---------

Postfix mail server on CentOS 7 with virtual domains, management system, web access and many others

https://www.dmosk.ru/instruktions.php?object=postfix-centos

Terms on the topic: Postfix , POP3 , SMTP , IMAP , MariaDB , CentOS , PostfixAdmin , Dovecot ,  Roundcube

In this manual, you configure a full-fledged mail server. List of all features and capabilities:

• Mail system based on Postfix;

• Support for virtual domains;

• Storing mail on the server;

• Connection to mailboxes by POP3 and IMAP (Dovecot);

• Encryption support;

• Storing a part of the settings in MariaDB;

• Protection from SPAM and viruses;

• Access to mail using the web interface (Roundcube);

• The ability to manage mailboxes using PostfixAdmin.

Content

1. Pre-installation of the system 

2. Configuring the Web server: NGINX + PHP + MariaDB 

3. Installing and configuring PostfixAdmin 

4. Configuring Postfix 

5. Configuring Dovecot 

6. Checking the server 

7. Configuring Roundcube Webmail 

8. Protection from viruses 

9. Protection from SPAM

1. Presetting the system

I remind you, this instruction is written under the Linux system CentOS version 7.

Setting the correct name to the server is an important step, since most antispam systems perform checks, referring to the server by name in anticipation of a response.

* You must specify the FQDN name that will be available from the WAN. In this example, relay.dmosk.ru is specified  .

After we enter the following command:

Install service packs (they will be needed during server configuration):

*  ntp for the ability to synchronize the time on the server; wget - client for downloading files.

Set the time zone (in this example, Moscow time):

Synchronize time:

We update the system:

We open the ports in advance on the  firewall :

* where we will open the following ports:

• 25 - standard SMTP via STARTTLS;

• 80 - HTTP for Postfixadmin and Roundcube portals;

• 110 - standard POP3 via STARTTLS;

• 143 - standard IMAP via STARTTLS;

• 443 - secure HTTPS for Postfixadmin and Roundcube portals;

• 465 - Secure SMTP over SSL / TLS;

• 587 - Secure SMTP through STARTTLS;

• 993 - Secure IMAP over SSL / TLS;

• 995 - Secure POP3 over SSL / TLS.

2. Configuring the web server: NGINX + PHP + MariaDB

The PostfixAdmin control system operates as a web application developed in  PHP , and stores information in the database. In our example, we will use the  web server on NGINX , and the database will be MariaDB.

NGINX installation

Add the repository with the required package:

Install nginx:

We allow autostart service and start it:

We check the working capacity of the web server by accessing it in the browser using the IP address . If you see the title "Welcome to nginx!", NGINX is configured correctly.

PHP + PHP-FPM + NGINX

Install php and php-fpm :

Configuring NGINX:

* where  / usr / share / nginx / html - directory for posting the Postfix management portal.

Configure PHP-FPM:

* here we changed the line  127.0.0.1:9000 .

Run the services:

* If during the restart of nginx the nginx error pops up  : [emerg] a duplicate default server , it is necessary to find the virtual domain setting, which also specifies the option  default_server - the option should be removed. Or you can configure another virtual domain yourself.

For verification, create an index file in the site directory with the following content:

Open the site in the browser by its IP address. On the opened page we should see the detailed information on php:

MariaDB

Install the database server with the following command:

Enable the autostart service and run it:

Set the password for the user sql root:

3. Installing and Configuring PostfixAdmin

Install additional components for PHP:

To apply installed packages, restart the script handler:

Download PostfixAdmin:

In the directory of nginx sites we create a directory for postfixadmin and unpack the archive into it:

We set the rights to the directory:

* despite the fact that we use the nginx web server, php-fpm by default, is run from the apache user.

Create the postfix database and the account in mariadb:

* where postfix is the name of the database.

* where  postfix is the account name; postfix123 - password; localhost only allows connection from the local server.

Exit the MariaDB command shell:

Open the configuration file postfixadmin:

And we edit the following:

Launch the browser and enter the address http: // <server IP address> /postfixadmin/setup.php

The process of verifying the configuration and installing the PostfixAdmin portal will begin. After it's finished, enter the password twice and generate a hash:

After reloading the page, we copy the hash:

Open the configuration file:

We find the line:

And we change it to:

* where  '7a8e14 ... c26' is the copied hash.

