After the basic installation your server will reboot and allow you to login. You can either login at the console (if you have physical access to the system) or using SSH (secure shell).
SSH as root with password login?
Unless you just installed the server it is a good idea to install all missing updates first:
apt update apt upgrade
Packages
Let us install the necessary Debian packages to make it an actual mail server. Take a moment to read through this list of package – we will do the installation afterwards:
- mariadb-server
The MySQL server that will store information about your email accounts and domains. In previous versions this package was called “mysql-server”. MySQL was bought by SUN Microsystems which was later bought again by Oracle. Its original developer Monty was not happy with Oracle and thus maintained the software under the new name MariaDB. (Maria and My are the names of Monty’s children.) So basically MariaDB is a fork of MySQL. Both pieces of software started to evolve in slightly different directions. However Linux distributions decided to go with the most open-sourcy way thus choosing MariaDB. So basically MariaDB is what you knew as MySQL. The “other” MySQL is available directly from Oracle. I just wonder how much I trust a commercial database maker with sponsoring a competing open-source product. - postfix
The MTA (mail transport agent) that speaks SMTP and receives and sends emails. - postfix-mysql
An extension that allows Postfix to get its information from a MySQL database. (Yes, it’s compatible with MariaDB.) - dovecot-mysql
The IMAP/POP3 mail server including an extension to query information from a MariaDB database. - dovecot-pop3d
An extension to Dovecot that allows users to fetch emails using the POP3 protocol. (This is optional. Only few users nowadays use POP3.) - dovecot-imapd
An extension to Dovecot that allows users to access emails using the IMAP protocol. - dovecot-lmtpd
Enables Dovecot to receive LMTP connections. We will need it later to make Postfix send emails to Dovecot for storage. - dovecot-managesieved
An extension to Dovecot that allows users to define filter rules that are automatically run on the server when a new email arrives. - apache2 and php7.0
The web server that powers the webmail interface. PHP is the scripting language that the Roundcube webmail software is written in. - adminer
A web interface to manage your SQL database. - rspamd
A third-party software that deals with spam and handles automatic domain key (DKIM) signing. - redis-server
A key-value store. It is a simple but fast kind of database service where Rspamd stores training data about spam and ham. - pwgen
A tool to create random passwords. - swaks
The SWiss Army Knife of Smtp. A utility to send emails through SMTP for testing purposes. - mutt
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the functionality of your mail server. - certbot
A tool that talks to the LetsEncrypt certificate service to create and renew certificates. - ca-certificates
A set of certificates from common certificate authorities on the internet. It is required for the proper function of wget for example. - fail2ban
A daemon that tracks log files to recognize brute force attacks. It can block IP addresses of attackers. We will use it to defend against evil people trying to get into our mail server.
pwgen
Let’s start with the pwgen utility. It helps you create secure passwords. Unless you already have a tool for that…
apt install -y pwgen
You will need a random passwords later to create a database user for the mail server. Just as an example: to create a secure password having a length of 20 characters you would run:
pwgen -s 20 1
That gets you a string like “W2EzNUFJzjEmA8tQT7A0”.
MariaDB server
If you used MySQL before you may remember that you were forced to specify a password for the ‘root’ database user. That has changed with MariaDB in Debian – for the better. Now you can access the database server without any password if you are logged in as ‘root’ on the server. You might as well set a password but it is not necessary.
Go install the MariaDB server package:
apt install -y mariadb-server
If all went well you can now run “mysql” and get a connection to your MySQL database:
root@buster:~# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 30 Server version: 10.3.18-MariaDB-0+deb10u1 Debian 10 Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or 'h' for help. Type 'c' to clear the current input statement. MariaDB [(none)]>
Exit the SQL shell by typing “exit” or pressing CTRL-D.
Postfix
Now on to the Postfix packages:
apt install -y postfix postfix-mysql
When you get asked for the mail server configuration type please choose “Internet site”. Enter your own mail server name (the fully qualified domain name) or just press enter. The host name and domain does not need to match any of your email domains.
Apache and PHP
To provide a webmail service you need the Apache web server software and the PHP scripting language support:
apt install -y apache2 php7.4
Information
rspamd
Just like in previous versions of this guide we will deal with spam using rspamd. (The rspamd principal developer harshly insists that you use his own software packages but in this guide we will use the packages in Debian.)
We also install Redis as a storage backend for Rspamd to store its training data about spam and ham.
apt install -y rspamd redis-server
swaks
A very useful tool to test email delivery later is SWAKS (the SWiss Army Knife for Smtp):
apt install -y swaks
mutt
This is a full-featured IMAP mail client. Think of it as the vi of mail clients. It cannot display HTML but it is very helpful to test IMAP mail servers. And some hardcore users still prefer it over any other mail client.
apt install -y mutt
certbot
You will want to use encrypted connections where possible. So you need a certificate for your services. The certbot software helps you to request and manage Let’s Encrypt certificates automatically.
apt install -y certbot
Dovecot
In addition to Postfix (that handles SMTP communication) you will need Dovecot to store received emails and provide IMAP (and optionally POP3) access for your users:
apt install -y dovecot-mysql dovecot-pop3d dovecot-imapd dovecot-managesieved dovecot-lmtpd
Adminer
SQL databases are called like that because SQL (structured query language) is the way you talk to it. But as we are just puny humans let’s have a more user-friendly way to manage the database. I suggest Adminer which is a tool similar to phpMyAdmin.
apt install -y adminer
ca-certificates
To avoid errors when downloading files using wget you should install the default set of certificates of common certificate authorities on the internet:
apt install -y ca-certificates
Hi Christoph,
Thanks again for the (every time even better) ISPmail guide. I have a question, reading the selected packages: Why PHP7 and not PHP8? Since support for PHP8 most likely will be longer…
Regards,
Richard
Hi Richard. I wasn’t aware there is PHP8 in Debian Bullseye. Are you sure?
