Your server should now be booted up and ready. So you can login at the console or via SSH (secure shell). By default the server will not allow logging in as “root” for security reasons. Use the “johndoe” user (or whatever you named it) to login.
To become root and be able to install software packages run…
su -
…and enter the root password. If in the future you prefer to login as root via SSH then create a /root/.ssh directory and put your public key (usually found in ~/.ssh/id_rsa.pub) into /root/.ssh/authorized_keys on the server.
Unless you just installed the server it is a good idea to install all missing updates first:
apt update apt upgrade
Packages
Let us install the necessary Debian packages to make it an actual mail server. You will install:
- mariadb-server
The MySQL server that will store information about your email accounts and domains. In previous versions this package was called “mysql-server”. MariaDB is a fork of MySQL which was bought by SUN Microsystems which was later bought again by Oracle. Its original developer Monty was not happy with Oracle and thus maintained the software under the new name MariaDB. Maria and My are names of his children. So basically MariaDB is what you knew as MySQL. MySQL is still available directly from Oracle. But to be honest I don’t trust a commercial database maker with sponsoring a competing open-source product. - postfix
The MTA (mail transport agent) that speaks SMTP and receives and sends emails. - postfix-mysql
An extension that allows Postfix to get its information from a MySQL database. - dovecot-mysql
The IMAP/POP3 mail server including an extension to get its information from a MySQL database. - dovecot-pop3d
An extension to Dovecot that allows users to fetch emails using the POP3 protocol. (This is optional. Only few users if any will use POP3.) - dovecot-imapd
An extension to Dovecot that allows users to access emails using the IMAP protocol. - dovecot-lmtpd
Enables Dovecot to receive LMTP connections. We will need it later to allow email communication between Postfix and Dovecot. - dovecot-managesieved
An extension to Dovecot that allows users to define filter rules that are automatically run on the server when a new email arrives. - apache2 and php7.0
The web server that powers the webmail interface. PHP is the scripting language that the Roundcube webmail software is written in. - phpmyadmin
A web interface to manage your MySQL database. - rspamd
A third-party software that deals with spam and malware and handles automatic domain key signing. - sophos (optional)
This is the only non-open-source software on this list. May be useful if you have Wind*ws clients and want to protect them from malware like viruses, trojans, worms and other nasty pieces of software. Naturally I would recommend ClamAV – an open-source antivirus software. But in real life its detection rate is ridiculously low. ClamAV’s detection rate has been 10%-20% in tests while Sophos found close to 100% of the test samples. (If I am doing anything wrong – please let me know in the comments.) And Sophos currently offers a free-beer version for Linux servers. Don’t let that fool you though. No virus scanner will protect you from a targeted attack against your organisation. But it will probably filter out most of the usual flood of evil attachments that your users may accidentally open. - pwgen
A tool to create random passwords. - roundcube
A PHP-based webmail software. (Optional.) - roundcube-plugins and roundcube-plugins-extra
Extra plugins that add functionality to Roundcube. (Optional.) - swaks
The SWiss Army Knife of Smtp. A utility to send emails through SMTP for testing purposes. - mutt
A console-based program that can speak IMAP and also read Maildirs directly. Very helpful for testing the functionality of your mail server. - certbot
A tool that talks to the LetsEncrypt certificate service to create and renew certificates. - ca-certificates
A set of certificates from common certificate authorities on the internet. It is required for the proper function of wget for example.
MySQL server
Let’s start with the pwgen utility. It helps you create secure passwords:
apt install pwgen
Create a password to be used for the administrative access to the MySQL in the next step:
pwgen -s 20 1
You will get a random string like “W2EzNUFJzjEmA8tQT7A0”. Copy it into your clipboard (e.g. by selecting it with your mouse).
Next install the MySQL server package:
apt install mariadb-server
The MariaDB (MySQL) server is installed. As opposed to the previous MySQL packages in previous Debian distributions MariaDB will not ask for a password for the database administrator (also called “root”). Instead you will be able to manage all databases by just running “mysql” in your shell when you are logged in as “root”.
If all went well you can now run “mysql” and get a connection to your MySQL database:
Exit the MySQL shell with “exit” or just press CTRL-D.
