Installation of Exim4, DoveCot, SquirrelMails

From Andreida

This is for Debian 7 Wheezy, but seems to work for Debian 10 Buster too


(old Installation of Exim4, DoveCot, SquirrelMails, Debian 5, Debian 6)

Goals

  • Using Debian 7 Wheezy
  • Exim 4 as mail server
  • Using self created certificate
  • Dovecot for imap access
  • SquirrelMail as web client
  • SpamAssassin for spam filtering
  • Access from
    • Thunderbird
    • Outlook: works out of the box, but you have to have certificates which match the domain names
  • Backup of mails to a different system
  • virtual users

Exim 4

install

We will use the heavy version to be able to later integrate SpamAssassin. 

apt-get install exim4-daemon-heavy

(I don't use this anymore: If you can start programs with X-Server, you would like to get geximon: 

apt-get install geximon xauth

Remember to ssh with "-X" or "ForwardX11 yes" in your config)

paniclog

If you get paniclog entries like "address already in use", find out about the other process with 

netstat -4anp | grep 25

Chances are, it is something about sendmail. Do 

which sendmail

and "ls -l" on the result like 

ls -l /usr/sbin/sendmail

or just (ticks, not single quotes) 

ls -l `which sendmail`

Chances are, it is a link to exim4 and the installation went wrong. Happens every time for me. Remove the paniclog and restart the server. Check the log /var/log/exim4/mainlog

If it is not the above, perhaps you need to remove the sendmail(-bin) package.

validating

Have a look at the ports: 

netstat -apn | grep exim

If you have exim4 listen on port 25, you should be ok.

  • add at least one local user so you can set him as receiver for postmaster etc in the next step

Now you should reconfigure exim4 

dpkg-reconfigure exim4-config
  • internet site
  • accept the domain name if you don't know better
  • IP addresses to listen to:
    • leave this empty or make sure you include the external ip
    • ::1 the IP6 variant, if you keep this empty, don't bother now
  • final destination: your domains
  • domains to relay for: normally none (empty)
  • machines to relay for: normally none (empty)
  • DNS queries minimal: your choice (default: no)
  • delivery method: maildir in home directory
  • split: your choice (default: no) The main difference is, where will you later put your modifications
    • non-slit: /etc/exim4/exim4.conf.localmacros
    • split: /etc/exim4/conf.d/main/000_localmacros
  • root/postmaster: select the above created user, should really read his mail

Now send a mail: 

echo Hello You | mail <user>@<OTHER-domain> -s test-1

You should receive the mail at your account at the OTHER domain.

open firewall

If you have a firewall, open it for incoming at port 25. For example ufw: 

ufw allow smtp

or firehol in /etc/firehol/firehol.conf 

server smtp accept

An example for a whole firehol.conf: 


FIREHOL_LOG_PREFIX="firehol: "

server_mySsh_ports="tcp/23"
client_mySsh_ports="default"

interface any world
  protection strong
  policy drop

  client all accept

  server ICMP accept
  server mySsh accept

  server https accept
  server imaps accept
  server smtp accept
  server imap accept
  server smtps accept

TLS for SMTP

If you will have different mail domains at one ip you will get into problems with Outlook if you do not have one certificate per domain where the certificate matches the domain name. (TODO)


  • install openssl (for certificate) and swaks (for tests) and libnet-ssleay-perl
apt-get install openssl swaks libnet-ssleay-perl
  • edit the cert creation script, check at least the DAYS value. 7300 would be 20 years.
vi /usr/share/doc/exim4-base/examples/exim-gencert
  • execute the script
/usr/share/doc/exim4-base/examples/exim-gencert
  • create file /etc/exim4/exim4.conf.localmacros (non-split!) with
MAIN_TLS_ENABLE = 1
  • reload exim
/etc/init.d/exim4 reload
  • test it locally
swaks -f yourMail@YourDomain.com -t yourMail@YourDomain.com -tls -s localhost
  • What would be bad:
Host did not advertise STARTTLS

sasl for system login

Currently we want system users and system user passwords, so we use SASL:

