I managed to introduce quite a few improvements that make this tutorial better than any previous issue:
- Clearer explanations. More diagrams and screenshots. More side notes and links to deepen your knowledge.
- A newer Roundcube version. The webmail software has been upgraded from version 0.9 to the prettier version 1.1. Debian Jessie officially does not include Roundcube because its package maintainers did not manage to come up with decent packages when the release deadline was approaching. But fortunately the jessie-backports repository provides fresh Roundcube packages – so we can use them.
- Way more secure passwords. Dovecot handles the authentication for us. In all previous tutorials that used Dovecot I used unsalted MD5 hashes for the user passwords. That is admittely a very weak way to store passwords. Should someone accidentally get access to your encrypted passwords it would be rather simple to reverse-compute the plaintext passwords from that. Previous tutorials kept using MD5 though so that upgrades would not break anything for your existing users. From now on the new hashing method is salted SHA256 which is almost impossible to crack today. However existing users can still use their old MD5-hashed passwords. Once they change their passwords they will automatically get an SHA256 hash. Your users will not even notice that.
- Spam handling improved a lot. Previously I fully relied on real-time blacklists (RBL). So if a sending mail server on the internet would have been listed all email from them would have been rejected. It turned out that blacklists are often maintained automatically so it may accidentally happen that a legit mail server gets listed and thus blocked. Your users won’t be happy at all about it no matter how often you tell them about spam fighting. So this tutorial relies on SpamAssassin to query multiple blacklists (besides a lot of other checks) to determine if an email is spam. But even if it is definitely spam it will be delivered to the user – but into their Junk folder. And we will automatically subscribe them to their Junk folder so they will notice spam emails easily. Your users will never bother you again to track lost emails while you still have a much better spam detection rate than before.
- No greylisting. Spammers nowadays seem to be too smart to fall for greylisting. Greylisting delays incoming email but hardly has any effect on spam rejection. So I decided to leave it out. Besides users appreciate if they get their email as quickly as possible. Most of them will not be happy if they need to wait several minutes for a new email.
- Your users can finally change their own email password. Roundcube provides a password plugin that is integrated into the webmail interface that can do the change in the database.
- Communication between Postfix and Dovecot is now using the LMTP protocol instead of the LDA (local delivery agent). This increases delivery performance, uses less system resources and can handle emails with multiple recipients at one go.
- For experienced users I provide an Ansible playbook that helps you set up a mail server within minutes. But please work through this tutorial patiently before trying the playbook. It is intended for advanced system administrators who aim to set up new mail servers frequently.