After, on the same page where the hash is shown, add the superuser PostfixAdmin:

* where Setup password is the password that we entered on the previous page; Password - the new password for the account you are creating.

As a result, we will see the following:

And we go in the browser to the page http: // <IP-address of the server> / postfixadmin /

We enter login and password for the created user.

Done.

4. Configuring Postfix

By default, Postfix is ​​already installed in CentOS 7. But if the server does not exist without it, let's perform the installation with a simple command:

We create an account from which we will work with the virtual mailbox directory:

* First we create a group of  vmail and guid 1024 , after - the user  vmail with uid 1024 and home directory / home / mail . Note that on some systems, the group ID and user ID 1024 can be used. In this case, you must create another one, and in this manual, replace all 1024 with an alternative one.

Now open the configuration file of the mail server for editing:

And we edit the following lines:

* This setting specifies which domain to substitute to the sender, if it is not specified in the FROM header.

* specify for which domains we receive incoming mail.

* indicate where to get the list of local users.

* Permit to send messages to the local server.

* indicate where to get the list of aliases.

* You need to make sure that postfix will listen on all necessary interfaces, in this case, at all.

Now at the end of the configuration file we will add the following:

* where:

• virtual_mailbox_base - the basic way to store mailboxes on a UNIX system.

• virtual_alias_maps  - format and path for storing aliases for virtual users.

• virtual_mailbox_domains  - the format and path for storing virtual user domains.

• virtual_mailbox_maps  - format and path for storing mailboxes for virtual users.

• virtual_minimum_uid  - from which number to assign IDs to users.

• virtual_uid_maps  - the identifier of the user from which messages are written.

• virtual_gid_maps  - identifier of the group from which messages are written.

• virtual_transport  - specifies the message delivery system.

• dovecot_destination_recipient_limit  - the transfer of messages from Postfix to Dovecot is performed according to the specified number (in our example, 1 piece).

• smtpd_sasl_auth_enable  - allows sasl authentication.

• smtpd_sasl_exceptions_networks  - excluding networks from using encryption.

• smtpd_sasl_security_options  - additional options for setting sasl.

• broken_sasl_auth_clients  - this option is prescribed for MS Outlook clients.

• smtpd_sasl_type  - indicates the type of authentication.

• smtpd_sasl_path  - the path to the temporary information exchange files with Dovecot. It specifies either an absolute path or a relative queue_directory.

• smtpd_tls_cert_file  - the full path to the public certificate.

• smtpd_tls_key_file  - the full path to the private certificate.

• smtpd_use_tls  - indicates to clients that TLS support is available.

• smtpd_tls_auth_only  - use only TLS.

• smtpd_helo_required  - request to start the session with a greeting.

Create a file with the settings for accessing the database with aliases:

* where user and password - login and password to connect to MySQL; hosts - the name of the database server (in this case, the local server); dbname - the name of the database; query - a query template for data.

Create a file with instructions for obtaining data on virtual domains:

And a file with mailboxes:

Open the file master.cf and add to the very end:

* Need to make sure that the contents of the file are no other options uncommented for  submission,  smtps and  dovecot (by default, they are not). In this case, we configured postfix on ports 25, 465 and 587.

Restart postfix:

5. Configuring Dovecot

Install Dovecot with the component to work with the DBMS:

We configure the way messages are stored:

* In this example, the messages will be stored in the advanced maildir format  .

Configure the listener for authentication:

* Please note that  / var / spool / postfix / private / auth is the same  private / auth that was registered by us in postfix.

Configure authentication in Dovecot:

* in this case, we just comment on the usual authentication and remove the comment for using sql-auttification.

Configure the use of encryption:

* This setting will tell dovecot to require clients to use encryption.

Let's configure automatic creation of directories when the user first connects to the mailbox:

We configure the connection to our database:

* In this example, we have specified a file that will contain the settings for retrieving users and passwords from the database.

Create a file with the settings for working with mysql:

And, finally, configure the protocols and interface, which will listen to dovecot:

* By default, dovecot also listens on ipv6 ( listen = *, ::) . If the server does not use the 6th version of the TCP / IP protocol, errors will appear in the dovecot logs: 

master: Error: service (imap-login): listen (::, 143) failed 

: service (imap-login): listen (::, 993) failed: Address

Generate security certificates

Create a catalog in which to place the certificates:

And we will generate them with the following command:

* the certificate is generated for  1461 days, subj keys  can be arbitrary, CN must be specified in accordance with the name of the server by which we will connect to the mail.