  • install it
apt-get install sasl2-bin
  • enable for system restart in /etc/default/saslauthd
START=yes
  • add exim user to sasl group
adduser Debian-exim sasl
  • start sasl
/etc/init.d/saslauthd start

enable exim to ask clients for passwords if they want to SEND mails

in /etc/exim4/exim4.conf.template enable the following 2 sections 

plain_saslauthd_server:
driver = plaintext
public_name = PLAIN
server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
server_set_id = $auth2
server_prompts = :
.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
.endif

login_saslauthd_server:
   driver = plaintext
   public_name = LOGIN
   server_prompts = "Username:: : Password::"
   # don't send system passwords over unencrypted connections
   server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
   server_set_id = $auth1
   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
   .endif
  • activate it
update-exim4.conf && /etc/init.d/exim4 reload
  • add one of the system users you will want to add anyway
  • after installation of dovecot try for example to send a mail with Thunderbird, you should get asked to accept the certificate and give the password

virtual users

Source: https://www.organicdesign.co.nz/Configure_mail_server#Setting_up_mail_users

in exim4.conf.template set domainlist to 

vi /etc/exim4/exim4.conf.template
domainlist local_domains = @ : @[] : localhost : partial-lsearch;/etc/exim4/virtual.domains

after section "real_local" add 

virtual:
	driver = redirect
	allow_defer
	allow_fail
	data = ${lookup{$local_part@$domain}lsearch*@{/etc/exim4/virtual.users}}
	domains = partial-lsearch;/etc/exim4/virtual.domains
	retry_use_local_part

create the file /etc/exim4/virtual.domains 

example.com
example.net

reload settings 

update-exim4.conf && /etc/init.d/exim4 reload

change /etc/exim4/virtual.users, you don't have to restart the server for this 

regularuser@example.com     : localuser@localhost
forwardinguser@example.com  : someuser@example.org
foo@example.com             : :fail: Foo no longer lives here.
bar@example.com             : :blackhole:
*@example.com               : catchall1@localhost

regularuser@example.net     : localuser2@localhost
forwardinguser@example.net  : someuser2@example.org
*@example.net               : catchall2@localhost

If you have the local user smith but you want only to allow smith to get mail via huber@example.com, then use the following pattern: 

huber@example.com : smith@localhost
*@example.com     : :fail: Your message

disable ipv6

to be able to send messages to providers like google, you will have to support ipv6 completely or not at all. So:

add to /etc/exim4/update-exim4.conf.conf 

disable_ipv6='true'

add to /etc/sysctl.conf 

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1

restart the server 

shutdown -r now

set some receivers to external mail accounts

  • edit /etc/aliases
  • change the entries to something you like, for example
root : you@yourDomain.com
  • then run
newaliases
  • perhaps you just need to allow root@your-domain.com as valid mail receiver

DoveCot

  • allow in your firewall, for example for ufw
ufw limit imap

or for firehol in /etc/firehol/firehol.conf 

server imap accept

Don't forget 

firehol start
  • install it
apt-get install dovecot-imapd
  • use same directory for mail as exim4:
vi /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:~/Maildir
#mail_location = mbox:~/mail:INBOX=/var/mail/%u

/etc/init.d/dovecot restart
  • first test (look for "Dovecot ready")
telnet localhost 143
  • remote test (look for "Dovecot ready") from another computer
telnet <domain> 143
  • remote tls test
openssl s_client -connect <domain>:143 -starttls imap

folders below inbox

Attention: Only customize this for NEW servers where ALL mailboxes are NEW. Otherwise, use the same settings as the old server. Exception: if you know what you are doing :-)


If you want the folders junk, sent etc. below the inbox, then do the following but keep in mind that is is not possible to just copy mail/ or Maildir/ from another server AND change the separator etc. 

vi /etc/dovecot/conf.d/10-mail.conf

search for "namespace inbox" and inside that scope change 

separator =

to 

separator = /

Then open 

vi /etc/dovecot/conf.d/15-mailboxes.conf

and have it look like the following (INBOX/ and auto=subscribe and \Archive), do NOT reformat it to something like: 

  mailbox INBOX/Junk   
  {
    special_use = \Junk
    auto=subscribe
  }

This is considered an invalid format by Dovecot :-(


This is the normal format: 

namespace inbox {
  mailbox INBOX/Drafts   {
    special_use = \Drafts
    auto=subscribe
  }

