Your server should now be booted up and ready. So you can login at the console or via SSH (secure shell). By default the server will not allow logging in as “root” for security reasons. Use the “johndoe” user (or whatever you named it) to login.
To become root and be able to install software packages run…
…and enter the root password. If in the future you prefer to login as root via SSH then create a /root/.ssh directory and put your public key (usually found in ~/.ssh/id_rsa.pub) into /root/.ssh/authorized_keys on the server.
Unless you just installed the server it is a good idea to install all missing updates first:
apt update apt upgrade
Let us install the necessary Debian packages to make it an actual mail server. You will install:
The MySQL server that will store information about your email accounts and domains. In previous versions this package was called “mysql-server”. MariaDB is a fork of MySQL which was bought by SUN Microsystems which was later bought again by Oracle. Its original developer Monty was not happy with Oracle and thus maintained the software under the new name MariaDB. Maria and My are names of his children. So basically MariaDB is what you knew as MySQL. MySQL is still available directly from Oracle. But to be honest I don’t trust a commercial database maker with sponsoring a competing open-source product.
The MTA (mail transport agent) that speaks SMTP and receives and sends emails.
An extension that allows Postfix to get its information from a MySQL database.
The IMAP/POP3 mail server including an extension to get its information from a MySQL database.
An extension to Dovecot that allows users to fetch emails using the POP3 protocol. (This is optional. Only few users if any will use POP3.)
An extension to Dovecot that allows users to access emails using the IMAP protocol.
Enables Dovecot to receive LMTP connections. We will need it later to allow email communication between Postfix and Dovecot.
An extension to Dovecot that allows users to define filter rules that are automatically run on the server when a new email arrives.
- apache2 and php7.0
The web server that powers the webmail interface. PHP is the scripting language that the Roundcube webmail software is written in.
A web interface to manage your MySQL database.
A third-party software that deals with spam and malware and handles automatic domain key signing.
- sophos (optional)
This is the only non-open-source software on this list. May be useful if you have Wind*ws clients and want to protect them from malware like viruses, trojans, worms and other nasty pieces of software. Naturally I would recommend ClamAV – an open-source antivirus software. But in real life its detection rate is ridiculously low. ClamAV’s detection rate has been 10%-20% in tests while Sophos found close to 100% of the test samples. (If I am doing anything wrong – please let me know in the comments.) And Sophos currently offers a free-beer version for Linux servers. Don’t let that fool you though. No virus scanner will protect you from a targeted attack against your organisation. But it will probably filter out most of the usual flood of evil attachments that your users may accidentally open.
A tool to create random passwords.
A PHP-based webmail software. (Optional.)
- roundcube-plugins and roundcube-plugins-extra
Extra plugins that add functionality to Roundcube. (Optional.)
The SWiss Army Knife of Smtp. A utility to send emails through SMTP for testing purposes.
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the functionality of your mail server.
A tool that talks to the LetsEncrypt certificate service to create and renew certificates.
A set of certificates from common certificate authorities on the internet. It is required for the proper function of wget for example.
Let’s start with the pwgen utility. It helps you create secure passwords:
apt install pwgen
Create a password to be used for the administrative access to the MySQL in the next step:
pwgen -s 20 1
You will get a random string like “W2EzNUFJzjEmA8tQT7A0”. Copy it into your clipboard (e.g. by selecting it with your mouse).
Next install the MySQL server package:
apt install mariadb-server
The MariaDB (MySQL) server is installed. As opposed to the previous MySQL packages in previous Debian distributions MariaDB will not ask for a password for the database administrator (also called “root”). Instead you will be able to manage all databases by just running “mysql” in your shell when you are logged in as “root”.
If all went well you can now run “mysql” and get a connection to your MySQL database:
Exit the MySQL shell with “exit” or just press CTRL-D.
Now on to the Postfix packages:
apt install postfix postfix-mysql
When you get asked for the mail server configuration type please choose “Internet site”. Enter your own mail server name (the fully qualified domain name) or just press enter. The host name and domain does not need to match any of your email domains.
Apache and PHP
To provide a webmail service you need the Apache web server software and the PHP scripting language support:
apt install apache2 php7.0
Our new way to deal with spam is using rspamd. Previous tutorials used either AMaViS or SpamAssassin directly. Setting up AMaViS was a pain. And SpamAssassin was nice but lacked a few features and was relatively slow which caused problems on mail servers with large volumes of incoming emails.
rspamd is relatively new and not yet very widespread. When Debian Stretch was released it was not yet included. The next Debian release will include it. But at least the rspamd project provides an APT repository for us. We just need to add it. As APT repositories are cryptographically signed you first need to add the PGP key:
wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
Then create a new APT repository definition in /etc/apt/sources.list.d/rspamd.list:
echo "deb http://rspamd.com/apt-stable/ stretch main" > /etc/apt/sources.list.d/rspamd.list
Get the list of packages from that new repository:
Now you can install rspamd:
apt install rspamd
A very useful tool to test email delivery later is SWAKS (the SWiss Army Knife for Smtp):
apt install swaks
In addition to Postfix (that handles SMTP communication) you will need Dovecot to store received emails and allow IMAP (and optionally POP3) access for your users:
apt install dovecot-mysql dovecot-pop3d dovecot-imapd dovecot-managesieved dovecot-lmtpd
If you intend to offer a webmail service I can recommend the Roundcube package. The Installation is easy:
apt install roundcube roundcube-plugins roundcube-plugins-extra php-net-sieve
Roundcube also creates a small MySQL database to store its management information. So you will be asked whether that database should be configured automatically for you:
Next it will create a non-admin MySQL user with just access to that new database. The password of that user does not matter so just press “Enter”:
Now all required packages are installed. They are not configured though. That is what we will deal with on the next pages.
To avoid errors when downloading files using wget you should install the default set of certificates of common certificate authorities on the internet:
apt install ca-certificates