Hi christoph, you’re right, it isn’t (yet). mixed up debian/ubuntu/manual actions.
Hi Christoph – Thanks for all your hard work putting this together! I notice that you include fail2ban in your bulleted list of packages to install, but don’t include in the individual packages list that follows. Is this intentional (maybe it will be installed later?) or an unintended omission from the second list?
Oops, this reply comes months too late. In fact the “apt install” is mentioned on the page about brute-force prevention.
Hello Christoph,
many thanks for this guido which is so comprehensive .
Regarding Richards hint:
As I follow your guide, and we are currently in March 2022 there is even PHP8.1 in, and
if I remember correctly (just setting up Mail in parallel to Nextcloud) PHP8.1 is set to standard when installing so I had to step back to 8.0.
Nevertheless, one has to keep an eye on this when installing.
Best regards
Güner
According to many, Nginx is a better choice than Apache2.
Why did you choose Apache?
Search for nginx in the article. 🙂
Hello Cristoph,
Like many people here I’ve been following your tutorials for years (in my case since squeeze) starting on GlobalScale Dreamplug hardware and latterly using Raspberry Pi 4 machines. I endorse fully the positive remarks made by lots of other people about your tutorials: they are an incredibly useful resource. My latest build is on Bullseye using the 64-bit version of the Raspberry Pi OS, which brings me to the problem.
All was going well until I reached the “Filtering out spam with rspamd” section. It didn’t work; in /var/log/mail.log was
postfix/cleanup[283010]: warning: connect to Milter service inet:127.0.0.1:11332: Connection refused
Digging further, rspamd isn’t running. systemctl status rspamd shows
rspamd.service – rapid spam filtering system
Loaded: loaded (/lib/systemd/system/rspamd.service; enabled; vendor preset: enabled)
Active: failed (Result: signal) since Sun 2022-09-18 18:17:20 BST; 16h ago
Docs: https://rspamd.com/doc/
Process: 1050 ExecStart=/usr/bin/rspamd -c /etc/rspamd/rspamd.conf -f (code=killed, signal=SEGV)
Main PID: 1050 (code=killed, signal=SEGV)
CPU: 42ms
One other person has had this problem (https://raspberrypi.stackexchange.com/questions/136785/rspamd-wont-start-code-killed-signal-segv-on-pi-4-11-64-bit) and he solved it by downloading rspamd from GitHUb and rebuilding from the (latest) source. I very much agree with your position on using official Debian versions but it looks like I have three, equally unpalatable, alternatives:
1) Start again from scratch using a 32-bit version of Bullseye.
3) Try the rspamd version from Bookworm.
2) Install the necessary tools (git, cmake etc.) then download rspamd from GitHub and rebuild it from source.
The Bookworm and latest GitHub release appear to be similar (version 3.2). the Bullseye version is 2.7
What would you advise? FWIW, my instinct is to go with (1).
Regards
Don
Maybe the Bullseye-backports version (3.2-1~bpo11+1) is a better option than option (2) or (3)
I hesitate to believe everything I find on Stackoverflow. 🙂
Does “rspamdadm configtest” show anything unusual?
I just heard that there might be warnings about crypto hardware features on Raspi but those should not stop it from running.
Could you try to run it manually using “/usr/bin/rspamd -c /etc/rspamd/rspamd.conf -f -d -u _rspamd”?
Unfortunately, I waited a day for my message to appear and then assumed you were on holiday/busy. So I went ahead and installed the version from Bullseye-backports (figuring that if I was going to start again from scratch with 32-bit Bullseye, I had nothing to lose). So I can’t do any of the tests you asked for. Sorry.
What I can report is that version 3.2-1~bpo11+1 works just fine. So, if anybody else gets the SEGV problem, they may be able to do the tests (and after that, unless it looks fixable, install rspamd from backports).
Just hitting Enter when asked by the postfix installation produces:
“myhostname = localhost” in /etc/postfix/main.cf.
Some receiving SMTP servers reject emails without an fully qualified domain name in the header.
I strongly recommend to enter such instead of just hitting Enter.
Just a hint if someone else stucks with this problem: As mentioned above it is not neccessary to set a root password for mariadb anymore. But if you did (as i did as learned so many years) you need to modify /etc/mysql/debian.cnf (and add your password manually twice) as dpkg just generates a dummy file with no password and so dbconfig-common fails as it is not able to create a new database. This happens when you later try to install roundcube.