  mailbox INBOX/Junk   {
    special_use = \Junk
    auto=subscribe
  }

  mailbox INBOX/Trash   {
    special_use = \Trash
    auto=subscribe
  }

  mailbox INBOX/Sent   {
    special_use = \Sent
    auto=subscribe
  }

  mailbox INBOX/Archive   {
    special_use = \Archive
    auto=subscribe
  }
}

switch server

You can copy "mail" or "Maildir" directories from one server or account to the other. If you copy between servers you will have to have the same prefix/separator in both locations. Or you have to understand this: http://wiki2.dovecot.org/Namespaces or something like it. Whatever you do, after the copy of a Maildir, do 

chown -R newUser:newUser Maildir

Spam Assassin

the following is from sysadmin world

  • install spamassassin and the exim filter
apt-get install sa-exim  spamassassin
  • old debian (7): start on each boot:
vi /etc/default/spamassassin
ENABLED=1
  • new debian (10): start on each boot:
update-rc.d spamassassin enable
  • new debian (10):
vi /etc/default/spamassassin
CRON=1
  • What about Debian 8 and 9? No idea.
  • start
service spamassassin start
  • in /etc/exim4/exim4.conf.template at the top in MAIN CONFIGURATION SETTINGS add:
local_scan_path = /usr/lib/exim4/local_scan/sa-exim.so
  • enable the connector in /etc/exim4/sa-exim.conf. Please be careful, there are some lines with SAEximRunCond but only one with SAEximRunCond: 0. Comment this line out.
#SAEximRunCond: 0

Logging: 

SAEximDebug: 0
  • activate changes in /etc/exim4/exim4.conf.template
/usr/sbin/update-exim4.conf
  • restart exim
/etc/init.d/exim4 restart

Let Spam Assassin learn from your folders

Spam Assassin can learn what is junk and what is ham (not junk) from your folders, if the users of your mail server put junk mails into certain folders and good mails into certain other folders. If Thunderbird is being used, it is easy. 

crontab -e
32 1 * * * . /etc/profile && /usr/bin/sa-learn  --spam /home/*/Maildir/.INBOX.Junk/ > /dev/null
45 2 * * * . /etc/profile && /usr/bin/sa-learn  --ham /home/*/Maildir/.INBOX.Archive* > /dev/null

This way your Spam Assassin will learn each night more. It is important to realize that Spam Assassin does not put junk into certain folders. It will only mark the messages as junk. You have to configure your e-mail program to trust Spam Assassin headers and put marked mails into its junk folders.

SquirrelMail

SquirrelMail does not exist for Debian 10, here the old instructions for Debian 7: SquirrelMail Installation for Debian 7

Do NOT use this! I just point to it and keep it because I don't wan to delete it.

Horde (Webmail, instead of SquirrelMail)

info

Please be careful in this section. I am not 100% sure what I did here. Make sure you have created a real user who will be using his mail account later because you need to give his name as the first admin.

install

Make sure you have the locales installed (should do nothing, but...just in case): 

apt-get install locales

Configure them: 

dpkg-reconfigure locales

I always keep en_US.UTF-8 and the locale for my country (de_DE.UTF-8).

Install horde and the PDO driver for sqlite for PHP - I hope this made sense ;-) 

apt-get install php-horde-webmail php7.3-sqlite3

setup

Modify the port for ssl use: 

vi /usr/share/horde/config/conf.php.dist
// $conf['server']['port'] = 80;
$conf['server']['port'] = 443;

prepare the database directory 

mkdir /usr/share/horde/database
chown -R www-data:www-data /usr/share/horde/database

call the setup 

webmail-install
> sqlite
> /usr/share/horde/database/horde


At some point after this the database file will exist 

ls -l /usr/share/horde/database/horde

If it exists and looks like this: 

-rw-r--r-- 1 root root 1892352 Nov 20 09:43 horde

then it's wrong. And you should do the same stuff as always: 

chown www-data:www-data /usr/share/horde/database/horde
chmod 600 /usr/share/horde/database/horde

HINT HINT HINT: if your horde login succeeded but you get the information that a read-only database can't be written into... then you know you forgot it!


doing weird stuff in the hope it will activate ssl

You already changed the default port above to 443. That was in this context too.