Postfix
Now on to the Postfix packages:
apt install postfix postfix-mysql
When you get asked for the mail server configuration type please choose “Internet site”. Enter your own mail server name (the fully qualified domain name) or just press enter. The host name and domain does not need to match any of your email domains.
Apache and PHP
To provide a webmail service you need the Apache web server software and the PHP scripting language support:
apt install apache2 php7.0
rspamd
Our new way to deal with spam is using rspamd. Previous tutorials used either AMaViS or SpamAssassin directly. Setting up AMaViS was a pain. And SpamAssassin was nice but lacked a few features and was relatively slow which caused problems on mail servers with large volumes of incoming emails.
rspamd is relatively new and not yet very widespread. When Debian Stretch was released it was not yet included. The next Debian release will include it. But at least the rspamd project provides an APT repository for us. We just need to add it. As APT repositories are cryptographically signed you first need to add the PGP key:
wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
Then create a new APT repository definition in /etc/apt/sources.list.d/rspamd.list:
echo "deb http://rspamd.com/apt-stable/ stretch main" > /etc/apt/sources.list.d/rspamd.list
Get the list of packages from that new repository:
apt update
Now you can install rspamd:
apt install rspamd
swaks
A very useful tool to test email delivery later is SWAKS (the SWiss Army Knife for Smtp):
apt install swaks
Dovecot
In addition to Postfix (that handles SMTP communication) you will need Dovecot to store received emails and allow IMAP (and optionally POP3) access for your users:
apt install dovecot-mysql dovecot-pop3d dovecot-imapd dovecot-managesieved dovecot-lmtpd
Roundcube
If you intend to offer a webmail service I can recommend the Roundcube package. The Installation is easy:
apt install roundcube roundcube-plugins roundcube-plugins-extra php-net-sieve
Roundcube also creates a small MySQL database to store its management information. So you will be asked whether that database should be configured automatically for you:
Answer “yes”.
Next it will create a non-admin MySQL user with just access to that new database. The password of that user does not matter so just press “Enter”:
Now all required packages are installed. They are not configured though. That is what we will deal with on the next pages.
ca-certificates
To avoid errors when downloading files using wget you should install the default set of certificates of common certificate authorities on the internet:
apt install ca-certificates
Hi just a small note – as in the next step you need working Apache installed maybe there could be a mention of that somewhere on this page?
So right. I missed the Apache installation part. Will add that right away. Thanks.
Is it really a good idea to install Roundcube from the repository rather than manually from the website?
On Jessie they pretty much abandoned this package and it was never really updated.
I switched after a while and installed it “by hand”…
If there is a package in the Debian repositories I strongly recommend to use that. Unless you have certain needs and don’t mind the hassle. Be aware that packages in Debian stable will give you years of security support out of the box. Check out https://packages.debian.org/roundcube to see which versions ship with each Debian release. And as you can see on https://tracker.debian.org/pkg/roundcube there have been security updates already that you may have missed if you installed Roundcube manually.
Hi. Is it possible to write how to configure sophos? It sounds interesting. Thanks for the nice guide, by the way:)
Yes, I’m currently working on the section about virus scanning using ClamAV and Sophos. I have Sophos-based scanning in production for a company and it works well. Besides it’s free (beer). Will have that online in the next days.
Hello, do you have ever test Avast for Linux ?
mariadb-server vs. MySQL – if I have a server already setup with MySQL, can I leave it installed and use that instead of maria? This will be a fresh install of postfix, dovecot, etc…, (I know this tutorial is geared to a fresh install, but I’ve already several working websites that rely on MySQL). I may, at a later time when I have more time, convert over to Maria, but if they are so vastly different I may wait on this tutorial till I can switch over.
If your database server is seperate and “still” runs on MySQL then that’s fine. The communication protocol is binary compatible. You could even use the Oracle MySQL mainline version or Percona’s build.
When you convert to MariaDB later you will need to use “mysqldump” though because data storage is not binary compatible. And my experience with “mysqldump” is very bad. YMMV.
Hi Christoph,
Any opinion or recommendation regarding rainloop webmail, rainloop.net ?
