What this tutorial is *NOT* about
If you just need a no-cost mail server quickly and don't care about the technical mumbo-jumbo then this is the wrong place for you. There are ready solutions like
iRedMail if you are in a hurry. Don't expect to learn much though if you chose the dark side. I personally recommend you understand what you are doing - that's what the ISPmail tutorials are for. Experience from giving support in the #postfix channel on IRC shows that most hobby sysadmins fail because some detail in a complex setup goes wrong and they have no idea how to track it down. Actually I have a feeling that other projects use the ISPmail tutorials to get started, too. :)
What this tutorial is about
You are interested in learning all the basics about running your own mail server using Debian Squeeze? Be my guest. All you need is a computer running Debian (Squeeze) and an internet connection. This tutorial explains step-by-step how to set up such a server and give you lots of background information in the process. Depending on the internet connection and server hardware you will be able to run a reliable mail service for thousands of domains and users.
Soon you will be proud operator of a mail server that can:
- receive and store email for your users from other mail servers on the internet
- let your users retrieve the email through IMAP and POP3 - even using SSL-encrypted connections
- receive and forward ("relay") email for your users using SMTP authentication
- offer a webmail interface to read emails in a web browser
- detect most spam emails and filter them out or tag them
License/Copyright
This tutorial is copyrighted 2011 Christoph Haas (email@christoph-haas.de). It can be used freely under the terms of the
GNU General Public License. Don't forget to refer to this URL when using it. Thank you.
Things you will need
The server setup described here is totally standard work for a professional system administrator. Depending on your level of knowledge and experience you may walk through this document easily or curse the author and fail miserably. You will need to know or learn about different topics regarding basic system administration tasks, DNS, SMTP, MySQL and POP3/IMAP. What you will need:
- A computer to run Debian on (e.g. a dedicated server)
- A Debian installation medium (I prefer a Debian netinstall CD)
- An internet connection
- If your internet connection has a dynamic IP address then you will need an SMTP relay (most decent ISPs offer that) because you usually can't send out emails directly to other mail servers.
- An internet domain and control over its MX record
- Control over your firewall (if you have one) to open the needed ports for SMTP, IMAP and POP3.
- 1-8 hours of time depending on your knowledge.
About this tutorial
Many years ago I wanted to turn my Debian server into a mail server with virus scanning, spam detection, email forwarding, POP3 and IMAP access and a webmail service. All the components were available but it took a while until they worked properly together. So I summed up my desk full of scrawly notes into a tutorial that has become pretty famous. According to my web server statistics it's still the most frequently read article at workaround.org.
This document is not a simple copy-and-paste tutorial where you just copy the commands from the web site and run it on your server. Instead it will make you understand the different components that you are setting up. In the end you will be skilled enough to debug problems yourself. If you feel you need help with your setup then try the hints in the Troubleshooting section or ask on the
mailing list. Unlike many other Postfix tutorials on the internet this is already the sixth edition. Writing this tutorial took a lot of work so these are not just quick draft notes thrown together but a consistent document guiding you.
The whole tutorial is split into several chapters. Please use the links on the right side or below to navigate through the tutorial. If you prefer all content on a single page (e.g. for printing the tutorial) then use the "
printer-friendly" link below. You are also invited to comment on the pages - just click on the "
Add new comment" link at the bottom.
If you like the tutorial then a
tiny donation is appreciated to run the servers and pay for the internet connection.
94 Comments
Backup mail server; backing up&archiving mail messages
Submitted by Anonymous (not verified) on
Thanks for these great tutorials. I started by using the Etch tutorial, few years ago, and can not wait for the squeez tutorial to migrate.
I've been resarching for "backup mail server" setup and how to backup&archive mail messages.
I'll be setting up (with squeez) two servers and use rsync/rsnapshot.
Has anyone have experince or ideas with these two topics?
Thanks,
I'm close to having the basic
Submitted by Christoph Haas on
I'm close to having the basic bits of the Squeeze tutorial ready. Feel free to subscribe the workaround-chitchat mailing list. I'll announce shortly what parts are ready and appreciate to have testers.
So you want to provide a high-availability mail server? rsync may be a solution. So could be DRBD. If you want to spend money you can also use a shared network storage (NAS) and mount /var/vmail (using OCFS2) on both servers using iSCSI.
Backup mail server; backing up&archiving mail messages
Submitted by Ragai (not verified) on
Thanks, I susbscribed to the Forum and the mailing list.
I have two separate and identical servers. Each with 2 mirrored 1TB HDDs. I was thinking of putting them in two different locations. I believe this should provide redundancy against hardware failure, file system corruption and Network/power connectivity. Not yet sure how to handle the DNS for them or the SSL certificates.
