After the basic installation your server will reboot and allow you to login. You can either login at the console (if you have physical access to the system) or using SSH (secure shell).
Unless you just installed the server it is a good idea to install all missing updates first:
apt update apt upgrade
Packages
Let us install the necessary Debian packages to make it an actual mail server. You will install:
- mariadb-server
The MySQL server that will store information about your email accounts and domains. In previous versions this package was called “mysql-server”. MySQL was bought by SUN Microsystems which was later bought again by Oracle. Its original developer Monty was not happy with Oracle and thus maintained the software under the new name MariaDB. (Maria and My are the names of Monty’s children.) So basically MariaDB is a fork of MySQL. Both pieces of software started to evolve in slightly different directions. However Linux distributions decided to go with the most open-sourcy way thus choosing MariaDB. So basically MariaDB is what you knew as MySQL. The “other” MySQL is available directly from Oracle. I just wonder how much I trust a commercial database maker with sponsoring a competing open-source product. - postfix
The MTA (mail transport agent) that speaks SMTP and receives and sends emails. - postfix-mysql
An extension that allows Postfix to get its information from a MySQL database. (Yes, it’s compatible to MariaDB.) - dovecot-mysql
The IMAP/POP3 mail server including an extension to query information from a MariaDB database. - dovecot-pop3d
An extension to Dovecot that allows users to fetch emails using the POP3 protocol. (This is optional. Only few users nowadays use POP3.) - dovecot-imapd
An extension to Dovecot that allows users to access emails using the IMAP protocol. - dovecot-lmtpd
Enables Dovecot to receive LMTP connections. We will need it later to make Postfix send emails to Dovecot for storage. - dovecot-managesieved
An extension to Dovecot that allows users to define filter rules that are automatically run on the server when a new email arrives. - apache2 and php7.0
The web server that powers the webmail interface. PHP is the scripting language that the Roundcube webmail software is written in. - adminer
A web interface to manage your SQL database. - rspamd
A third-party software that deals with spam and malware and handles automatic domain key signing. - pwgen
A tool to create random passwords. - swaks
The SWiss Army Knife of Smtp. A utility to send emails through SMTP for testing purposes. - mutt
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the functionality of your mail server. - certbot
A tool that talks to the LetsEncrypt certificate service to create and renew certificates. - ca-certificates
A set of certificates from common certificate authorities on the internet. It is required for the proper function of wget for example. - fail2ban
A daemon that tracks log files to determine brute force attacks. It can block IP addresses of attackers. We will use it to defend against evil people trying to get into your mail server.
pwgen
Let’s start with the pwgen utility. It helps you create secure passwords. Unless you already have a tool for that…
apt install pwgen
You will need a random passwords later to create a database user for the mail server. Just as an example: to create a secure password having a length of 20 characters you would run:
pwgen -s 20 1
That gets you a string like “W2EzNUFJzjEmA8tQT7A0”.
MariaDB server
If you used MySQL before you may remember that you were forced to specify a password for the ‘root’ database user. That has changed with MariaDB in Debian – for the better. Now you can access the database server without any password if you are logged in as ‘root’ on the server. You might as well set a password but it is not necessary.
Go install the MariaDB server package:
apt install mariadb-server
If all went well you can now run “mysql” and get a connection to your MySQL database:
root@buster:~# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 30 Server version: 10.3.18-MariaDB-0+deb10u1 Debian 10 Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]>
Exit the SQL shell by typing “exit” or press CTRL-D.
Postfix
Now on to the Postfix packages:
apt install postfix postfix-mysql
When you get asked for the mail server configuration type please choose “Internet site”. Enter your own mail server name (the fully qualified domain name) or just press enter. The host name and domain does not need to match any of your email domains.
Apache and PHP
To provide a webmail service you need the Apache web server software and the PHP scripting language support:
apt install apache2 php7.3
rspamd
Just like in the Stretch guide we will deal with spam using rspamd. Since Debian Buster the software is included as a software package. So installing is as simple as:
apt install rspamd
swaks
A very useful tool to test email delivery later is SWAKS (the SWiss Army Knife for Smtp):
apt install swaks
mutt
This is a full-featured IMAP mail client. Think of it as a console-based Thunderbird. It cannot display HTML but it is very helpful to test IMAP mail servers. And some hardcore users still prefer it over any other mail client. Think of it as the vi of mail clients.
