{"id":497,"date":"2023-02-07T07:16:53","date_gmt":"2023-02-07T07:16:53","guid":{"rendered":"http:\/\/tty.tartux.net\/?page_id=497"},"modified":"2023-02-09T19:59:00","modified_gmt":"2023-02-09T18:59:00","slug":"installation-dun-serveur-postfix-dovecot","status":"publish","type":"page","link":"https:\/\/tty.tartux.net\/?page_id=497","title":{"rendered":"Installation d'un serveur postfix-dovecot"},"content":{"rendered":"\n

Pour m'affranchir de tout t\u00e9l\u00e9chargement sur les plateformes ad hoc, j'ai choisi de faire mon installation sur une debian 12 (freeze des paquets la semaine prochaine, sortie pr\u00e9vue cet \u00e9t\u00e9).<\/p>\n\n\n\n

1. Mise \u00e0 jour<\/h4>\n\n\n\n

Commen\u00e7ons par un classique :<\/p>\n\n\n\n

\n

# apt update && apt dist-upgrade<\/p>\n<\/blockquote>\n\n\n\n

2. Le hostname<\/h4>\n\n\n\n

On donne au serveur son fqdn :<\/p>\n\n\n\n

\n

# hostnamectl set-hostname mail.tartux.net<\/p>\n<\/blockquote>\n\n\n\n

J'en profite aussi pour mettre \u00e0 jour le \/etc\/hosts.<\/p>\n\n\n\n

3. Installation de Apache, MariaDB, Php et PhpMyAdmin<\/h4>\n\n\n\n
\n

# apt install apache2 mariadb-server php-{xml,pear,imap,intl,common,json,curl,mbstring,mysql,gd,imagick,zip,opcache,sqlite3} libapache2-mod-php<\/p>\n<\/blockquote>\n\n\n\n

Et j'ajoute PhpMyAdmin :<\/p>\n\n\n\n

\n

# apt install phpmyadmin<\/p>\n<\/blockquote>\n\n\n\n

4. Cr\u00e9ation de l'utilisateur vmail<\/h4>\n\n\n\n
\n

# useradd -r -u 501 -g mail -d \/var\/vmail -s \/sbin\/nologin -c \"Virtual Mail User\" vmail
# mkdir \/var\/vmail
# chmod -R 770 \/var\/vmail
# chown -R vmail:mail \/var\/vmail<\/p>\n<\/blockquote>\n\n\n\n

5. Cr\u00e9ation de la base de donn\u00e9es<\/h4>\n\n\n\n
\n

# mysql<\/p>\n<\/blockquote>\n\n\n\n

On cr\u00e9e la base de donn\u00e9es, l'utilisateur postfixadmin et son mot de passe :<\/p>\n\n\n\n

\n

MariaDB [(none)]> CREATE DATABASE postfixadmin;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON postfixadmin.* TO 'postfixadmin'@'localhost' IDENTIFIED BY 'monsupermotdepa55es\u00e9curis\u00e9!';<\/p>\n<\/blockquote>\n\n\n\n

J'ajoute mon utilisateur d'administration sql pour ne pas se connecter en root dans PhpMyAdmin<\/p>\n\n\n\n

\n

MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'papadakis'@'localhost' IDENTIFIED BY 'monsupermotdepa55eadmin!' WITH GRANT OPTION;<\/p>\n<\/blockquote>\n\n\n\n

On applique les droits :<\/p>\n\n\n\n

\n

MariaDB [(none)]> FLUSH PRIVILEGES;
\nQuery OK, 0 rows affected (0,001 sec)<\/b>

\nMariaDB [(none)]> quit<\/p>\n<\/blockquote>\n\n\n\n

6. Installation et configuration de postfix<\/h4>\n\n\n\n
\n

# apt install postfix-mysql<\/p>\n<\/blockquote>\n\n\n\n

Dans l'outil de configuration, on choisit l'option Site Internet<\/q> et on donne le fqdn<\/strong>.<\/p>\n\n\n\n