I did not research RDBD before. Not sure if it writes to the other disk or just syncs/mirrors the disks, copying over any file system corruption that might occur. That will be my home-work after Easter.
I still need some sort of archival backup so I can retrieve some user's emails if he, by mistake, deleted his emails. May be monthly full backups for six month and daily diffs for a month. Something like that.
Backup mail server
Submitted by Anonymous (not verified) on
Flexbackup
Submitted by Anonymous (not verified) on
I've been using flexbackup for several years now. Works great so far. Nothing fancy but it gets the job done in a small to medium environment.
Javier Llarens.-
Moving vmail
Submitted by alex (not verified) on
Hello,
I follow your tutorials since the first one !
My /var partition is quite full and I'd like to moove the vmail directory into the /home partition, is there a tutorial for this ?
I hope I don't need to recreate all my adresses.
Thanks a lot for your time.
Alex
The simplest way would be
Submitted by Christoph Haas on
The simplest way would be moving /var/vmail somewhere else and using a symlink. For example:
mv /var/vmail /home/vmail
ln -s /var/vmail /home/vmail
I recommend you shut down Postfix and Dovecot while you move the files to avoid data corruption.
Instead of using a symlink you could change the path /var/vmail in all your configuration files to /home/vmail. I would probably add a dedicated logical volume if I had a system with a working LVM (logical volume manager) setup. That would give me maximum flexibility.
Change Hash metod of passwords
Submitted by Anonymous (not verified) on
Maybe it is time to change hash method of passwords in database? MD5 is not secure enough for today. It would be great to use SHA256 + SALT or any SHA.
I second that SHA is probably
Submitted by Christoph Haas on
I second that SHA is probably more secure than MD5. On the other hand it's just a matter of preventing that the database contains cleartext passwords. The MD5 hashes are just used between Dovecot and Postfix and the MySQL database.
In addition system administrators following the previous tutorials couldn't just change that because they already have the passwords in MD5. And I'm not aware of a fast MD5 to SHA converter. :)
But this isn't problem. You
Submitted by Anonymous (not verified) on
But this isn't problem. You need only to update column password to form: "{PLAIN-MD5}" + old_password_hash (also change it width, because it is now created only for MD5-HEX). Than u can change default hash to SHA1/SHA256/SSHA256/etc. As I acknowledge user verification is only in Dovecot and to verify user in Postfix you use bridge between Dovecot and Postfix. And now you have back compatibility and safer storage. New password you can generate by dovecotpw command.
Thanks. I will consider that.
Submitted by Christoph Haas on
Thanks. I will consider that. You are right that the authentication schema can be given explicitly like this. I just wonder if other parts of the setup would prefer to have one common hashing algorithm. Like for example the web frontends out there that deal with the existing database schema. I've received many "please don't change the schema" pleas in the past. :)
So today we have 1st May. Did
Submitted by Anonymous (not verified) on
So today we have 1st May. Did you finished your tutorial?
@Anonymous Good work takes
Submitted by Anonymous (not verified) on
@Anonymous
Good work takes time... Did you ever did a good work?
,-) Alois
Not quite. My spare time is
Submitted by Christoph Haas on
Not quite. My spare time is hard to plan. :) But most chapters are done and tested. It cost me quite a lot of time because I decided to rewrite the educational chapters from scratch thus making them easier to understand. What's left is Roundcube web mail, DKIM mail signing and SPF checks. Then the tutorial is ready for release. I already have a sponsor (ads) so I'm forced to get the tutorial done soon.
Hmmm can't wait, checking
Submitted by Anonymous (not verified) on
Hmmm can't wait, checking every day now. can you give a time table when your finishd?
I'll probably release the
Submitted by Christoph Haas on
I'll probably release the "beta" version during the weekend and ask for testers. I'm doing the tests on a virtual machine, too, but haven't yet upgraded my mail servers step-by-step following my own tutorial. So I'm trying to be careful. But, yes, I'm trying to get done with the tutorial this week. After all I'm starting to get annoyed to have it on my todo list for so long. :)
Worth the wait
Submitted by Anonymous (not verified) on
We can all wait, rather have it done properly than more revisions later on. Thx again for an awesome guide!
When will the roundcube part
Submitted by Anonymous (not verified) on
When will the roundcube part be finished?
For what it's worth....
Submitted by Anonymous (not verified) on
I wrote a series of comments which you can find here:
http://workaround.org/ispmail/squeeze/installing-packages
on my experiences on setting up Roundcube.
Since that time (in excess of two months), Roundcube has been purring away not missing a beat.
