org/index.php/OpenDKIM#Security).
+
+Now, just start/enable the `opendkim` service:
+
+```sh
+systemctl start opendkim.service
+systemctl enable opendkim.service
+```
+
+# Spamassassin
-- 
cgit v1.2.3-54-g00ecf