Il faut ensuite cr\u00e9er plusieurs fichiers de configuration :<\/p>\n\n\n\n

    \n
  • Pour r\u00e9cup\u00e9rer la destination de l'alias d'une bo\u00eete :<\/li>\n<\/ul>\n\n\n\n
    \n

    # nano \/etc\/postfix\/mysql_virtual_alias_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

    \n

    user = postfixadmin
    \npassword = monsupermotdepa55es\u00e9curis\u00e9!
    \nhosts = localhost
    \ndbname = postfixadmin
    \nquery = SELECT goto FROM alias WHERE address='%s' AND active = '1'
    <\/p>\n<\/blockquote>\n\n\n\n

      \n
    • Pour r\u00e9cup\u00e9rer le domaine :<\/li>\n<\/ul>\n\n\n\n
      \n

      # nano \/etc\/postfix\/mysql_virtual_domains_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

      \n

      user = postfixadmin
      \npassword = monsupermotdepa55es\u00e9curis\u00e9!
      \nhosts = localhost
      \ndbname = postfixadmin
      \nquery = SELECT domain FROM domain WHERE domain='%s' AND active = '1'<\/p>\n<\/blockquote>\n\n\n\n

        \n
      • Pour r\u00e9cup\u00e9rer le chemin de stockage d'une bo\u00eete :<\/li>\n<\/ul>\n\n\n\n
        \n

        # nano \/etc\/postfix\/mysql_virtual_mailbox_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

        \n

        user = postfixadmin
        \npassword = monsupermotdepa55es\u00e9curis\u00e9!
        \nhosts = localhost
        \ndbname = postfixadmin
        \nquery = SELECT maildir FROM mailbox WHERE username='%s' AND active = '1'<\/p>\n<\/blockquote>\n\n\n\n

          \n
        • Pour r\u00e9cup\u00e9rer la destination d'un alias de domaine :<\/li>\n<\/ul>\n\n\n\n
          \n

          # nano \/etc\/postfix\/mysql_virtual_alias_domain_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

          \n

          user = postfixadmin
          \npassword = monsupermotdepa55es\u00e9curis\u00e9!
          \nhosts = localhost
          \ndbname = postfixadmin
          \nquery = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('%u', '@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1'<\/p>\n<\/blockquote>\n\n\n\n

            \n
          • Pour r\u00e9cup\u00e9rer le chemin d'un alias de domaine :<\/li>\n<\/ul>\n\n\n\n
            \n

            # nano \/etc\/postfix\/mysql_virtual_alias_domain_mailbox_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

            \n

            user = postfixadmin
            \npassword = monsupermotdepa55es\u00e9curis\u00e9!
            \nhosts = localhost
            \ndbname = postfixadmin
            \nquery = SELECT maildir FROM mailbox,alias_domain WHERE alias_domain.alias_domain = '%d' and mailbox.username = CONCAT('%u', '@', alias_domain.target_domain) AND mailbox.active = 1 AND alias_domain.active='1'<\/p>\n<\/blockquote>\n\n\n\n

              \n
            • Pour r\u00e9cup\u00e9rer le quota d'une bo\u00eete :<\/li>\n<\/ul>\n\n\n\n
              \n

              # nano \/etc\/postfix\/mysql_virtual_mailbox_limit_maps.cf<\/p>\n<\/blockquote>\n\n\n\n

              \n

              user = postfixadmin
              \npassword = monsupermotdepa55es\u00e9curis\u00e9!
              \nhosts = localhost
              \ndbname = postfixadmin
              \nquery = SELECT quota FROM mailbox WHERE username='%s' AND active = '1'<\/p>\n<\/blockquote>\n\n\n\n

                \n
              • R\u00e9cup\u00e9rer le chemin d'un alias catch-all<\/li>\n<\/ul>\n\n\n\n
                \n
                \n