The only thing I would reiterate is, as I am a novice email admin and I don't know if this test server with Roundcube is vulnerable, so please keep that in mind, but it certainly works! Having said that, to the best of my knowledge I haven't had any successful attacks against it.
Coooool
Submitted by Anonymous (not verified) on
Thanks a lot for ne update of the turorial!
A really great one! :-)
Thank you for your efforts
Submitted by Anonymous (not verified) on
Just wanted to say that I deeply appreciate the time and efforts you've put into these "ISPmail" guides over the years. I read the one written for Debian Etch some years back, and it certainly influenced how I chose to set up my own mail system.
I look forward to read your latest tutorial for Squeeze!
Quotas?
Submitted by Anonymous (not verified) on
Hi there,
First of all I'd just like to say thanks for this.
I've been the sysadmin at a hosting company for a while and have been wanting to migrate away from Courier to Dovecot for a while now and this was an easy guide to follow, so hats off to you for that.
Something worth noting though, what would be the process or adding quotas to this setup?
Thanks,
Lee.
I'm currently working on a
Submitted by Christoph Haas on
I'm currently working on a page on how to use quotas with Dovecot. Stay tuned - it will be released shortly.
quota
Submitted by Anonymous (not verified) on
for quota I just did this:
Quotas ?
Submitted by Anonymous (not verified) on
Any thoughts on the quotas page ?
Quota
Submitted by Tibby (not verified) on
Any Update on how to configure different quotas for users ?
Administration via web portal
Submitted by Anonymous (not verified) on
Hi,
Do you have any tutorials for setting up administering of the domains/users etc via a portal? I know of packages such as postfixadmin, but I'm not sure what to use, as I'm new to postfix (ex courier user!)
Cheers,
Steven
Almost there...
Submitted by Anonymous (not verified) on
Today, the top-level page says the squeeze tutorial has gone to beta, with two pages left to do (down from five). I can only see one new page (the very last one about sysadmin niceties). Judging by the comments, quite a lot of us have followed the '5 pages left' tutorial.
Would it be possible to give a quick summary of what the new sections are, how they affect anything we've already done, and what the two remaining ones are? Thanks.
Hey, you are watching the
Submitted by Christoph Haas on
Hey, you are watching the main page and compare the number of pages left? Nice. :)
But seriously. The newest page is "Sysadmin niceties" dealing with advances topics like brute force prevention, log rotation, statistics and the message queue. Another page is called "SMTPd restrictions, SPF, DKIM and greylisting" - I hoped to have the page ready but at 1:00 in the morning I delayed that until this evening. There is just one section missing on DKIM signing and I rather wanted to have it fully tested before publishing it. The third page is on RoundCube web mail but I unpublished that page, too, because I had trouble with its settings and wanted to check that out first.
So, yes, the counter is wrong. But the end is near.
Many thanks, Christophe...
Submitted by Anonymous (not verified) on
...for both the reply, and indeed the tutorials in the first place. I know it's easy for us to be critical, but I really do appreciate the effort you put into these tutorials - not only the learning, investigating and testing of the accuracy of them (which I gather is appreciable), but also the time you take to explain the reasons for doing things, and the excellent presentation of them in an easy to read and understand format.
Many thanks.
Alias deliver
Submitted by Anonymous (not verified) on
Hi,
I really appreciate the ISP Turorials. Upgraded to Squeeze from Lenny. Using ISPWebadmin as well.
Can create aliases in ISPWebAdmin and new alias is inserted into the virtual_alias table properly. However, instead of aliasing, or forwarding the source to the destination address, a new mailbox is created in the source domain of /var/vmail/source_domain as if its a true mailbox rather than an alias. If I create a new email account in a client, then I can get the mail normally.
This is happening to all aliases both existing and new aliases.
I'm sure I've missed something but I have gone back through the entire tutorial a number of times to find an answer to no avail. I'm hoping you might point me in the right direction.
Best
Chap
Mailing lists (SmartList)
Submitted by Anonymous (not verified) on
Hi there.
I recently used your great tutorial to set up a mail server and it's working just fine.
Now, today I decided to set up some mailing lists with SmartList, so I created a subdomain (lists.mydomain.org). Now, what's the best way to make Postfix redirect mails to *@lists.mydomain.org to SmartList's flist program? I tried using transport_maps to map mylist@lists.mydomain.org to a transport called list-mylist (and mylist-request@lists.mydomain.org to a transport list-mylist-request, respectively), and it seems like this worked. But it doesn't seem to be feasible if there are more mailing lists (creating a new transport for every mailing list seems just... wrong). It would be great if I could just call 'createlist newlist' and 'newaliases'. I tried using alias_maps=hash:/etc/aliases (as SmartList automatically adds mailing list aliases to this file), but then Postfix won't execute the specified command but rather try to 'send' it to some address like |flist@mydomain.org. I don't know how to make it work properly.