Run the dovecot:

6. Create the first mailbox and check the server operation

In the browser, enter the path to Postfixadmin in the address bar - http: // <server IP address> / postfixadmin /.

We enter login and password from the administrative account that we created in step 3. We will see the account management page.

Let's move on to the Domain List - New Domain:

Fill out the forms and click on Add Domain:

Now go to Overview - Create a box:

Enter the data for the new user and click on Create a box:

Now you can connect to the server using any email program, for example, Mozilla Thunderbird.

Connection parameters:

• Server : the name of the server or its IP address (not desirable, since the certificate is issued by domain name).

• IMAP : 143 STARTTLS or 993 SSL / TLS

• POP3 : 110 STARTTLS or 995 SSL / TLS

• SMTP : 25 STARTTLS or 465 SSL / TLS or 587 STARTTLS

7. Install and configure Roundcube Webmail

On the official site go to  the download page of  Roundcube. See the link to the latest stable version of the product:

Use the link to download the program archive:

Create a directory where the portal files will be located:

And unpack the downloaded archive:

Copy the config template:

And we open it for editing:

* We edit the first line, and add the second one. In the first line of the  roundcube: roundcube123 - login and password for accessing the database; localhost  - the database server; roundcubemail  - the name of the database.

We set the apache owner to the portal folder:

Create a base in MariaDB for the roundcubemail:

And load the data into the created database:

Install the components necessary for the work of Roundcube:

Let's configure php:

Reboot php-fpm:

Now open the browser and go to http: // <server IP address> / webmail / installer /. At the very bottom click on the Next button . If the button is inactive, check that there are no errors ( NOT OK ).

We check that all items are in the OK state .

After removing the folder with the installation scripts:

And go to the browser at http: // <server IP address> / webmail /.

8. Protect yourself from viruses

Installing and Configuring ClamAV

Install the antivirus:

Configuring postfix:

* where  content_filter points to an application that will scan messages; receive_override_optionsallows you to see the original email addresses of emails with viruses.

Now edit master.cf:

We add the following:

Restart postfix:

Configure clamsmtpd:

* Where  ClamAddress is pointing to the path to the socket file - it must match the path in the configuration file for clam scan; TempDirectory - the path for storing temporary files.

Editing the configuration file for clam scan:

* where  PidFile is the path for the service pid file; LocalSocket - the path to the socket file for interaction with clamsmtp; User - the user from which clamd will be launched.

Let's edit the owner on the directory for the socket file:

Now let's run the antivirus and run it:

Update

Open the config freshclam and put a comment opposite Example:

We resolve and start the service:

Run the update:

To configure the automatic update, we edit cron:

* In this example, every day at 03:15 the clamav update process will be started.

Checking

To check, we send a message with the following content:

X5O! P% @ AP [4 \ PZX54 (P ^) 7CC) 7} $ EICAR-STANDARD-ANTIVIRUS-TEST-FILE! $ H + H *

The letter should not reach.

9. Fighting with SPAM

Checking content with Spamassassin

Install spamassassin

Edit master.cf:

For smtp, add the following option: 

And add the following:

Updating spamassassin:

Let's start it and start the service:

Restart postfix:

For automatic updates, add the following to cron:

* The update will occur every day at 03:30 .

To check the operation of the content antispam, send a message with the following content:

XJS * C4JDBQADN1.NSBN3 * 2IDNEN * GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL * C.34X

Antispam tools Postfix

MTA Postfix has its own mechanism for checking the headers of incoming messages. The rules are placed in 6 sections, which are processed in the following order:

client -> helo -> sender -> relay -> recipient -> data

And so, to configure the antispam in the main.cf configuration file,  add:

* these are more or less mild rules. They can be used for the first time while testing the server.

To strengthen the protection we add:

* where:

• reject_unknown_client_hostname - checks the presence of the PRT record of the sender and the availability of the working A-record in accordance with the PTR.

• reject_invalid_helo_hostname - Checks the HELO greeting syntax.

• reject_non_fqdn_helo_hostname - requires the correct FQDN name during the HELO greeting.

• reject_unknown_helo_hostname - forbids to be represented by names for which there is no A-record or MX.

• reject_rbl_client - checks the presence of the sender in blacklists.

After making all edits, you need to restart Postfix:

The server is configured - you can use it.

# Servers # UNIX # NGINX # MySQL

--------