                # nano \/etc\/postfix\/mysql_virtual_alias_domain_catchall_maps.cf<\/p>\n<\/div><\/div>\n<\/blockquote>\n\n\n\n

                \n

                user = postfixadmin
                \npassword = monsupermotdepa55es\u00e9curis\u00e9!
                \nhosts = localhost
                \ndbname = postfixadmin
                \nquery = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1'<\/p>\n<\/blockquote>\n\n\n\n

                Il faut ensuite changer la configuration de \/etc\/postfix\/main.cf. On peut le faire en ligne de commande :<\/p>\n\n\n\n

                \n

                # postconf -e \"myhostname = $(hostname -f)\"
                # postconf -e \"mydestination = localhost\"
                # postconf -e \"mynetworks = 127.0.0.0\/8\"
                # postconf -e \"inet_protocols = ipv4\"
                # postconf -e \"inet_interfaces = all\"
                # postconf -e \"smtpd_tls_cert_file = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem\"
                # postconf -e \"smtpd_tls_key_file = \/etc\/ssl\/private\/ssl-cert-snakeoil.key\"
                # postconf -e \"smtpd_use_tls = yes\"
                # postconf -e \"smtpd_tls_auth_only = yes\"
                # postconf -e \"smtpd_sasl_type = dovecot\"
                # postconf -e \"smtpd_sasl_path = private\/auth\"
                # postconf -e \"smtpd_sasl_auth_enable = yes\"
                # postconf -e \"smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination\"
                # postconf -e \"virtual_transport = lmtp:unix:private\/dovecot-lmtp\"
                # postconf -e \"virtual_mailbox_domains = proxy:mysql:\/etc\/postfix\/mysql_virtual_domains_maps.cf\"
                # postconf -e \"virtual_alias_maps = proxy:mysql:\/etc\/postfix\/mysql_virtual_alias_maps.cf, proxy:mysql:\/etc\/postfix\/mysql_virtual_alias_domain_maps.cf, proxy:mysql:\/etc\/postfix\/mysql_virtual_alias_domain_catchall_maps.cf\"
                # postconf -e \"virtual_mailbox_maps = proxy:mysql:\/etc\/postfix\/mysql_virtual_mailbox_maps.cf, proxy:mysql:\/etc\/postfix\/mysql_virtual_alias_domain_mailbox_maps.cf\"<\/p>\n<\/blockquote>\n\n\n\n

                On modifie ensuite le fichier \/etc\/postfix\/master.cf<\/p>\n\n\n\n

                \n

                smtp inet n - y - - smtpd
                #smtp inet n - y - 1 postscreen
                #smtpd pass - - y - - smtpd
                #dnsblog unix - - y - 0 dnsblog
                #tlsproxy unix - - y - 0 tlsproxy
                # Choose one: enable submission for loopback clients only, or for any client.
                #127.0.0.1:submission inet n - y - - smtpd
                submission inet n - y - - smtpd
                -o syslog_name=postfix\/submission
                -o smtpd_tls_security_level=encrypt
                -o smtpd_sasl_auth_enable=yes
                # -o smtpd_tls_auth_only=yes
                # -o smtpd_reject_unlisted_recipient=no
                # Instead of specifying complex smtpd__restrictions here,
                # specify \"smtpd__restrictions=$mua__restrictions\"
                # here, and specify mua__restrictions in main.cf (where
                # \"\" is \"client\", \"helo\", \"sender\", \"relay\", or \"recipient\").
                # -o smtpd_client_restrictions=
                # -o smtpd_helo_restrictions=
                # -o smtpd_sender_restrictions=
                # -o smtpd_relay_restrictions=
                -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
                -o milter_macro_daemon_name=ORIGINATING
                # Choose one: enable submissions for loopback clients only, or for any client.
                #127.0.0.1:submissions inet n - y - - smtpd
                #submissions inet n - y - - smtpd
                smtps inet n - y - - smtpd
                # -o syslog_name=postfix\/submissions
                -o syslog_name=postfix\/smtps
                # -o smtpd_tls_wrappermode=yes
                -o smtpd_sasl_auth_enable=yes
                # -o smtpd_reject_unlisted_recipient=no
                # Instead of specifying complex smtpd__restrictions here,
                # specify \"smtpd__restrictions=$mua__restrictions\"
                # here, and specify mua__restrictions in main.cf (where
                # \"\" is \"client\", \"helo\", \"sender\", \"relay\", or \"recipient\").
                -o smtpd_client_restrictions=permit_sasl_authenticated,reject
                # -o smtpd_helo_restrictions=
                # -o smtpd_sender_restrictions=
                # -o smtpd_relay_restrictions=
                # -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
                -o milter_macro_daemon_name=ORIGINATING<\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/xxx><\/p>\n<\/blockquote>\n\n\n\n