But still, my mail server is running smoothly. Thanks for your great tutorial and keep up the good work!
I am going to do the same,
Submitted by Anonymous (not verified) on
I am going to do the same, why do you prefer smartlist over mailman?
I pretty much agree with
Submitted by Anonymous (not verified) on
I pretty much agree with this: http://www.jwz.org/doc/mailman.html
Sorry, your helo has been denied. 550
Submitted by Anonymous (not verified) on
Firts of all a huge THANK YOU to you for this great tutorial!
I had absolutely no problems following your tutorial to successfully set up a mail server.
Just a note for sending mails to gmx.net users.
When I tried to send a mail to my gmx mail account for testing purposes I was getting a "Undelivered Mail Returned to Sender" replay with the error message Sorry, your helo has been denied. 550.
To fix this I had to edit/add tho following to my /etc/postfix/main.cf
myhostname = example.org
mydomain = example.org
Of course example.org was replaced by my real domain.
After I made this changes I cloud successfully send mails to my gmx account.
thanks - but is there a webmail interface and web interface for
Submitted by Anonymous (not verified) on
Thanks for all your hard work.
I was looking for a user web interface that would be easy to setup to interact with your configuration.
DO you have a tutorial on how to set that up ??
I also need a web or script to interfacce with the sql tables I can input the correct info - do you have a tutroial for that???
thanks
mjh
postfix piping emails to php
Submitted by Anonymous (not verified) on
Hi,
I want to pipe some emails from a virtual alias to php. It's possible ?
Something like this:
php-pipe@example.com => /usr/bin/php -d /var/www/pipe.php
I need some help.
Thank you
Have you found an answer? I
Submitted by Anonymous (not verified) on
Have you found an answer? I have exactly the same problem...
That's relatively easy if you
Submitted by Christoph Haas on
That's relatively easy if you know how to do it. Pipes to commands only work with local domains. So you have to create a local domain (see "mydestination" and read on the different types of domains if you are unsure about the difference of local and virtual domains.) Assume your local domain is "mylocaldomain.example.com" (I usually use "localhost" as a domain). Then create a forwarding from your dindgdong@example.com address to e.g. php@mylocaldomain.example.com. Aliases for local domains are listed in /etc/aliases. Add an entry like:
and run "newaliases". Emails will then be sent as STDIN to that PHP script. Note that the PHP script has to be readable with "nobody" rights.
Thanks Christoph - that was
Submitted by Anonymous (not verified) on
Thanks Christoph - that was really easy. It seems I always tried to get this with virtual users...
Virtual User to Pipe through Local Domain?
Submitted by Anonymous (not verified) on
If I understand, if we need a virtual email address to pipe to a php script we would create a virtual alias (in the MySQL Database). E.g.: Where virtual.example.net is a virtual domain and example.com is the local one (or anything from the mydestination in main.cf):
support@virtual.example.net to pleasepipe@example.com
then in the alias, e.g.:
(then a postmap /etc/aliases)
Thanks!
Roundcube Password changer
Submitted by Anonymous (not verified) on
Chris,
how do we go about allowing the users to change passwords via roundcube? I love the interface and your tutorial has helped me set up a nice email server. i have been poking around on the web and have been thoroughly confused with its setup. any thoughts?
Thanks
--John
SMTP and Roundcube
Submitted by Anonymous (not verified) on
Followed your guide but somehow after I changed to SSL I'm not able to connect to SMTP and Roundcube isn't allowing me to login, don't know what can be wrong?
UnicodeMultiDict
Submitted by Anonymous (not verified) on
routes
Submitted by Anonymous (not verified) on
Sorry, the comment should have gone to the Lenny/ispwebadmin page.
There seems to be a similiar problem with routes. When you see routes-related exceptions, try this:
Great Article Thank you for sharing this
Submitted by Anonymous (not verified) on
Realy great article.
Thank you for sharing this.
Exactly what I've been looking for!!!
Submitted by Anonymous (not verified) on
Christoph, great tutorial! I wanted to know the nuts and bolts and NOT use those other 'quick and painless' solutions out there. I wanted to understand what I was doing when setting things up, and your tutorial was successful!
Thanks again! :D
Filtering Email?
Submitted by Anonymous (not verified) on
What do you suggest for filtering email? Procmail? Maildrop?
ISPwebAdmin (web interface)
Submitted by Anonymous (not verified) on
Does ISPwebAdmin setup described in lenny works for squeeze?
TIA
Yup
Submitted by Christoph Haas on
Yes, the database schema hasn't changed. So you should be able to use it on Squeeze.
Pages