Check the rights for the folders (look for "Directory") and consider to only allow /usr/share/horde 

vi /etc/apache2/apache2.conf

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Require all denied
</Directory>

<Directory /usr/share/horde>
    AllowOverride None
    Require all granted
</Directory>

<Directory /var/www/>
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all denied
</Directory>

Disable the normal port 80: 

vi /etc/apache2/ports.conf

# Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

Enable some mods: 

cd /etc/apache2/mods-enabled
ln -s ../mods-available/socache_dbm.load
ln -s ../mods-available/socache_memcache.load
ln -s ../mods-available/socache_shmcb.load
ln -s ../mods-available/ssl.conf
ln -s ../mods-available/ssl.load

Disable the default (port 80/html) site and enable the ssl default config: 

cd /etc/apache2/sites-enabled 
rm 000-default.conf
ln -s ../sites-available/default-ssl.conf

Restart apache: 

/etc/init.d/apache2 restart

.htaccess

Depending on your circumstances (only you as user, more security needed...) you can consider to add a .htaccess file to your /usr/share/horde directory. Check out this for some basic info: Apache 2, quickly protect directory with password


done?

Try to reboot your system and then connect to 

https://<your-domain>/horde/

Backup

If you have on some server elsewhere a rsnapshot installation running, you can just add your mail server in your /etc/rsnapshot.conf 

backup  root@server-mail:/etc/       server-mail/
backup  root@server-mail:/var/www/   server-mail/
backup  root@server-mail:/home/      server-mail/

For the above to work you will need the following:

  • the backup server must be able to connect to the mail-server with ssh with keys, without passwords
  • the .ssh/config must have an entry like this:
Host server-mail
    HostName        123.123.123.123
    User            root
    Port            22
    ForwardX11      no
    IdentityFile    /root/.ssh/id-rsa-server-mail

Moving Server

If you are moving files from one server to the other, then this section is for you.

Create a local ssh key, paste the public part into the authorized_keys file of the old server.

  • domains?
vi /etc/exim4/virtual.domains
update-exim4.conf && /etc/init.d/exim4 reload
  • virtual users?
/etc/exim4/virtual.users
  • add all users to the system
adduser <username>
  • aliases
vi /etc/aliases
root : you@yourDomain.com
newaliases
  • copy mail directories
cd /home
adduser user1
scp -r old-mail:/home/user1/Maildir/ user1/
chown -R user1:user1 user1/Maildir
  • depending on your system, perhaps get the .htaccess file from your old system AND the file with the password and remember the rwx rights:
ls -la /usr/share/horde/.htaccess
ls -la /etc/apache2/.passwd

DNS

Make sure you have the needed DNS entries.

Example
Hostname Type Address
@ MX (Mail) mail.example.com
mail A (Address) 41.42.43.44
41.42.43.44 PTR (reverse DNS) mail.example.com

The PTR is sometimes in the settings for the machine, not in the settings for the domain.

Make sure https://whatismyipaddress.com/blacklist-check does not contain the IP of your mail server.

Make sure you have the fully qualified hostname in your /etc/hosts as first entry in the line with the real IP, something like: 

127.0.0.1       localhost localhost.localdomain
::1     localhost localhost.localdomain
278.241.130.121 imap.yourdomain.com imap
xxxx:xxxx:xx::xxxx:xxxx imap.yourdomain.com imap


Check the MX entry: 

dig +noall +answer -t MX smilingcat.net

The answer should be the fully qualified name of your mailserver like 

imap.yourdomain.com


Check domain -> ip with dig some (ca. 24) hours after you changed it: 

dig +noall +answer -t ANY  <hostname>
dig +noall +answer -t ANY imap.yourdomain.com

The answer should be the correct IP.


Check the qualified hostname of your server locally: 

hostname -f

If the answer is 

imap.yourdomain.com

then you are good, if the answer is 

imap

then you have to fiddle with the hosts file (See above).

Outlook / Windows Mail Problems

vi /etc/exim4/exim4.conf.localmacros
MAIN_TLS_TRY_VERIFY_HOSTS =

update-exim4.conf && /etc/init.d/exim4 reload

Custom certificate

Add "Outbox" as favourite, then you get the exclamation mark for the failed send and can press it and select to use the "bad" certificate. Then you restart Mail and it should be ok.

Retrieved from "http://wiki.andreas-duffner.de/index.php?title=Installation_of_Exim4,_DoveCot,_SquirrelMails&oldid=616"