Thomas.will: Die Seite wurde neu angelegt: „= Mailserver komplett = = Installation = ;Pakete installieren apt update apt install postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils *apt install…“

2026-06-09T14:57:10Z

Die Seite wurde neu angelegt: „= Mailserver komplett = = Installation = ;Pakete installieren *apt update *apt install postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils *apt install…“

Neue Seite

= Mailserver komplett =

= Installation =
;Pakete installieren
*apt update
*apt install postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils
*apt install rspamd redis clamav clamav-daemon
*apt install roundcube roundcube-core php-net-smtp

;Bei der Postfix-Abfrage '''Internet Site''' wählen

= Benutzer anlegen =
*useradd -m -s /bin/bash martha
*useradd -m -s /bin/bash leroy
*passwd martha
*passwd leroy

;Maildir-Struktur für neue Benutzer
*mkdir -p /etc/skel/Maildir/{cur,new,tmp}

;Für bestehende Benutzer
*mkdir -p /home/martha/Maildir/{cur,new,tmp}
*mkdir -p /home/leroy/Maildir/{cur,new,tmp}

= Zertifikate =
;Privkey und Zertifikat erstellen und ablegen unter
*/etc/ssl/own.crt
*/etc/ssl/own.key

= Postfix =

== /etc/postfix/main.cf ==
*vi /etc/postfix/main.cf
<pre>
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
compatibility_level = 3.6

# TLS
smtpd_tls_cert_file=/etc/ssl/own.crt
smtpd_tls_key_file=/etc/ssl/own.key
smtpd_tls_security_level=may
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# Relay
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

myhostname = mail.it213.int
myorigin = it213.int
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, localhost, it213.int
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all

# Maildir
home_mailbox = Maildir/
mailbox_command =

# SASL über Dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# Rspamd Milter
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_default_action = accept
</pre>

== /etc/postfix/master.cf ==
;SMTPS auf Port 465 aktivieren – mit Milter
*vi /etc/postfix/master.cf
<pre>
smtps inet n - y - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_milters=inet:127.0.0.1:11332
</pre>

;Ohne die -o smtpd_milters Zeile ruft Postfix Rspamd für Roundcube-Mails (Port 465) nicht auf – DKIM-Signing findet dann nicht statt

= Dovecot =

== /etc/dovecot/conf.d/10-mail.conf ==
*vi /etc/dovecot/conf.d/10-mail.conf
<pre>
mail_driver = maildir
mail_home = /home/%{user | username}
mail_path = %{home}/Maildir
namespace inbox {
inbox = yes
}
mail_privileged_group = mail
protocol !indexer-worker {
}
</pre>

== /etc/dovecot/conf.d/10-ssl.conf ==
*vi /etc/dovecot/conf.d/10-ssl.conf
<pre>
ssl = yes
ssl_server_cert_file = /etc/ssl/own.crt
ssl_server_key_file = /etc/ssl/own.key
ssl_min_protocol = TLSv1.2
</pre>

== /etc/dovecot/conf.d/10-master.conf ==
*vi /etc/dovecot/conf.d/10-master.conf
<pre>
service imap-login {
inet_listener imap { }
inet_listener imaps { }
}

service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
}

service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}

service auth-worker {
}
</pre>

= Rspamd =

== Redis ==
*systemctl enable --now redis

== /etc/rspamd/local.d/redis.conf ==
*vi /etc/rspamd/local.d/redis.conf
<pre>
servers = "127.0.0.1:6379";
</pre>

== DKIM Key generieren ==
*mkdir -p /etc/rspamd/dkim
*rspamadm dkim_keygen -b 2048 -s mail -d it213.int -k /etc/rspamd/dkim/mail.key
*chown -R _rspamd:_rspamd /etc/rspamd/dkim
*chmod 600 /etc/rspamd/dkim/mail.key

;DNS-Eintrag auslesen
*cat /etc/rspamd/dkim/mail.txt

;In der DNS-Zone eintragen
<pre>
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=<public key>"
</pre>

;Prüfen
*dig TXT mail._domainkey.it213.int

== /etc/rspamd/local.d/dkim_signing.conf ==
*vi /etc/rspamd/local.d/dkim_signing.conf
<pre>
enabled = true;

domain {
it213.int {
selector = "mail";
path = "/etc/rspamd/dkim/mail.key";
}
}

use_domain = "header";
allow_username_mismatch = true;
sign_authenticated = true;
sign_local = true;
sign_inbound = false;
use_esld = true;
check_pubkey = true;
</pre>

;allow_username_mismatch = true ist notwendig wenn SASL-User ohne Domain-Suffix authentifiziert werden (z.B. '''martha''' statt '''martha@it213.int''')

== ClamAV ==
*systemctl enable --now clamav-daemon
*freshclam

== /etc/rspamd/override.d/antivirus.conf ==
*vi /etc/rspamd/override.d/antivirus.conf
<pre>
enabled = true;

clamav {
type = "clamav";
symbol = "CLAM_VIRUS";
servers = "/var/run/clamav/clamd.ctl";
scan_text_mime = true;
scan_mime_parts = true;
min_size = 0;
scan_unauthenticated = true;
stream = true;
score = 20.0;
}
</pre>

= Roundcube =

== /var/www/roundcube/config/config.inc.php ==
*vi /var/www/roundcube/config/config.inc.php
<pre>
$config['imap_host'] = 'ssl://mail.it213.int:993';
$config['smtp_host'] = 'ssl://mail.it213.int:465';
</pre>

= Dienste starten =
*systemctl restart postfix
*systemctl restart dovecot
*systemctl restart rspamd
*systemctl restart clamav-daemon

= Kontrolle =

== Ports ==
*ss -4lntp | egrep "25|465|993|143"

== DKIM ==
;Nach dem Versand einer Mail prüfen ob der DKIM-Signature Header gesetzt ist
*grep DKIM_SIGNED /var/log/rspamd/rspamd.log | tail -5

== Rspamd Webinterface ==
*http://mail.it213.int:11334

= Logging =
*journalctl -f -u postfix
*tail -f /var/log/rspamd/rspamd.log
*tail -f /var/log/mail.log

Mailserver mit Rspamd, ClamAV und DKIM - Versionsgeschichte

Thomas.will: Die Seite wurde neu angelegt: „= Mailserver komplett = = Installation = ;Pakete installieren *apt update *apt install postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils *apt install…“

Thomas.will: Die Seite wurde neu angelegt: „= Mailserver komplett = = Installation = ;Pakete installieren apt update apt install postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils *apt install…“