My preference is NGINX, and Roundcube from the package manager has an Apache dependency. So that’s leaning me towards experimenting with webmail rather than installing Roundcube from source (or switching to Apache2).
I’m using Rainloop on nginx with no issues. But Roundcube also works fine too….apache2 is a recommended package, not a dependency. It’s actually “apache2 | lighttpd | spawn-fcgi | php-fpm | httpd-cgi”, so if you use php-fpm with nginx, it won’t try to install apache2.
Hi Christoph,
You pasted from the Jessie tuto some lines about pwgen, but if for Mariadb the server root acount and the DBA Mariadb root are the same (is that a good thing ?) no need at this stape for pwgen ?
And in the Jessie tuto you suggested to remove the default exim package. Is it not necessary in Stretch ?
Exim is an equivalent to Postfix, you can’t have the same on your server.
The installation of mutt should be mentioned in the fine grained explanations too, shouldn’t it?
Indeed. Enough people seem to be having problems with it. I tried a simple “apt install mutt” but it doesn’t pick up the mail server settings at all, in spite of my having worked through all the previous steps and getting all the correct responses from the tests up to the section on testing IMAP – which uses mutt. The assumption that other users will pick up on errors and omissions to help out looks somewhat optimistic. It’s now 18 months since your post, Axel.
I’m confused. It’s described at https://workaround.org/ispmail/stretch/testing-email-delivery – please tell me what confuses you.
Hi Christoph,
do you already know when the part with ClamAV and Sophos will be available ?
Regards
Hampe
Hi Christoph,
when intenting to download the rspamd pgp.key I had a wget alert :
# wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add
–2018-03-04 15:13:31– https://rspamd.com/apt-stable/gpg.key
Resolving rspamd.com (rspamd.com)… 88.99.142.95
Connecting to rspamd.com (rspamd.com)|88.99.142.95|:443… connected.
ERROR: The certificate of ‘rspamd.com’ is not trusted.
ERROR: The certificate of ‘rspamd.com’ hasn’t got a known issuer.
gpg: no valid OpenPGP data found.
As I was in some hurry I used the –no-check-certificate wget option :
# wget –no-check-certificate -O- https://rspamd.com/apt-stable/gpg.key | apt-key add
–2018-03-04 15:21:31– https://rspamd.com/apt-stable/gpg.key
Resolving rspamd.com (rspamd.com)… 88.99.142.95
Connecting to rspamd.com (rspamd.com)|88.99.142.95|:443… connected.
WARNING: The certificate of ‘rspamd.com’ is not trusted.
WARNING: The certificate of ‘rspamd.com’ hasn’t got a known issuer.
HTTP request sent, awaiting response… 200 OK
Length: 3122 (3.0K) [text/plain]
Saving to: ‘STDOUT’
– 100%[=====================================================================================>] 3.05K –.-KB/s in 0s
2018-03-04 15:21:31 (67.3 MB/s) – written to stdout [3122/3122]
OK
It seems a problem with let’s Encrypt certificate and the wget trusted CA certificates.
I see that the ca-certificates package was not installed, I thought it was by default with wget. Maybe you should had this tip on your page, “apt-get install ca-certificate” before the wget download to avoid this disagreement.
That’s right. Just added it to /ispmail/stretch/install-software-packages
But you haven’t responded to the person who asked where the mutt installation has gone. Is it simply a matter of “apt install mutt” or are there other parts or modules?
Dear Mr. Haas,
Can I suggest running the mysql_secure_installation command after installing either Mariadb or MySQL? This will get rid of some of the possible security issues like the test database and root access from anywhere: https://mariadb.com/kb/en/library/mysql_secure_installation/. It will also let you re-set the root password for the database if necessary.
Regards
Dietbrand
Hi Christoph,
thank you for this tutorial.
Just some notes about running all the described procedure under ubuntu 18.04.
At the moment it seems that rspamd installation procedure doesn’t works as described. I’ve found a working solution on the rspamd home page (https://rspamd.com/downloads.html) under the “experimental” branch under “Debian/Ubuntu” tab.
The second note is about the webserver used jointly with roundcube; I’ve seen nginx often taking place of apache2 and on many systems nginx is installed by default.
apt installs roundcube with apache2 as default and I don’t found any workaround to avoid this double webserver.
