The Wiert Corner – irregular stream of stuff

Summary from [WayBack]‪ Dear #lazyweb, can anyone point me to a modern email server setup (just email) with letsencrypt, some spam filter, multi domain preferably on RHEL/Cent… – Jan Wildeboer – Google+

• many SMTP servers on the interwebs do not have proper TLS setups, so do not require remote SMTP servers to deliver email with a proper certificate
• delivering mail via SMTP using STARTTLS with a proper certificate yourself is a good step forward
• postfix
• dovecot
• greylisting (although in practice it does not make much of a difference any more)
• fail2ban
• dnsbl (often called rbl)
• spamassasin
• rspamd (supports SPF, DKIM and many others)
  • [WayBack] Rspamd spam filtering system
  • [WayBack] GitHub – vstakhov/rspamd: Rapid spam filtering system.
• letsencrypt automation can be tough, so here is a small wrapper: [WayBack] GitHub – DrGlitchMX/update-letsencrypt: Tiny script for updating “Let’s Encrypt!” certificates from cron
• it helps having letsencrypt and the mail server to be on one machine:
  • multidomain let’s encrypt cert that has my webserver name and the mailserver in the Subject Alternative Names field. As both are on the same machine certbot can automatically update it and I just point Postfix and Dovecot to the LE files.
• Hans-Martin Mosner SMTP as-is is just not suitable for the kind of decentralized mail that you would prefer. You need some mechanism to determine which mail senders to trust and which not. Cryptography is suitable at the MUA level and should be used much more, but at the MTA level, TLS for privacy and SPF(bleh) or DKIM(meh) for sender domain authentication are basically your only weapons -much too weak. The PGP web of trust must be considered a failed experiment – who of your mail contacts uses PGP properly or at all? Ironically the only secure messaging solutions for the masses are centralized.

• A bit large but, might be an option: Zimbra. Multidomain and spam out of the box. Certs are well documented. Just disable logging which consumes way too much resources.
• Guides
  • [WayBack] Mailserver mit Dovecot, Postfix, MySQL und Rspamd unter Debian 9 Stretch
  • [WayBack] ISPmail tutorials – workaround.org (Postfix, Dovecot IMAP/POP3 and MySQL backend on a Debian server just)
    • [WayBack] ISPmail guide for Debian Stretch – workaround.org
      1. [WayBack] What’s new in the Stretch guide? – workaround.org
      2. [WayBack] Migrating from a Jessie to a Stretch mail server – workaround.org
      3. [WayBack] The big picture – workaround.org
      4. [WayBack] Types of email domains – workaround.org
      5. [WayBack] Install Debian Stretch on your server – workaround.org
      6. [WayBack] Install the software packages – workaround.org
      7. [WayBack] Creating a TLS encryption key and certificate – workaround.org
      8. [WayBack] Preparing the database – workaround.org
      9. [WayBack] Making Postfix get its information from the MySQL database – workaround.org
      10. [WayBack] Setting up Dovecot – workaround.org
      11. [WayBack] Making Postfix send emails to Dovecot – workaround.org
      12. [WayBack] Testing IMAP and setting up Roundcube webmail – workaround.org
      13. [WayBack] Testing email delivery – workaround.org
      14. [WayBack] Relaying with SMTP authentication – workaround.org
      15. [WayBack] Filtering out spam with rspamd – workaround.org
          • The SMTP equivalent to the EICAR virus test is the GTUBE test which you can download at [WayBack] GTUBE
      16. [WayBack] Filtering out viruses and malware – workaround.org
      17. [WayBack] DNS MX records – workaround.org
      18. [WayBack] Prevent spoofing with DKIM – workaround.org
      19. [WayBack] Managing users, aliases and domains – workaround.org
      20. [WayBack] Fighting brute force attacks – workaround.org
    • [WayBack] ISPmail guide for Debian Jessie – workaround.org
    • The above cover (though I wish it did without MariaDB / MySQL):
      • Receive emails on your domain(s).
      • Filter out spam and malware.
      • Send emails out to any other servers/domains on the internet. Connections will be encrypted when possible.
      • Add cryptographic signatures (DKIM) to outgoing emails.
      • Store as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user.
      • Let your users fetch email using IMAP or POP3 and send email through your servers using SMTP.
      • Allow users to manage server-based filter rules. Distribute incoming emails to different folders. Forward copies. Or send out-of-office notifications.
      • Provide a webmail interface so users can access their emails securely from any location.
      • Mitigate brute force attacks.

Things to do:

• find a proper multi-MX fallback setup guide for postfix

–jeroen

Read the rest of this entry »