zkk / VPS email server

---

apt update
apt upgrade
ufw allow 25
ufw allow 587
apt install mailutils postfix
useradd -m -s /bin/bash max
passwd max

cp /etc/postfix/main.cf /etc/postfix/main.cf.bak
dpkg-reconfigure postfix

echo "home_mailbox = Maildir/" >> /etc/postfix/main.cf

systemctl reload postfix
echo "Body." | mail -s "Subject." max@massimo-fontana.net

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.max73.it/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.max73.it/privkey.pem

apt install opendkim opendkim-tools
mkdir -p /etc/postfix/dkim
opendkim-genkey -D /etc/postfix/dkim/ -d max73.it -s mail
chgrp opendkim /etc/postfix/dkim/*
chmod g+r /etc/postfix/dkim/*
echo "mail._domainkey.max73.it max73.it:mail:/etc/postfix/dkim/mail.private" > /etc/postfix/dkim/keytable
echo "*@max73.it mail._domainkey.max73.it" > /etc/postfix/dkim/signingtable
echo -e "127.0.0.1\n10.1.0.0/16\n1.2.3.4/24" > /etc/postfix/dkim/trustedhosts

KeyTable file:/etc/postfix/dkim/keytable
SigningTable refile:/etc/postfix/dkim/signingtable
InternalHosts refile:/etc/postfix/dkim/trustedhosts
Canonicalization        relaxed/simple
Socket                  inet:12301@localhost

echo "massimo-fontana.net" > /etc/mailname
postconf -e "myhostname = $(cat /etc/mailname)"
postconf -e "milter_default_action = accept"
postconf -e "milter_protocol = 6"
postconf -e "smtpd_milters = inet:localhost:12301"
postconf -e "non_smtpd_milters = inet:localhost:12301"
systemctl restart opendkim
systemctl enable opendkim
systemctl reload postfix

echo "max73.it" > /etc/hostname
shutdown -r now

useradd -m -G mail dmarc
echo "_dmarc.$(cat /etc/mailname)"
echo "v=DMARC1; p=reject; rua=mailto:dmarc@$(cat /etc/mailname); fo=1"

cat /etc/mailname
IP4='my-ipv4'
IP6='my-ipv6'
echo "v=spf1 mx a:mail.$(cat /etc/mailname) ip4:$IP4 ip6:$IP6 -all"

echo "Test dkim." | mail -s "test email." test-da745b6b@appmaildev.com

echo "Test dkim." | mail -s "test email." maxmatty@gmail.com

apt install dovecot-imapd dovecot-sieve spamassassin spamc
ufw allow 993
certbot --nginx certonly -d mail.mx73.it

# Note that in the dovecot conf, you can use:
# %u for username
# %n for the name in name@domain.tld
# %d for the domain
# %h the user's home directory

# Connections between the mail client and Dovecot needs to be encrypted
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.max73.it/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.max73.it/privkey.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED
ssl_prefer_server_ciphers = yes
ssl_dh = </usr/share/dovecot/dh.pem
auth_mechanisms = plain login
auth_username_format = %n

protocols = $protocols imap

# Search for valid users in /etc/passwd
userdb {
    driver = passwd
}
#Fallback: Use plain old PAM to find user passwords
passdb {
    driver = pam
}

# Our mail for each user will be in ~/Mail, and the inbox will be ~/Mail/Inbox
mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
namespace inbox {
    inbox = yes
    mailbox Drafts {
	  special_use = \Drafts
	  auto = subscribe
    }
    mailbox Junk {
	  special_use = \Junk
	  auto = subscribe
	  autoexpunge = 30d
    }
    mailbox Sent {
	  special_use = \Sent
	  auto = subscribe
    }
    mailbox Trash {
	  special_use = \Trash
    }
    mailbox Archive {
	  special_use = \Archive
    }
}

# Here we let Postfix use Dovecot's authetication system.
service auth {
    unix_listener /var/spool/postfix/private/auth {
	  mode = 0660
	  user = postfix
	  group = postfix
    }
}

protocol lda {
    mail_plugins = $mail_plugins sieve
}
protocol lmtp {
    mail_plugins = $mail_plugins sieve
}
plugin {
    sieve = ~/.dovecot.sieve
    sieve_default = /var/lib/dovecot/sieve/default.sieve
    sieve_dir = ~/.sieve
    sieve_global_dir = /var/lib/dovecot/sieve/
}

mkdir -p /var/lib/dovecot/sieve/
echo -e "require [\"fileinto\", \"mailbox\"];\nif header :contains \"X-Spam-Flag\" \"YES\"\n        {\n                fileinto \"Junk\";\n        }" > /var/lib/dovecot/sieve/default.sieve

grep -q '^vmail:' /etc/passwd || useradd vmail
chown -R vmail:vmail /var/lib/dovecot
sievec /var/lib/dovecot/sieve/default.sieve
echo -e "auth    required        pam_unix.so nullok\naccount required        pam_unix.so" >> /etc/pam.d/dovecot
postconf -e 'smtpd_sasl_auth_enable = yes'
postconf -e 'smtpd_sasl_type = dovecot'
postconf -e 'smtpd_sasl_path = private/auth'
postconf -e 'mailbox_command = /usr/lib/dovecot/deliver'

sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf
echo -e "smtp unix - - n - - smtp\nsmtp inet n - y - - smtpd\n  -o content_filter=spamassassin\nsubmission inet n       -       y       -       -       smtpd\n  -o syslog_name=postfix/submission\n  -o smtpd_tls_security_level=encrypt\n  -o smtpd_sasl_auth_enable=yes\n  -o smtpd_tls_auth_only=yes\nsmtps     inet  n       -       y       -       -       smtpd\n  -o syslog_name=postfix/smtps\n  -o smtpd_tls_wrappermode=yes\n  -o smtpd_sasl_auth_enable=yes\nspamassassin unix -     n       n       -       -       pipe\n  user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf
usermod -a -G max
postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain'
echo -e "/^Received:.*/     IGNORE\n/^X-Originating-IP:/    IGNORE\n/^User-Agent:/        IGNORE\n/^X-Mailer:/        IGNORE" >> /etc/postfix/header_checks
postconf -e "header_checks = regexp:/etc/postfix/header_checks"

apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[postfix]
enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log

[sasl]
enabled  = true
port     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter   = postfix-sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = /var/log/mail.warn
maxretry = 1
bantime  = 21600

[dovecot]
enabled = true
port    = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter  = dovecot
logpath = /var/log/mail.log

shutdown -r now