                7. Installation et configuration de dovecot<\/h4>\n\n\n\n
                \n

                apt install dovecot-mysql dovecot-imapd dovecot-pop3d dovecot-lmtpd<\/p>\n<\/blockquote>\n\n\n\n

                On modifie le fichier \/etc\/dovecot\/conf.d\/10-auth.conf en ajoutant login sur cette ligne :<\/p>\n\n\n\n

                \n

                auth_mecanisms = plain login<\/p>\n<\/blockquote>\n\n\n\n

                Puis on commente !include auth-system.conf.ext et on d\u00e9commente #!include auth-sql.conf.ext<\/p>\n\n\n\n

                \n

                #!include auth-system.conf.ext
                \n!include auth-sql.conf.ext<\/p>\n<\/blockquote>\n\n\n\n

                On modifie le fichier \/etc\/dovecot\/dovecot-sql.conf.ext<\/p>\n\n\n\n

                \n

                driver = mysql
                connect = host=localhost dbname=postfixadmin user=postfixadmin password=monsupermotdepa55es\u00e9curis\u00e9!
                default_pass_scheme = MD5-CRYPT
                password_query = SELECT username as user, password, '\/var\/vmail\/%d\/%n' as userdb_home, 'maildir:\/var\/vmail\/%d\/%n' as userdb_mail, 150 as userdb_uid, 8 as userdb_gid FROM mailbox WHERE username = '%u' AND active = '1'
                user_query = SELECT '\/var\/vmail\/%d\/%u' as home, 'maildir:\/var\/vmail\/%d\/%u' as mail, 150 AS uid, 8 AS gid, concat('dirsize:storage=', quota) AS quota FROM mailbox WHERE username = '%u' AND active = '1'<\/p>\n<\/blockquote>\n\n\n\n

                On modifie le fichier \/etc\/dovecot\/conf.d\/10-mail.conf<\/p>\n\n\n\n

                \n

                mail_location = maildir:\/var\/vmail\/%d\/%n
                mail_uid = vmail
                mail_gid = mail
                mail_privileged_group = mail
                first_valid_uid = 150
                last_valid_uid = 150<\/p>\n<\/blockquote>\n\n\n\n

                On v\u00e9rifie que la ligne ssl=yes est bien d\u00e9comment\u00e9e dans \/etc\/dovecot\/conf.d\/10-ssl.conf<\/p>\n\n\n\n

                On passe \u00e0 la configuration de dovecot, dans \/etc\/dovecot\/conf.d\/10-master.conf, on cherche la section du service lmtp et on l'\u00e9dite ainsi :<\/p>\n\n\n\n

                \n

                service lmtp {
                unix_listener \/var\/spool\/postfix\/private\/dovecot-lmtp {
                mode = 0600
                user = postfix
                group = postfix
                }
                }<\/p>\n<\/blockquote>\n\n\n\n

