email on vasilian.net

Start reading this document about why you may not want to run an email server.

I decided to use (1) MTA=Postfix (2) MDA=Dovecot and (3) IMAP server.

I have not yet decided on Spam Filter, AntiVirus and Webmail.

Here is an overview about existing MTA programs.

Add required DNS entries for the email programs.

Here is a guide on why and how to add the SPF record.

Here is a wiki page on the MX record (it will always map to an A, AAA record).

Here is an article about email routing. Observe the last command:

dig vasilian.net mx

We head now further into installing the Let's Encrypt Certbot and creating a SSL certificate for the domain and subdomains.

certbot --apache

This will detect only the www and domain name, but will not show the mail. subdomain

You have to re-run with expand option to include also the mail.vasilian.net

certbot --expand -d www.vasilian.net,vasilian.net,mail.vasilian.net

Here is a page for crontab commands to list all jobs for current user or for all users.

To easily create a crontab job use this generator.

crontab -l
* * * * 1 certbot renew >/dev/null 2>&1

To check if SSL certificate is installed correctly use the SSL Server Test page.

Now it's time to install postfix and dovecot. The setup will use Maildir format (instead of mbox) and the SSL certificate that was previously generated.

My 1st installation guide explains authentication via STARTTLS on smtp port 25.

A 2nd installation guide for CentOS7 has useful parameters for Dovecot.

A 3rd installation guide exists at DigitalOcean for Debian.

Also here a 3rd guide I used for better overview on the parameters. This is for Ubuntu.

Here are my final changes for the setup.

/etc/postfix/main.cf

mail_owner = postfix
myhostname = mail.vasilian.net
mydomain = vasilian.net
myorigin = $mydomain
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
virtual_alias_maps = hash:/etc/postfix/virtual
mynetworks = 127.0.0.0/8
relayhost =
home_mailbox = Maildir/
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/vasilian.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/vasilian.net/privkey.pem
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
smtpd_sender_login_maps = $virtual_alias_maps
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

/etc/postfix/master.cf

# ==========================================================================                                                  
# service type  private unpriv  chroot  wakeup  maxproc command + args                                                        
#               (yes)   (yes)   (yes)   (never) (100)                                                                         
# ==========================================================================                                                  
smtp       inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtp
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_sender_login_maps=$virtual_alias_maps
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  
submission inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sender_login_maps=$virtual_alias_maps
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,permit_sasl_authenticated,reject

Edit /etc/postfix/virtual
here replace AT with @

mihaiATvasilian.net    mihai
rootATvasilian.net     mihai

Here is a guide on postfix parameters. Of interest here was virtual(5) and $inet_interfaces.

However, after /etc/postfix/virtual file is edited the database must be re-generated with:

postmap /etc/postfix/virtual

Edit /etc/dovecot/dovecot.conf

protocols = imap imaps

Edit /etc/dovecot/conf.d/10-auth.conf.orig

disable_plaintext_auth = yes
auth_mechanisms = plain login

Edit /etc/dovecot/conf.d/10-mail.conf.orig

mail_location = maildir:~/Maildir

Edit /etc/dovecot/conf.d/10-master.conf.orig

unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
}

Edit /etc/dovecot/conf.d/10-ssl.conf.orig

ssl = yes
ssl_cert = </etc/letsencrypt/live/vasilian.net/fullchain.pem
ssl_key  = </etc/letsencrypt/live/vasilian.net/privkey.pem
ssl_protocols = !SSLv2 !SSLv3

Edit /etc/dovecot/conf.d/20-pop3.conf.orig

pop3_uidl_format = %08Xu%08Xv

Here is a guide on how to set the reverse dns for DigitalOcean droplet.

Rename the droplet from CentOS7-512MB-FRA1-01 to vasilian.net

and DigitalOcean will automatically assign a PTR record for the domain.

Check if the IP has a reverse dns with:

host 138.68.68.112
112.68.68.138.in-addr.arpa domain name pointer vasilian.net.

Let's check the mail server functionality
What ports are open?

nmap vasilian.net

PORT    STATE  SERVICE
25/tcp  open   smtp
143/tcp open   imap
587/tcp open   submission
993/tcp open   imaps

Is AUTH PLAIN LOGIN available unencrypted?

telnet vasilian.net smtp
ehlo vasilian.net

250-mail.vasilian.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Does MAIL FROM: work unencrypted?

telnet vasilian.net smtp
MAIL FROM: user@vasilian.net
530 5.7.0 Must issue a STARTTLS command first

Does encrypted authentication work?

# use real login data 
echo -ne '\0user\0password' | base64
AHVzZXIAcGFzc3dvcmQ=

openssl s_client -connect vasilian.net:25 -starttls smtp
ehlo vasilian.net

250-mail.vasilian.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

AUTH PLAIN
334 
AHVzZXIAcGFzc3dvcmQ=
235 2.7.0 Authentication successful

quit
221 2.0.0 Bye
closed