Email Service (SMTP,IMAP)
I will describe how to use postfix as MTA and use it locally and on the interet, then DOVECOT for IMAP & POP3
Basically you will do 2 things
Configure a macine as an SMTP server using POSTFIX
Configure IMAP or POP3 for Client Access (Remotly connect)
SMTP Server
Postfix is what's called an MTA or a message transfer agent. That's a server or a daemon that runs a process that supports these simple mail transport protocol, or SMTP communications. So when it comes to email, a lot of us use web-based mail now, so we don't see these protocols at all. That's why people don't even think about these things running. But if you configure an email client, you're normally receiving email by using things like POP3 or IMAP4. But when you send email, email is sent using SMTP. And MTAs or message transfer agents, they receive the email you're sending and then guide it to its destination. So if it needs to go to Gmail or me.com or AOL or whoever it is that you're emailing, it finds the servers and gets it delivered to the right place. So SMTP servers aren't really designed to interact with end users. They're designed to interact with other SMTP servers.
Building an SMTP server with Postfix
Installing the binaries and starting the configuration: sudo DEBIAN_PRIORITY=low apt install postfix
If you want to configure an email server on the internet you don’t want to use the default configuration that comes with sudo apt install postfix which will result to the server being an open relay
An open SMTP relay is a server that allows anyone on the internet to send email through it. This is not a desirable configuration because it can be exploited by spammers to send massive amounts of unsolicited email. If your server is an open relay, it can be added to blacklists and your legitimate email may not be delivered. It's important to properly configure your SMTP server to prevent it from becoming an open relay.
Reconfigure the installation:
sudo dpkg-reconfigure postfix
Postfix Configuration
using it’s config file:
sudo vim /etc/postfix/mainc.cfOr using a command utility:
postconfIf you want to see only overwritten things :
postconf -n
Next thing is Mapping users to email addresses
We need to define a mapping file, by default w don’t have it inside /etc/postfix, I will create it
sudo postconf -e 'virtual_alias_maps= hash:/etc/postfix/maps’
Now it’s gonna now that have a mapping file and i can go and create it
sudo vim /etc/postfix/maps
taqiyeddine@homelab.lan toukI need to tell postfix about it :
sudo postmap /etc/postfix/maps
And it is a good idea to restart the service:
sudo systemctl restart postfix
Now, I have a functional SMTP server and it can accepts emails
Allow it through the firewall?
sudo ufw allow 25/tcp or sudo ufw allow postfix and it will add more needed ports like secure smtp …
SOME CHANGES I HAD TO DO:
I added an MX record for my mail server:
touk@k8snode:/etc/bind$ cat homelab.lan.zone
;
; BIND data file for homelab.lan zone
;
$TTL 604800
@ IN SOA ns1.homelab.lan. admin.homelab.lan. (
5 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS ns1.homelab.lan.
ns1 IN A 192.168.1.9
; -- Add dns records
web IN A 192.168.1.12
centos IN A 192.168.1.16
site1 IN CNAME web
site2 IN CNAME web
server IN A 192.168.1.5
@ IN MX 10 server.homelab.lan.sudo systemctl restart bind9
Changing host-name in /etc/postfix/main.cf
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = homealb.lan
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, homelab.lan, ubuntu-server, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24 172.16.1.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Mail/
virtual_alias_maps = hash:/etc/postfix/mapssudo systemctl restart postfix
One thing else, i have messed with the home_mailbox for postfix, so you shouldn’t do that
just comment it and restart the service and everything will 100% work
sudo vim /etc/postfix/main.cf
#home_mailvbox= Mail/
sudo systemctl restart postfix
I will add another user and check if he can receive mails
As you can see in my sudo cat /etc/postfix/maps
testuser@ubuntu-server:/etc/postfix$ cat /etc/postfix/maps
taqiyeddine@homelab.lan touk
testuser@homelab.lan testusertouk@ubuntu-server:/etc/postfix$ sudo useradd -m -s /bin/bash testuser
touk@ubuntu-server:/etc/postfix$ sudo passwd testuser
New password:
Retype new password:
passwd: password updated successfullyecho “Hello test user” | mail -s 'to testuser' testuser@homelab.lan
and now :
touk@ubuntu-server:/etc/postfix$ su testuser
Password:
testuser@ubuntu-server:/etc/postfix$ mail
"/var/mail/testuser": 2 messages 2 new
>N 1 touk Sat Sep 2 11:28 14/434 to testuserTEST IT via the intrnet:
touk@ubuntu-server:/etc/postfix$ mail -s "this is from postfix" recipo2194@xgh6.com
Cc:
ANOTHER TEEEEST; POSTFIX IS WORKINGGGG
Securing Postfix with TLS
We will use Let’s Encrypt for that!
Let's Encrypt will let you generate a certificate that is publicly trusted, free of charge
sudo apt install certbot
What Certbot is is a little automated utility that will help us generate a trusted certificate. Well, it can spin up a temporary web server on port 80, and Let's Encrypt can use that temporary web server to validate that I am who I say I am, that I control that domain.
sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d server.homelab.lan
Make sure to point the record for your smtp server like i am doing in my bind9 server:
touk@k8snode:/etc/bind$ sudo dig server.homelab.lan
; <<>> DiG 9.16.1-Ubuntu <<>> server.homelab.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4260
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 1d332c4ffc55f0d90100000064f30800fad0cd29d4c4147f (good)
;; QUESTION SECTION:
;server.homelab.lan. IN A
;; ANSWER SECTION:
server.homelab.lan. 604800 IN A 192.168.1.5
;; Query time: 0 msec
;; SERVER: 192.168.1.9#53(192.168.1.9)
;; WHEN: Sat Sep 02 03:01:36 PDT 2023
;; MSG SIZE rcvd: 91Once that done it will create a trusted cert for you
For me i dont have these certs, because my domain is not registered
Or you can do this lol:
register a free domain in No-IP AND then point it to the public ip of your home router and do port forwarding to the smtp server
touk@ubuntu-server:/etc/postfix$ sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d serversmtp.servehttp.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for serversmtp.servehttp.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/serversmtp.servehttp.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/serversmtp.servehttp.com/privkey.pem
This certificate expires on 2023-12-01.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: <https://letsencrypt.org/donate>
* Donating to EFF: <https://eff.org/donate-le>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -View the current values postconf | grep 'smtpd_tls_cert\\|smtpd_tls_key'
Update the values sudo postconf -e'smtpd_tls_cert_file=/etc/letsencrypt/live/lab.itpro.tv/fullchain.pem' sudo postconf -e'smtpd_tls_key_file=/etc/letsencrypt/live/lab.itpro.tv/privkey.pem'
Now encryption is like a boolean between the server and the client
touk@ubuntu-server:/etc/postfix$ postconf smtpd_tls_security_level
smtpd_tls_security_level = mayYou can force it, but it violates the standards, mails might be dropped (If it is an smtp serve on the internet not in private net)
sudo postconf -e 'smtpd_tls_security_level=encrypt’
IMAP & POP3
REMOTE EMAIL DELIVERY
We all love the terminal, i am assuming lol
but i do not like working on the terminal when it comes to recieve and sending emails, i don’t want to ssh very time i want to check my mail to get in the server
i am going to have my laptop or my phone or something like that retrieve mail from the server
In order for that to work we need to install Remote email delivery
sudo apt install dovecot-pop3d dovecot-imapd
Configuring Dovecot for User Access
sudo vim /etc/dovecot/10-auth.conf
auth_mechanisms = plain login
disable_plaintext_auth = noadding ‘login’ will give as basic linux login
disabling plain text is referred to looking at password in plain text or hashed, but we will use TLS instead
Setting email users location
#mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_location = maildir:~/Maildiri have commented the first line and added the default directory
This will use the Maildir format and store the emails in the Maildir directory in the user's home directory.
Configure Unix Listener
And then one last thing I need to do is to configure a Unix listener. When somebody logs in, they're logging in with their Linux user account. Dovecot expects them to log in with a virtual user account. So that's already set up, but I I'd be good to go if I went with virtual users. But I'm using real users, so I need to add a couple of extra permissions to make that happen. So I need to go into the 10-master file, which is the master configuration for Dovecot as a whole
sudo vim 10-master.conf
I'm just going to uncomment that line right there. That's the one that's allowing us to handle that authentication and tie the users together. Now the default configuration is fine, but if you're running Postfix under a dedicated user account, which Ubuntu does by default, then you may need to add two extra lines here. I'm going to say user equals postfix and group equals postfix. And that's letting Dovecot know that the Postfix server is running under its own user account. And so now it knows which user and which group to use when it's dealing with file permissions.
service auth {
# auth_socket_path points to this userdb socket by default. It's typically
# used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
# full permissions to this socket are able to get a list of all usernames and
# get the results of everyone's userdb lookups.
#
# The default 0666 mode allows anyone to connect to the socket, but the
# userdb lookups will succeed only if the userdb returns an "uid" field that
# matches the caller process's UID. Also if caller's uid or gid matches the
# socket's uid or gid the lookup succeeds. Anything else causes a failure.
#
# To give the caller full permissions to lookup all users, set the mode to
# something else than 0666 and Dovecot lets the kernel enforce the
# permissions (e.g. 0777 allows everyone full permissions).
unix_listener auth-userdb {
#mode = 0666
#user =
#group =
}
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
# Auth process is run as this user.
#user = $default_internal_user
}For TLS as i menionned you can configure the 10-ssl.conf and add the path for your certificate and key in ssl_crt path and ssl_jey path inside this file
Firewall access
sudo ufw allow "Dovecot POP3"
sudo ufw allow "Dovecot IMAP"
sudo ufw allow "Dovecot Secure IMAP"
sudo ufw allow "Dovecot Secure POP3"sudo systemctl restart dovecot
This was done because i faced an issue of directories conflict between postfix using mailbox and dovecot using Maildir
touk@ubuntu-server:/etc/dovecot/conf.d$ sudo apt install mb2md
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
mb2md is already the newest version (3.20-9).
0 upgraded, 0 newly installed, 0 to remove and 11 not upgraded.mb2md -s /var/mail/touk -d ~/Maildir
Converting /var/mail/touk to maildir: /home/touk/Maildir
Source Mbox is /var/mail/touk
Target Maildir is /home/touk/Maildir
6 messages.There is a mismatch between the old directory used by postfix which use /var/mail/touk and pop3 ~/Maildir so i need to tell postfix to use Maildir in /etc/postfix/main.cf
home_mailbox = Maildir/sudo systemctl restart postfix
touk@ubuntu-server:~$ echo "this is a test" | mail -s "testing mail directory if its working" touk@ubuntu-server
touk@ubuntu-server:~$ telnet 127.0.0.1 110
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
user touk
+OK
pass touk
+OK Logged in.
list
+OK 8 messages:
1 541
2 449
3 2238
4 477
5 466
6 451
7 466
8 469Testing Dovecot Locally
touk@ubuntu-server:/etc/dovecot/conf.d$ telnet 127.0.0.1 110
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
user touk
+OK
pass touk
+OK Logged in.
list
+OK 13 messages:
1 541
2 449
3 2238
4 477
5 466
6 451
7 466Using ThunderBird
Last updated