                De m\u00eame avec le service auth :<\/p>\n\n\n\n

                \n

                service auth {
                unix_listener \/var\/spool\/postfix\/private\/auth {
                mode = 0666
                user = postfix
                group = postfix
                }

                unix_listener auth-userdb {
                mode = 0600
                user = vmail
                }
                user = dovecot
                }<\/p>\n<\/blockquote>\n\n\n\n

                et pour le service auth-worker :<\/p>\n\n\n\n

                \n

                service auth-worker {
                user = vmail
                }<\/p>\n<\/blockquote>\n\n\n\n

                Enfin on change les permissions et on red\u00e9marre le service<\/p>\n\n\n\n

                \n

                # chown -R vmail:dovecot \/etc\/dovecot
                # chmod -R o-rwx \/etc\/dovecot
                # systemctl restart postfix dovecot<\/p>\n<\/blockquote>\n\n\n\n

                8. Installation de PostfixAdmin<\/h4>\n\n\n\n

                Comme on est sur debian 12, \u00e0 l'heure o\u00f9 j'\u00e9cris, le paquet postfixadmin existe<\/p>\n\n\n\n

                \n

                # apt install postfixadmin<\/p>\n<\/blockquote>\n\n\n\n

                On cr\u00e9e un fichier \/etc\/postfixadmin\/config.local.php :<\/p>\n\n\n\n

                \n

                <?php
                $CONF['database_type'] = 'mysql';
                $CONF['database_host'] = 'localhost';
                $CONF['database_user'] = 'postfixadmin';
                $CONF['database_password'] = 'monsupermotdepa55es\u00e9curis\u00e9!';
                $CONF['database_name'] = 'postfixadmin';
                $CONF['configured'] = true;
                ?><\/p>\n<\/blockquote>\n\n\n\n

                Avec un navigateur, on va sur : http:\/\/ADRESSE_IP_DU_SERVEUR\/postfixadmin\/setup.php<\/p>\n\n\n\n

                Il faut g\u00e9n\u00e9rer le hash du mot de passe monsupermotdepa55es\u00e9curis\u00e9! , on le rentre deux fois dans Generate setup_password. La page le renvoi, on colle la ligne dans \/etc\/postfixadmin\/config.local.php<\/p>\n\n\n\n

                \n

                $CONF['setup_password'] = '$2y$10$D\/ZeiL3PWIILin\/9sa.a2.GigUeh\/3ufTpdwaosm3SSqLxHXwhzXG';<\/p>\n<\/blockquote>\n\n\n\n

                On rafra\u00eechit la page et cette fois, on de logue via l'invite Login with setup_password. <\/p>\n\n\n\n

                Il faut fixer les erreurs s'il y en a. (Ici, j'ai juste r\u00e9initialis\u00e9 le mot de passe de postfixadmin dans PhpMyAdmin. Cela a suffit pour fixer 3 erreurs.)<\/p>\n\n\n\n

                Il faut maintenant cr\u00e9er l'administrateur postfix avec une adresse mel existante.<\/p>\n\n\n\n

                Une fois cr\u00e9er, on peut se loguer sur http:\/\/ADRESSE_IP_DU_SERVEUR\/postfixadmin\/login.php<\/p>\n\n\n\n

                \"\"<\/a><\/figure>\n\n\n\n

                Et l'aventure peut commencer !<\/p>\n","protected":false},"excerpt":{"rendered":"

                Pour m'affranchir de tout t\u00e9l\u00e9chargement sur les plateformes ad hoc, j'ai choisi de faire mon installation sur une debian 12 (freeze des paquets la semaine prochaine, sortie pr\u00e9vue cet \u00e9t\u00e9). 1. Mise \u00e0 jour Commen\u00e7ons par un classique : # apt update && apt dist-upgrade 2. Le hostname On donne au serveur son fqdn : […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-497","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/pages\/497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tty.tartux.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=497"}],"version-history":[{"count":50,"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/pages\/497\/revisions"}],"predecessor-version":[{"id":568,"href":"https:\/\/tty.tartux.net\/index.php?rest_route=\/wp\/v2\/pages\/497\/revisions\/568"}],"wp:attachment":[{"href":"https:\/\/tty.tartux.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}