apt install mutt
certbot (LetsEncrypt)
You will want to use encrypted connections where possible. So you need a certificate for your services. The certbot software allows you to request and manage that certificate automatically.
apt install certbot
Dovecot
In addition to Postfix (that handles SMTP communication) you will need Dovecot to store received emails and provide IMAP (and optionally POP3) access for your users:
apt install dovecot-mysql dovecot-pop3d dovecot-imapd dovecot-managesieved dovecot-lmtpd
Adminer (replaces phpmyadmin)
SQL databases are called like that because SQL (structured query language) is the way you talk to it. But as we are just puny humans let’s have a more user-friendly interface to manage the database. Formerly I recommended phpmyadmin. But unfortunately it was excluded from the Debian Buster release.
So I looked around and found Adminer to be a lightweight, secure and featureful replacement.
apt install adminer
ca-certificates
To avoid errors when downloading files using wget you should install the default set of certificates of common certificate authorities on the internet:
apt install ca-certificates
Hey Christoph,
rspamd is also in buster-backports. It’s version 1.9.4, a bit newer then the buster package. When it comes to foreign archives I agree with you. But do you see a problem when it comes to using the backports package?
Also I want to know if you could add the information about mysql_secure_installation?
I think it is mandatory to do this before the first use of mysql.
That’s a good question. I tried to research it. It seems that security issues are fixed by backporting newer versions which might lead to breaking changes in configurations as I discussed earlier. Also I’m not sure how large the backports team is and whether they understand each package well enough to apply security fixes. It might be worth using the newer package if it offers an actual benefit. If it’s just for the sake of the version number I probably wouldn’t risk it.
Hi Christoph,
thank you very much for sharing your job.
Some questions about the choice of the packages: Have you ever considered to use a “small footprint” version of your guide using sqlite and Lighttpd, Cherokee or Hiawatha (as stated on compatibility list)? This may be a nice choice to run the solution on a low performances VM or small community server.
Hi Francesco… that’s a pretty neat idea indeed. Although a small VM should easily cope with the needs of a friends&family mail server. 1 GB might be enough. However I can imagine to tune it down even more and maybe fit it into 256 MB. I would even put a mail server on a solar powered Raspi Zero. 🙂 The problem is merely the disk storage that you inevitably need to store the emails. With a 400 GB Micro SD card and a Raspi Zero W in a case and a power supply it would be below 100€. Put it in a nice acrylic case in the living room and show everyone your mail server. 🙂
Again thanks for an excellent tutorial!
A fairly minor point: in the list of packages, it reads “apache2 and php7.0”, but further below it correctly gives the PHP version as 7.3 for Buster.
Slightly more important, the installation recommendation for PHP:
> apt install apache2 php7.3
I would recommend using the “php” metapackage instead, without version number. Otherwise, when upgrading this server at a later point, PHP won’t be automatically upgraded to a newer version. A trap I’ve fallen for repeatedly when I upgraded Debian servers (I know you don’t recommend upgrading live systems, but it worked very well for me in the past, including systems using this ISP style mailserver tutorial). Generally it makes more sense to use a broader metapackage rather than give a specific version number, when there’s no conflicting packages for a specific Debian version anyway.
In conclusion, I’d recommend:
> apt install apache2 php
(There doesn’t seem to be an “apache” metapackage, otherwise the same would obviously apply 😉 )
Regarding your claim that Apache “is still more common”, it’s only by a very small margin. If it weren’t for Cloudfare, Nginx would probably have overtaken Apache already. See https://w3techs.com/technologies/history_overview/web_server/ms/q .
Regarding your choice of mysql/mariadb, I wish this manual weren’t so opinionated. Some of us have also chosen Postfix and Dovecot (but not Apache) but don’t need to set up for an email user base of 15 or less, so having a database involved seems like overkill.
I completely understand that you wished for more choice in regard of the components. But to make the guide less opinionated I would have to offer several pieces of software and test them all. I hardly manage to update the guide the way it is. Personally I prefer PostgreSQL and Nginx. But previous guides recommended Apache and MySQL because more people are familiar with it. I will happily change that if another piece of software does a better job. But in the context of this guide I do not see any clear advantage of Nginx.
Going without a database does not work well. A mapping file may work for Postfix but not for Dovecot. But you could use SQLite instead of MariaDB I suppose.
In the list of packages:
> apache2 and php7.0
should be php7.3