What’s new in the Buster guide?

I try to keep as many parts of the setup as in previous guides. Many of us are happy with their mail servers and want to change as little as possible. After all email is a boring matter anyway and we do our jobs best if our users don’t even realize that we are there.

A few things though that are new in this version of the ISPmail guide:

• Better security against cryptographic hacks and brute force attacks. E.g. older TLS protocols are explicitly disabled.
• Newer software versions – it is a new Debian release after all. There are no breaking changes though – mainly bugfixes and security enhancements. Just business as usual.
• Server-side maildir encryption. Your users can now have their emails encrypted while stored on the server. However if they lose their password they cannot decrypt their emails any more. This is optional. (A guest column from Eelke Smit.)
• Ham/spam learning of emails by rspamd was previously stored in one global database. This has lead to bad detection rates in some cases because every users could affect the detection of spam emails for any other user on the server. Now the users train rspamd only for their own emails.
• Users are encouraged to use the submission port (TCP port 587) instead of the SMTP port (TCP port 25) to send their emails.
• Finally this guide added support for quotas. I had announced it for the Debian Stretch guide already but never found the time to implement it. Sorry about that. Now it’s there.
• phpmyadmin did not make it into Debian Buster. In this guide I will endorse a lightweight alternative called Adminer.
• A working Ansible playbook again if you have worked through this guide but don’t want to repeat all the steps if you want to set up multiple servers. (Not yet ready.)
• fail2ban is now using the new nftables firewall rules.
• The guide explains auto-configuration to help your users set up their mail clients.