Can I use this guide for my own work?
Previously I claimed a copyright on the documentation. However let’s make things simpler. This Bullseye guide is using the Creative Commons BY-NC-SA license. Which means:
- BY = Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- NC = NonCommercial — You may not use the material for commercial purposes. Do what you want with your mail server. But let’s keep the knowledge free.
- SA = ShareAlike — If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.
Besides that this guide has been a team effort. Many readers have contributed to it. I may spend the time to turn it into a guide but a lot of good ideas were not mine alone.
Can I advertise in your guide?
No.
Why don’t you use Nginx/PostgreSQL?
I personally prefer that software, too. Just go for it. But for the sake of consistency let’s keep Apache and MySQL as default choices in this guide so that readers upgrading from previous versions don’t have to switch.
Do you offer paid support?
Generally, yes, I am a sysadmin freelancer. If you are just stuck at some point you may want to ask in the chat first though.
How do I filter out malware?
I understand the need for it. If your users are using low-security operating systems (e.g. those that run EXE files) they are threatened by a lot of security problems. From the perspective of an email provider I would not want to take responsibility for filtering emails. That is only working on symptoms and not addressing the actual issues. Security is a fundamental concept and not something you slap on top of something inherently broken. I would not want to be blamed for a crypto trojan infection because the user relied on me saving them from bad things to happen. Client security in non-free systems is a topic on its own.
Debian packages are too old and insecure
If you use a Debian stable release you have chosen to stay on a specific software version. “Stable” means “a version that will not change”. That’s the best choice for a server. Those software packages are by no means less secure though because they also get security updates. Debian also has up-to-date packages but you surely don’t want to use them for a mail server unless you feel adventurous or have an intense hatred for your users. For a detailed discussion see this separate article.
Can I download the guide as one file?
I haven’t yet found a way to accomplish that. WordPress is not especially good when it comes to structured multi-page documentation. If anyone has a hint I’d be grateful.
Why don’t you put the guide on Github as Markdown?
This website runs on WordPress because I wanted something easy to edit and also have discussions on each page. I might be a hardcore terminal user but just sometimes I prefer to have a WYSIWYG editor. I tried several ways to work with multi-file Markdown builders but the workflow was uncomfortable and lead to ugly documentation. Besides we wouldn’t have discussions on the pages and I’m surely not including Quora for discussions.
This may seem like a silly/uneducated question, but will this process also allow for calendar integration? i.e. sending meeting invites, accepting meeting invites, etc.?
Aren’t we all here to be educated? 🙂 My goto-solution for calendar and contacts is Thunderbird, Nextcloud and DavX. You probably know Thunderbird as a desktop mail program (“mail user agent”). It can handle contacts and calendars as well. However contacts and meetings/appointments are not actually stored on the mail server.
That’s what I use Nextcloud for. Using CalDAV for calendar entries – and CardDAV for contacts/cards, you can load them into Thunderbird. When you create a new appointment you can include any contacts there which triggers an email to those recipients.
On the smartphone I use DavX (Android) to do the same. It can speak CalDAV and CardDAV and also gets the data from Nextcloud. It will sync changes regularly and keep you up to date.
That way you can use your desktop and your smartphone. Create a contact on the phone and get it in Thunderbird, too. Create a new appointment in Thunderbird and have the calendar entry on your smartphone. And of course you can view them in Nextcloud, too.
If you are not a fan of Thunderbird you can also use Calendar, Contacts and Mail in Nextcloud altogether.
I intended to create a separate chapter on that topic because I find that very useful. If there is interest I’ll write it.
Hello,
Thanks for the tutorial. I followed it and have everything set up and working perfectly as it should, except two questions.
1. I have also installed Nextcloud on the same server as the email server. I would like to have new Nextcloud users automatically be assigned an email account on the mail server. To accomplish this, I put the Nextcloud database on the same database as the email server. I then created a database trigger on the Nextcloud user table to insert a new record on the virtual_users table before a new user is inserted on the Nextcloud table. This seems to work great. Are there security risks with using the same table with Nextcloud and using database triggers to insert new mail users, update mail passwords, and delete mail users?
2. I would also like to use the Nextcloud mail addon “Snappymail.” The IMAP connection with Snappymail works fine, so I can receive mail with no problem on Snappymail. However, the SMTP connection does not work right because Snappymail is on the same server and is connecting on localhost. Dovecot is not authenticating the localhost connection therefore Postfix is not sending email outside of the server when using Snappymail (as expected, since it is not authenticated) Snappymail can send mail to other mail accounts on the server. Other clients, such as Thunderbird, can send mail outside of the server because they are not connecting as localhost and are thus being properly authenticated. If I add “permit_mynetworks” to “smtpd_recipient_restrictions”, then the localhost can send mail without the SASL authentication and it works. However, I am concerned the “permit_mynetworks” could be a security risk to the mail server. Is it safe to use the permit_mynetworks on the smtpd_recipient_restrictions? Or is there a way to force the localhost to use the SASL authentication so that Snappymail can properly authenticate on SMTP? The most frustrating part of this problem is that Snappymail has an addon to connect to the mail server with the users IP instead of localhost, but that addon is not functioning as it should. I lack the ability to to fix the Snappymail addon (which I believe is the proper solution).
Thanks again for the tutorial and for any thoughts you have on my issues.
Hello again,
I have been working on this throughout the day and have found this:
https://www.postfix.org/SASL_README.html
That suggests that the normal functionality of a Postfix server is to allow connections from the localhost to send without authentication. Am I understanding that right? If I am, then it seems to me that I should set “permit_mynetworks” to “smtpd_recipient_restrictions” and thus allow the localhost to send without authentication. That seems reasonable, but I am not positive about this.
Hello Christoph,
thank you so much for this updated guide and the continuous improvement to it.
do you have any plan to integrate a MFA solution to it for both webmail and mail clients (or any suggestion for one that would be easy to integrate) ?
Michael
Hello Christoph,
could you please consider to enhance your ansible playbook with deployment of Nginx and its relevant config?
Thomas
If you already have nginx set up, ansible is likely to clobber it. If you just want to use nginx, see the arguments that Christoph has presented.
Alternatively, you can use Mailcow which uses nginx by default.
A sysadmin newbie here. How scalable is this solution compared to others? Can it handle several hundred users and expand as required? Thanks
It probably depends on how busy the users are. Usually a mail server is bored. Dovecot also keeps indexes of email folders to speed up things. I suggest to avoid spinning disks and always go with SSDs or other full-flash storage. The server will only get a slight CPU and I/O spike when a mail arrives or when users fetch emails. So I/O is probably the bottlneck – thus: SSDs.
If I’m running this behind an nginx server running at x.x.x.111, how can I set up traffic to forward to the apache2 instance running on x.x.x.112?
If I use the “mutt -f” command to test imap, I get “Network is unreachable” using the domain. Although using mutt -f @@x.x.x.112 works.
I should also say that following the instructions, I can successfully access domain.com/test.