Mail Servers

Update and upgrade:

apt-get update apt-get upgrade

Add user:

adduser username

Change /etc/hostname:

hostname servername Vi /etc/hostname Vi /etc/hosts

127.0.0.1   localhost
127.0.1.1   domainName

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Create SSL cert:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-mail.key -out /etc/ssl/certs/ssl-mail.pem

Install packages:

apt-get install postfix postfix-policyd-spf-python postfix-pcre dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd opendkim opendkim-tools

Select internet site

Enter the domain name of the server

Postfix

Use this for /etc/postfix/master.cf

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv chroot  wakeup maxproc command + args
#               (yes) (yes) (no)    (never) (100)
# ==========================================================================
smtp      inet n     - y   - - smtpd
#smtp      inet n   - y   - 1 postscreen
#smtpd     pass -   - y   - - smtpd
#dnsblog   unix -   - y   - 0 dnsblog
#tlsproxy  unix -   - y   - 0 tlsproxy
submission inet n       - y - -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_wrappermode=no
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
#smtps     inet n   - y   - - smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet n   - y   - - qmqpd
pickup    unix n     - y   60 1 pickup
cleanup   unix n     - y   - 0 cleanup
qmgr      unix n     - n   300 1 qmgr
#qmgr     unix n     - n   300 1 oqmgr
tlsmgr    unix -     - y   1000? 1 tlsmgr
rewrite   unix -     - y   - - trivial-rewrite
bounce    unix -     - y   - 0 bounce
defer     unix -     - y   - 0 bounce
trace     unix -     - y   - 0 bounce
verify    unix -     - y   - 1 verify
flush     unix n     - y   1000? 0 flush
proxymap  unix -     - n   - - proxymap
proxywrite unix -       - n - 1       proxymap
smtp      unix -     - y   - - smtp
relay     unix -     - y   - - smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix n     - y   - - showq
error     unix -     - y   - - error
retry     unix -     - y   - - error
discard   unix -     - y   - - discard
local     unix -     n n   - - local
virtual   unix -     n n   - - virtual
lmtp      unix -     - y   - - lmtp
anvil     unix -     - y   - 1 anvil
scache    unix -     - y   - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix -     n n   - - pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix -   n n   - - pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix  - n n       - - pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix -     n n   - - pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix -     n n   - - pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix -     n n   - - pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -   n   n   -   2   pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix -     n n   - - pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

policyd-spf  unix - n       n - 0   spawn

user=policyd-spf argv=/usr/bin/policyd-spf

Use this for /etc/postfix/main.cf, replacing the highlighted values

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-mail.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination,
    check_policy_service unix:private/policyd-spf

# Milter configuration
# OpenDKIM
milter_default_action = accept
# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
milter_protocol = 6
smtpd_milters = local:/opendkim/opendkim.sock
non_smtpd_milters = local:/opendkim/opendkim.sock

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

#startNew
smtp_use_tls = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_auth_only = yes
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
tls_random_source = dev:/dev/urandom
#End new

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.domainName
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, mail.domainName, domainName, localhost.localdomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 ipAddrsForAnyServersUsingThisForMail
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all

local_recipient_maps = proxy:unix:passwd.byname $alias_maps

policyd-spf_time_limit = 3600

Use this for /etc/aliases

See man 5 aliases for format

mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
no-reply: root
security: root
service-reply: root
server-reply: root
sms: root
# Add any email addresses you want here
# ie username -> username@domainName

Dovecot

Use this for /etc/dovecot/dovecot.conf

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
  driver = passwd
}
passdb {
  args = %s
  driver = pam
}
protocols = " imap"

service auth {
  unix_listener /var/spool/postfix/private/auth {

group = postfix mode = 0660 user = postfix } }

ssl=required
ssl_cert = </etc/ssl/certs/ssl-mail.pem
ssl_key = </etc/ssl/private/ssl-mail.key

Opendkim

Use this for /etc/opendkim.conf

# This is a basic configuration that can easily be adapted to suit a standard
# installation. For more advanced options, see opendkim.conf(5) and/or
# /usr/share/doc/opendkim/examples/opendkim.conf.sample.

# Log to syslog
Syslog          yes
# Required to use local socket with MTAs that access the socket as a non-
# privileged user (e.g. Postfix)
UMask           002
# OpenDKIM user
# Remember to add user postfix to group opendkim
UserID          opendkim

# Map domains in From addresses to keys used to sign messages
KeyTable        /etc/opendkim/KeyTable
SigningTable        refile:/etc/opendkim/SigningTable

# Hosts to ignore when verifying signatures
ExternalIgnoreList  /etc/opendkim/TrustedHosts
InternalHosts       /etc/opendkim/TrustedHosts

# Commonly-used options; the commented-out versions show the defaults.
Canonicalization    relaxed/simple
Mode            sv
SubDomains      no
#ADSPAction     continue
AutoRestart     yes
AutoRestartRate     10/1M
Background      yes
DNSTimeout      5
SignatureAlgorithm  rsa-sha256

# Always oversign From (sign using actual From and a null From to prevent
# malicious signatures header fields (From and/or others) between the signer
# and the verifier.  From is oversigned by default in the Debian package
# because it is often the identity key used by reputation systems and thus
# somewhat security sensitive.
OversignHeaders     From

Set permissions and make directories: 
chmod u=rw,go=r /etc/opendkim.conf
mkdir /etc/opendkim
mkdir /etc/mail
chown -R opendkim:opendkim /etc/opendkim
mkdir /var/log/dkim-filter
touch /var/log/dkim-filter/dkim-stats
chown opendkim:opendkim /var/log/dkim-filter/
chown opendkim:opendkim /var/log/dkim-filter/dkim-stats
echo `hostname` `hostname`.com:mail:/etc/mail/dkim.key >> /etc/opendkim/KeyTable
echo \* `hostname`.com `hostname` >> /etc/opendkim/SigningTable
echo 127.0.0.1 >> /etc/opendkim/TrustedHosts
mkdir /var/spool/postfix/opendkim
chown opendkim:postfix /var/spool/postfix/opendkim

Create dkim keys:
opendkim-genkey -s mail -d `hostname`
mv mail.private dkim.key
mv * /etc/mail/
chown opendkim:opendkim /etc/mail/*
chmod 600 /etc/mail/*

Use this for /etc/default/opendkim

# Command-line options specified here will override the contents of
# /etc/opendkim.conf. See opendkim(8) for a complete list of options.
#DAEMON_OPTS=""
#
# Uncomment to specify an alternate socket
# Note that setting this will override any Socket value in opendkim.conf
# default:
SOCKET="local:/var/spool/postfix/opendkim/opendkim.sock"
# listen on all interfaces on port 54321:
#SOCKET="inet:54321"
# listen on loopback on port 12345:
#SOCKET="inet:12345@localhost"
# listen on 192.0.2.1 on port 12345:
#SOCKET="inet:12345@192.0.2.1"

Update/Restart services:

adduser postfix opendkim newaliases systemctl restart postfix systemctl restart dovecot systemctl restart opendkim

cat /etc/mail/mail.txt to DNS touch /var/log/mail.log touch /var/log/mail.err sudo chmod a+w /var/log/mail* mkdir /var/backup/