About this last point, any clue is welcome.
Regards,
Francesco
I just discovered that currently rspamd does not support Debian.
Well, you discovered wrong. Click the “Debian” button on their downloads page – they don’t support the version in the Debian repositories, but they provide their own, which is used in this section.
Hi, anyone has an “already build” repository for rspamd x86?
The official repository does not support anymore the old x86 (32bit) version but only x86_64 like explained here:
https://groups.google.com/forum/m/#!topic/rspamd/RVHH4gbLZr0
The only way is to build it and, if exist, I prefer to use a ready repository.
Thanks
Hi Christoph, thank you for your great tutorials.
I have a question about rspamd for x86 (32bit) platforms.
At the moment, rspamd is no more available for this platforms as reported here:
https://groups.google.com/forum/#!topic/rspamd/RVHH4gbLZr0
As you know (or any other know), exist a repository with a ready 32bit builds for Debian Stretch so we can avoid the building procedure?
Thank you
Hi Christoph,
I see now that the comments must be validate by you.
You can see 2 my posts about the same request (32bit rspamd repository).
please delete one of them.
Thank you
Hmm, this latest message has been posted and not my previous 2.
I’ll try to post it again here modifying the URL address, maybe this is the problem.
My question regards the rspamd 32bit version.
From what I read in this post, the 32bit version is no more available (I have changed tt with xx into the url).
hxxps://groups.google.com/forum/#!topic/rspamd/RVHH4gbLZr0
As you know (or other members know), exist a rspamd 32bit repository ready to be used?
If not, the only way is to build it as explained in the post.
Thank you
Ciao Enrico, same problem here. Seems that the only way is to build it – I swear I’ve tried -, but it is out of my very limited turf… So my server is running without it, and I miss rspamd handling DKIM (and I couldn’t configured opendkim either, even when it was running ok in my previous Jessie setup).
Hi Martin,
I’ll try to build it and I’ll give a feedback when ready with the instructions.
Obviously, if anyone has a ready repository is welcome 🙂
Hi again Martin, I have successfully build rspamd 32 bit following this instructions.
https://rspamd.com/downloads.html
(latest tab on the right Build rspamd)
I used a virtual machine with the Debian x86 stretch to build it.
The “make install” work properly but I have some problems with the distribution package version.
I’ll write again when solved 🙂
Hi again Martin, I have successfully build rspamd 32 bit following this instructions.
hxxps://rspamd.com/downloads.html
(Click on the right tab “Build rspamd”)
I used a virtual machine with the Debian x86 stretch to build it.
The “make install” work properly and rspamd run correctly, but I have some problems with the distribution package version.
I’ll write again when solved 🙂
Caro Enrico, I followed the instructions, and somehow I’ve managed to build the rspamd package for the 32 bit version. I’ve just installed it, tomorrow I’ll try to configure it according to Christoph’s tutorial. Feedback will follow. Grazie mille!
Ciao Martin! I’m very happy.
Let us know if rspamd work well in your system 😀
Well, finally (as far as it goes) rspamd is working ok in my server. Thank you Enrico for encouraging me to face the problem :), (and a huge danke schön to Christoph also).
Hi Christoph, just a quick question.
It’s safe to upgrade from PHP7.0 to PHP7.2 or there are some issues?
Thank you
I would not expect any problems. But there is no PHP7.2 in Debian Stretch/Stable. PHP is a security risk anyway… I wouldn’t want to use a version that is not covered by daily security updates.
By following the installation of Roundcube from the tutorial I ended with a slightly old version of Roundcube, I would recommend to install Roundcube by downloading the latest build on their website and following the installation instructions from there.
During Roundcube installation step you might encounter an error due to root database access with no password; this because you changed default plugin access method on mariadb user table, perhaps for security reasons, and no more “mysql -u root” login are allowed. You can get rid of this error modifying your /etc/mysql/debian.cnf specifying (twice) current mysql root password.
rspamd wget command kept giving me an “Cannot write to ‘-‘ (Broken pipe)” error but the following command worked for me:
sudo wget -O- ‘https://rspamd.com/apt-stable/gpg.key’ | sudo apt-key add